- Test - lists.nanog.org

RE: Understanding impact of RPKI and ROA on existing advertisements
by Jakob Heitz (jheitz) 04 Nov '22

04 Nov '22

There are a lot of ROAs out there that make it EASIER to hijack a route rather than harder. If you register an ROA for a route and also advertise that route in BGP, then an attacker who prepends your ASN has to at least compete with your route with an AS_PATH length and will lose in most of the Internet (but not all of it). However, if you don't advertise the route, then the attacker has nothing to compete with and his prepended route will be accepted as RPKI valid everywhere. Remember max_length in a ROA. All routes covered by that max_length will be considered valid by RPKI if the origin ASN matches. If you don't advertise them all, then you are just making it EASIER for an attacker to hijack them. For example if you have an ROA for 10.1.0.0/16, max_length 17, that includes the routes: 10.1.0.0/16 10.1.0.0/17 10.1.128.0/17 If you don't advertise all those routes in BGP, they are open to being hijacked and considered RPKI valid. OTOH, if you register the ROA as 10.1.0.0/16 max_length 16, then anyone who tries to advertise 10.1.0.0/17 will have their advertisement rejected as RPKI invalid. I'm aware that people create ROAs for more specifics in case they need to advertise them to break a hijack. But then the hijacker could just advertise the longest prefix allowed by the ROA. You can't break that with a yet more specific. Unless the user of the route is not validating with RPKI. It's a conundrum. Regards, Jakob.

2 1

WATCH NOW | NANOG 86 Talks, NANOG U + "Internet Innovators"
by Nanog News 03 Nov '22

03 Nov '22

*NANOG 86 Talks are LIVE! * Have you subscribed to our Youtube channel? Subscribe now <https://www.youtube.com/channel/UCIvcN8QNgRGNW9osYLGsjQQ> and be the first to know when new videos are uploaded. The full webcast is available in the "NANOG 86" playlist. *WATCH NOW * <https://www.youtube.com/playlist?list=PLO8DR5ZGla8jtquZaIDizi3q-GnoUgrQQ> *VIDEO: NANOG U Provides Incredible Opportunities for NexGen Tech* *City of Montgomery hosted the two-day event * >From networking opportunities with top-tier tech reps to educational info + career tips from industry leaders — NANOG U is the ultimate foot in the door for anyone interested in pursuing the technical field! Recently, the City of Montgomery hosted our two-day NANOG U Fall 2022 Tour. ARIN, ICANN, Amazon Web Services, Microsoft, + more were in attendance. *WATCH NOW * <https://www.nanog.org/news-stories/nanog-tv/nanog-u/nanog-u-fall-2022-tour-…> *New Episode of "Internet Innovators"* *"Father of the African Internet" Nii Quaynor talks to NANOG* If you watch "Internet Innovators" in Africa, you have Nii Quaynor to thank. Quaynor has pioneered internet development and expansion throughout Africa and is responsible for the first Internet connectivity throughout the continent. *WATCH NOW to learn:* - His story - The current status of the Internet in Africa (post-pandemic) - "Building the Blockchain" + why he thinks Africa should be a cashless society - How to introduce innovation to a new culture - His next five years - + More *WATCH NOW * <https://www.nanog.org/news-stories/nanog-tv/internet-innovators/internet-in…> *2022 NANOG Elections Results* The 2022 NANOG election results are in! Board of Directors Candidates Proposed Bylaw Changes Key Dates Election Results For a full overview and final results click below. *VIEW NOW * <https://www.nanog.org/members/elections/past-elections/2022-nanog-elections…>

1 0

DNS OARC 40 - Call for Contribitions
by John Todd 03 Nov '22

03 Nov '22

OARC 40 will be a two-day hybrid meeting held on 16 & 17 February in Atlanta (GA), USA at 10:00 AM (Local time - EST (UTC-05:00)). The onsite part of the meeting will be colocated with NANOG 87. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency - Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT The presentations can be either a full-length presentation - 20 mins (+5 mins Q/A) or a lightning presentation - 10 mins (+5 mins for Q/A) Workshop Milestones: 2022-10-22 Submissions open via Indico 2022-12-20 Deadline for submission (23:59 UTC) 2023-01-10 Preliminary list of contributions published 2023-01-17 Full agenda published 2023-01-30 Deadline for slideset submission and Rehearsal 2023-02-16 OARC 40 Workshop - Day1 2023-02-17 OARC 40 Workshop - Day2 The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc40> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft > slides are acceptable on submission. Guidelines for presentation > slides: https://www.grammarly.com/blog/presentation-tips/ Additional information for speakers of OARC 40 - Your talk will be broadcast live and recorded for future reference - Your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting - Remote speakers have mandatory rehearsal on 2023-01-31 at 14:00 UTC. It would be very useful to have your slides (even if draft) ready for this. Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net John Todd, for the DNS-OARC Programme Committee OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- John Todd - jtodd(a)quad9.net General Manager - Quad9 Recursive Resolver

1 0

Understanding impact of RPKI and ROA on existing advertisements
by Samuel Jackson 02 Nov '22

02 Nov '22

Hello, I am new to RPKI/ROA and still learning about RPKI. From all my reading on ARIN's documents I am not able to answer some of my questions. We have a public ARIN block and advertise smaller subnets from that to our ISP's. We do not have any RPKI configs. We need to setup ROA's to take another subnet from the ARIN block to AWS. Reading ARIN's docs, it seems I need to get setup on their Hosted RPKI service after which I can configure ROA's for the networks I am taking to AWS. My question is, will this impact my existing advertisements to my ISP's. The current advertisements do not have ROA's. Will having RPKI for my ARIN network, without ROA's for the existing advertisements impact me? Thanks for your help. Ref: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html https://www.arin.net/resources/manage/rpki/roa_request/ https://www.arin.net/resources/manage/rpki/hosted/

10 12

ARIN RPA updated (again) to address TAL distribution (Re: ARIN RPKI services terms/conditions - Change to Management of the Trust Anchor Locator for ARIN’s RPKI Service)
by Christopher S. Yoo 02 Nov '22

02 Nov '22

As the coauthors of the 2019 NSF-supported report that contributed to the current momentum toward overcoming the barriers RPKI adoption, a prior posting asked for our assessment of the changes. Our apologies that we won't be able to join you at this NANOG. We hope to put together some type of program in Atlanta in February. We would say that intent of ARIN's Sept. 26 and 29 updates ((link<https://www.arin.net/announcements/2022/documents/rpa_092622_redline.pdf> and link<https://www.arin.net/announcements/2022/documents/rpa_092922_redline.pdf>) to the RPA-to permit distribution of the TAL without signing the RPA-represent positive steps to address the most significant concern that we raised. In particular, the language in Section 5 added by the Sept. 29 update explicitly stating, "Notwithstanding the foregoing, You are specifically allowed to publicly distribute the ARIN TAL, including by embedding the ARIN TAL in relying party software," appears to authorize including ARIN's TAL in all distributions of validator software, and RPKI adopters would no longer need to download ARIN's TAL from its website. If effective, this is would remove the single most important legal obstacle to broader use of RPKI. The continuing wrinkle is that Section 5 authorizes distribution of ORCP services (including the ARIN TAL) only as permitted by the ORCP service terms. Section 9 requires third parties receiving this information either to have agreed to the RPA or to have entered into an agreement with the distributing party that includes the key terms of the RPA. That would suggest that anyone distributing validator software with ARIN's TAL must ensure that the recipient has agreed to the RPA in order to avoid violating the ORCP service terms. Although open source typically relies on licenses that are good against all users regardless of knowledge or assent (because they sound in property instead of contract), assent to the terms of the RPA could be incorporated into the distribution process, perhaps in the same manner used for other certificate authorities, which typically have terms of use. Another comment on this thread asked if ARIN has now addressed the other issues raised by our report. It is our assessment that ARIN has adequately addressed three of our other concerns, has announced its intention to address two others, and partially addressed one. The three issues that ARIN has adequately addressed include: * Dropping provision of the RSA requiring legacy address holders to acknowledge ARIN's property rights in IP addresses: dropped in update to LRSA dated Sept. 12, 2022 (link<https://www.arin.net/about/corporate/agreements/rsav13_changes.pdf>). * Drop provision of RPA prohibiting sharing of RPKI-derived data in a machine-readable format: authorized for informational purposes by update to RPA dated Oct. 21, 2019 (link<https://www.arin.net/vault/announcements/2019/20191021.html>); authorized for routing purposes by update to RPA dated Sept. 26, 2022 (link<https://www.arin.net/announcements/2022/documents/rpa_092622_redline.pdf>). * Better dissemination of best practices to the community: addressed by expansion of RPKI training at FISPA, WISPA, CaribNOG, and NANOG. ARIN has its intention to address two of our other concerns in the near future: * Better disclosure to government agencies of ARIN's willingness to waive insemination and choice of law clauses when barred by law: likely to be addressed by ARIN's announced plans to create webpage specifically for governments. * Better disclosure of operational practices, such as uptime, update frequency, and response expectations: likely to be addressed further by planned update to certificate practices statement. It partially addressed one concern that we raised. * Dropping blanket indemnification clause in favor of disclaimer of warranties and liability: revised RPA to exclude indemnification for ARIN's gross negligence by update to RPA dated Oct. 21, 2019 (link<https://www.arin.net/vault/announcements/2019/20191021.html>). We hope these comments are helpful and look forward to continuing to work with the community on removing the remaining legal barriers to RPKI adoption. Christopher Yoo (on behalf of myself and David Wishnick)

2 2

Equinix: Still looking for routeserver community info
by Elmar K. Bins 02 Nov '22

02 Nov '22

Hi folks, my inquiry kind of dead-ended here; I still have trouble in Warsaw (could be the name of a movie). Whether I send my prefix with NO_EXPORT, or with the secretly documented 24115:65281 (or 2 or 3) (from https://ix.equinix.com/portal/resources/mlpe-information) the routeserver just eats my prefix and doesn't forward... Does anybody have experience with getting the MLPE system to do what would be required (i.e., take the prefix, attach a NO_EXPORT, and forward)? Thanks! Elmar. PS: Anybody from Equinix wanting to shed some light on this, please...

1 0

Anyone from Verisign peering lurking?
by Bryan Holloway 02 Nov '22

02 Nov '22

Trying to resolve a peering issue; e-mails to listed contacts have been fruitless ... thanks!

1 0

NOTICE - Change in access to ARIN Online (was: Fwd: [arin-announce] ARIN to Enforce 2FA on all ARIN Online Accounts Starting 1 February 2023)
by John Curran 01 Nov '22

01 Nov '22

NANOGers - Important information - please note this change will affect how access to your ARIN Online account and related administration of your number resources. FYI, /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] ARIN to Enforce 2FA on all ARIN Online Accounts Starting 1 February 2023 Date: 1 November 2022 at 10:10:10 AM EDT To: "arin-announce(a)arin.net<mailto:arin-announce@arin.net>" <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> Beginning 1 February 2023, ARIN will require Two-Factor Authentication (2FA) on all ARIN Online accounts. Customers will be able to choose between Time-Based One-Time password (TOTP), SMS-based, and Fast Identity Online 2 (FIDO2). We had initially planned to enforce 2FA following the deployment of SMS-based 2FA, but we opted to delay the implementation of enforcing 2FA for all ARIN Online accounts until we were able to complete implementation of FIDO2 due to significant community feedback received during our community consultation (https://www.arin.net/announcements/20220524-consultopen/) on this change. FIDO2 support is pending release on 19 December 2022. You can learn more about your 2FA options by visiting our website: https://www.arin.net/reference/materials/security/twofactor/ By requiring 2FA for ARIN Online accounts that control number resources, the ARIN community should see stronger security for the registry, reduced risk of account fraud attempts, and increased confidence in the integrity of their ARIN resources. We strongly encourage account holders to set up 2FA in advance of the flag day for enforcement so that this change is not interruptive to your account access after 1 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) HELPFUL RESOURCES: Need help setting up your two-factor authentication? Visit https://www.arin.net/2fa to get started. You’ll find guides on enabling 2FA via an authenticator application such as Google Authenticator, SMS or Voice, and (coming soon) FIDO2. We also provide information on how to receive and save your 2FA recovery codes, as well as what to do if you’ve lost access to your authenticator or SMS/Voice phone number.

1 0

network configuration survey
by 徐惠三 01 Nov '22

01 Nov '22

Dear network operators, I hope this email finds you well. I am a first-year graduate student and I have been working on a survey for network configuration intent.I will be much appreciated if you could spare some time to answer my following questions. 1.For BGP communities, I have referred to BGP Community Guides | One Step for some communities opened by ISPs. I wonder if the ISPs will open all their communities and logics, or there are still more kept secret. If there are some secret community values and control logics, how can I make sure the community appended within my AS will not coincide with the ISPs' route maps and yield unexpected results? Have you ever observed similar errors? 2.Another question is about trouble-shooting. Suppose you find some errors in local AS (e.g cannot reach certain destination), yet you only have access to local RIBs or configurations. How do you try to fix it with these information? Is it necessary to refer to other ASes' information? If yes, which ASes are selected and how do you communicate with them? 3.Finally, I also want to know what are some of the properties to be expected if a tool is to be designed for the circumstance in question 2. Should it be privacy-preserving or scalable? What size of network is it expected to work on? And what is the expected processing time of the tool for different sizes of networks? You can fill in your answers at: https://docs.google.com/forms/d/e/1FAIpQLScQJIfQARRdZvk5Wmb5-sHvb02uZdE1NgZ… Thank you very much and I'm looking forward to hearing from you. Best regards, Huisan Xu

1 0

itojun
by Randy Bush 28 Oct '22

28 Oct '22

and the third giant to have died in october, itojun hagino died on this day in 2007. ipv6 owes a great debt to itojun; as do a bunch of other technoogies and many people. a wise and gentle soul. i dread october. randy http://www.itojun.org/itojun.html http://www.itojun.org/personal.html https://asiajin.com/blog/2007/10/jun-ichiro-itojun-hagino-dies-at-37-ipv6-d…

1 0