Issue Date:

Revision:

Anna Mulingbayan

SGNOG 4

18 Aug 2015

IPv4 transfers

2

Who can do the transfer?

• Transfer of IPv4 between you and– Other APNIC Members– Members from other RIR’s eg. ARIN

• Transfer between APNIC Members- So far SG has a total of 43 transfers- Transfer logs http://ftp.apnic.net/transfers/apnic/

• Transfer between APNIC and RIR– Transfer from RIR Member to APNIC Member, or vice versa– Source account to initiate transfer request– Registry of the recipient account to evaluate transfer request– More information on: www.apnic.net/transfer

3

How many transfers are we doing?

2010 2011 2012 2013 2014 20150

20

40

60

80

100

120

140

160

180

4

How to do the transfer in MyAPNIC? (source account)

5

MyAPNIC (source account)

6

MyAPNIC(recipient account)

7

Tips• Pre-approval

– allows you to demonstrate your need for the IPv4 block in advance– process is faster as the evaluation is done beforehand– complete the “Transfer pre-approval” form via MyAPNIC– more information at http://www.apnic.net/pre-approval

• IPv4 Transfer listing service– list Members who have received pre-approval on APNIC website to

allow others with excess IPv4 to contact you– More information at http://www.apnic.net/pre-approval-listing

• APNIC Transfers Mailing List– facilitate discussion on topics related to IPv4 transfer– to subscribe please go to www.apnic.net/mailing-lists

Issue Date:

Revision:

RPKI

9

Why use RPKI?

• Prevent route hijacking

– Only the rightful custodian can originate the prefix announcement – ISPs filter prefixes they propagate

• Minimize common routing errors

– Limits human errors– Prioritize routes with certificates

10

What is RPKI?

Resource Public Key Infrastructure(RPKI)

• A robust security framework for verifying the association between resource holders and their Internet resources

• Uses x.509 certificates with RFC3779 extensions

• Collaborative effort by all RIRs to help secure Internet routing by validating routes

11

How to use RPKI?• Create Route Origin Authorization (ROA) objects

• What’s contained in a ROA– The AS number you have authorized– The prefix that is being originated from it– The most specific prefix (maximum length) that the AS may

announce

For example: “AS64496 originates a route for the prefix 2001:DB8::/32 with a maximum prefix length of /40)”

12

Creating ROA in MyAPNIC• What you need to have before creating a ROA

– Must be an APNIC Member– Have access to MyAPNIC with 2 factor authentication

• Takes only 5 minutes to create, and 10 minutes to be visible to the public

13

Creating your ROA (Using suggestions)

14

Creating your ROA (Manual)

15

Created your ROA, what’s next?

• Maintain your ROAs - Changed BGP announcement - New delegation - Transferred resources

• RPKI validator - https://trac.rpki.net/wiki/doc/RPKI - Valid - Invalid - Unknown

16

ROA in South East Asia

EconomyRoa

IPv4 total IPv4 Roa IPv4 % IPv6 total IPv6 roa IPv6 pctcount

ID 1 17666560 65536 0.37096073 3204484864 0 0

MY 2 6490880 35840 0.5521593371476404224 0 0

PH 18 5352704 185088 3.457841121872419840 256 0.000029344

SG 14 5165568 78080 1.51154723 2315278848 67109376 2.898543994

* As at 5 Aug 2015

17

Success Story

• May 2015: APNIC Outreach in Bangladesh– 13 organizations visited– Onsite support to create ROA objects

561 valid prefixes (24%)

http://rpki.surfnet.nl/bd.html

18

World Leaderboard (economy)

http://rpki.surfnet.nl/country.html

As of June 10, 2015

19

You’re Invited!• APNIC 40: Jakarta, Indonesia from 3 - 10 Sept 2015

THANK YOUwww.facebook.com/APNIC

www.twitter.com/apnic

www.youtube.com/apnicmultimedia

www.flickr.com/apnic

www.weibo.com/APNICrir