Issue Date:
Revision:
Anna Mulingbayan
SGNOG 4
18 Aug 2015
IPv4 transfers
2
Who can do the transfer?
• Transfer of IPv4 between you and– Other APNIC Members– Members from other RIR’s eg. ARIN
• Transfer between APNIC Members- So far SG has a total of 43 transfers- Transfer logs http://ftp.apnic.net/transfers/apnic/
• Transfer between APNIC and RIR– Transfer from RIR Member to APNIC Member, or vice versa– Source account to initiate transfer request– Registry of the recipient account to evaluate transfer request– More information on: www.apnic.net/transfer
3
How many transfers are we doing?
2010 2011 2012 2013 2014 20150
20
40
60
80
100
120
140
160
180
4
How to do the transfer in MyAPNIC? (source account)
5
MyAPNIC (source account)
6
MyAPNIC(recipient account)
7
Tips• Pre-approval
– allows you to demonstrate your need for the IPv4 block in advance– process is faster as the evaluation is done beforehand– complete the “Transfer pre-approval” form via MyAPNIC– more information at http://www.apnic.net/pre-approval
• IPv4 Transfer listing service– list Members who have received pre-approval on APNIC website to
allow others with excess IPv4 to contact you– More information at http://www.apnic.net/pre-approval-listing
• APNIC Transfers Mailing List– facilitate discussion on topics related to IPv4 transfer– to subscribe please go to www.apnic.net/mailing-lists
Issue Date:
Revision:
RPKI
9
Why use RPKI?
• Prevent route hijacking
– Only the rightful custodian can originate the prefix announcement – ISPs filter prefixes they propagate
• Minimize common routing errors
– Limits human errors– Prioritize routes with certificates
10
What is RPKI?
Resource Public Key Infrastructure(RPKI)
• A robust security framework for verifying the association between resource holders and their Internet resources
• Uses x.509 certificates with RFC3779 extensions
• Collaborative effort by all RIRs to help secure Internet routing by validating routes
11
How to use RPKI?• Create Route Origin Authorization (ROA) objects
• What’s contained in a ROA– The AS number you have authorized– The prefix that is being originated from it– The most specific prefix (maximum length) that the AS may
announce
For example: “AS64496 originates a route for the prefix 2001:DB8::/32 with a maximum prefix length of /40)”
12
Creating ROA in MyAPNIC• What you need to have before creating a ROA
– Must be an APNIC Member– Have access to MyAPNIC with 2 factor authentication
• Takes only 5 minutes to create, and 10 minutes to be visible to the public
13
Creating your ROA (Using suggestions)
14
Creating your ROA (Manual)
15
Created your ROA, what’s next?
• Maintain your ROAs - Changed BGP announcement - New delegation - Transferred resources
• RPKI validator - https://trac.rpki.net/wiki/doc/RPKI - Valid - Invalid - Unknown
16
ROA in South East Asia
EconomyRoa
IPv4 total IPv4 Roa IPv4 % IPv6 total IPv6 roa IPv6 pctcount
ID 1 17666560 65536 0.37096073 3204484864 0 0
MY 2 6490880 35840 0.5521593371476404224 0 0
PH 18 5352704 185088 3.457841121872419840 256 0.000029344
SG 14 5165568 78080 1.51154723 2315278848 67109376 2.898543994
* As at 5 Aug 2015
17
Success Story
• May 2015: APNIC Outreach in Bangladesh– 13 organizations visited– Onsite support to create ROA objects
561 valid prefixes (24%)
http://rpki.surfnet.nl/bd.html
18
World Leaderboard (economy)
http://rpki.surfnet.nl/country.html
As of June 10, 2015
19
You’re Invited!• APNIC 40: Jakarta, Indonesia from 3 - 10 Sept 2015
THANK YOUwww.facebook.com/APNIC
www.twitter.com/apnic
www.youtube.com/apnicmultimedia
www.flickr.com/apnic
www.weibo.com/APNICrir