2. Welcome! APNIC Members Training Course Internet Resource Management I 27 April 2004, Melbourne

3. Introduction Presenters –Champika Wijayatunga Senior Training Specialist –Nurani Nimpuno Training Development Officer –Tim Jones Internet Resource Analyst

4. Assumptions & Objectives Assumptions –Are current or prospective APNIC member –Have not submitted many requests –Are not familiar / up-to-date with policies –Are not familiar with procedures Objectives –Teach members how to request resources from APNIC –Keep membership up-to-date with latest policies –Liaise with members Faces behind the e-mails

5. Schedule  Intro to APNIC Intro to APNIC  Policy development Policy development  Policies Policies  Whois DB intro Whois DB intro TEA BREAK (10:30 – 11:00)  Addressing plan Addressing plan  ISP request ISP request LUNCH (12:30 – 13:30)  ISP request evaluation ISP request evaluation  IP management IP management  2 nd opinion process 2 nd opinion process  DB protection & updates DB protection & updates  MyAPNIC MyAPNIC TEA BREAK (15:30 – 16:00)  ASN ASN  Reverse DNS Reverse DNS  Summary Summary

6. Introduction to APNIC Asia Pacific Network Information Centre

7. Overview What is APNIC? Regional Internet Registry APNIC structure What Does APNIC do ? APNIC Membership services Why APNIC ? APNIC resources APNIC environment APNIC responsibilities Intro

8. What is APNIC? RIR for the Asia Pacific Regional Internet Registry –Regional authority for Internet Resource distribution –IPv4 & IPv6 addresses, ASNs, reverse dns delegation Industry self-regulatory body – Non-profit, neutral and independent Open membership-based structure Intro

9. APNIC membership Intro Last Update Mar 2004

10. APNIC is not… Not a network operator –Does not provide networking services Works closely with APRICOT forum Not a standards body –Does not develop technical standards Works within IETF in relevant areas (IPv6 etc) Not a domain name registry or registrar Will refer queries to relevant parties Intro

11. APNIC structure Industry self-regulatory structure – Participation by those who use Internet resources – Consensus-based decision making Eg. Policy changes, db requirements etc – Open and transparent Meetings and mailing lists –Open to anyone Intro

12. APNIC region Intro

13. APNIC services & activities Resources Services IPv4, IPv6, ASN, reverse DNS Policy development –Approved and implemented by membership APNIC whois db –whois.apnic.net –Registration of resources –Routing Registry: irr.apnic.net Information dissemination APNIC meetings Publications –Web and ftp site –Newsletters, global resource reports –Mailing lists Open for anyone! Training Courses –Subsidised for members Co-ordination & liaison –With membership, other RIRs & other Internet Orgs.

14. Questions ? Material available at: www.apnic.net/training/recent/

15. Checkpoint question What is APNIC’s primary role? To distribute and manage Internet resources (IP addresses & AS numbers) in a fair and responsible manner

16. Policy Development in the Asia Pacific The APNIC Community & the Policy Development Process

17. What is the APNIC community? Open forum in the Asia Pacific –Open to any interested parties Voluntary participation Decisions made by consensus Public meetings Mailing lists –web archived A voice in regional Internet operations through participation in APNIC activities

18. Policy Development Industry self-regulatory processes –Open to all interested parties –Facilitated by RIR staff Policy implementation –RIR processes –ISPs and other affected parties

19. Participation in policy development Why should I bother? –Responsibility as an APNIC member To be aware of the current policies for managing address space allocated to you –Business reasons Policies affect your business operating environment and are constantly changing Ensure your ‘needs’ are met –Educational Learn and share experiences Stay abreast with ‘best practices’ in the Internet

20. Policy development cycle OPEN TRANSPARENT‘BOTTOM UP’ Anyone can participate All decisions & policies documented & freely available to anyone Internet community proposes and approves policy Need DiscussEvaluate Implement Consensus

21. How to make your voice heard Contribute on the public mailing lists http://www.apnic.net/community/lists/index.html Attend meetings –Or send a representative –Gather input at forums Give feedback –Training or seminar events

22. Come to the APNIC meeting! APNIC 18 Nadi, Fiji, 31 Aug- 3 Sep 2004 Participate in policy development Attend workshops, tutorials & presentations Exchange knowledge and information with peers Stay abreast with developments in the Internet View multicast online Provide your input in matters important to you http://www.apnic.net/meetings/

23. Policy making process description –http://www.apnic.net/docs/policy/dev/index.htmlhttp://www.apnic.net/docs/policy/dev/index.html Questions ? Material available at: www.apnic.net/training/recent/

24. Checkpoint question Who can propose Internet resource policy? Anyone can propose policy change! APNIC members, members of the community, APNIC staff or anyone interested in Internet policy!

25. Internet Registry Allocation and Assignment Policies

26. Overview of APNIC policies –Definitions –Background –Objectives –Environment –Allocation & Assignment Policies –Summary Policies

27. Allocation and Assignment Allocation “A block of address space held by an IR (or downstream ISP) for subsequent allocation or assignment” Not yet used to address any networks Assignment “A block of address space used to address an operational network” May be provided to LIR customers, or used for an LIR’s infrastructure (‘self-assignment’) Policies

28. Sub- Allocation /22 /8 APNIC Allocation Allocation and Assignment /24 /20 Member Allocation Customer Assignments /25 Policies /26 /27 /26 APNIC Allocates to APNIC Member APNIC Member Customer / End User Assigns to end-user Allocates to downstream Downstream Assigns to end-user

29. Portable & non-portable Portable Assignments –Customer addresses independent from ISP Keeps addresses when changing ISP –Bad for size of routing tables –Bad for QoS: routes may be filtered, flap- dampened Non-portable Assignments –Customer uses ISP’s address space Must renumber if changing ISP –Only way to effectively scale the Internet Policies 

30. Aggregation and “portability” Aggregation (Non-portable Assignments) (Portable Assignments) No Aggregation BGP Announcement (1) BGP Announcements (4) ISP Allocation Customer Assignments ISP Policies

31. Aggregation and “portability” ISP D ISP C ISP A ISP B Internet ISP D ISP C ISP A ISP B Internet Aggregation (Non-portable Assignments) (Portable Assignments) No Aggregation (4 routes) (21 routes) Policies

32. Address management objectives Conservation Efficient use of resources Based on demonstrated need Aggregation Limit routing table growth Support provider-based routing Registration Ensure uniqueness Facilitate trouble shooting

33. Why do we need policies ? - Global IPv4 Delegations (Pre-RIR) Policies

34. Growth of global routing table last updated 09 Mar 2004 http://bgp.potaroo.net/as1221/bgp-active.html Deployment Period of CIDR CIDR made it work for a while But they cannot be relied on forever Projected routing table growth without CIDR ISPs tend to filter longer prefixes Policies

35. Routing table prefix distribution Last updated Feb 2004 Policies

36. APNIC policy environment “IP addresses not freehold property” –Assignments & allocations on license basis Addresses cannot be bought or sold Internet resources are public resources ‘Ownership’ is contrary to management goals “Confidentiality & security” –APNIC to observe and protect trust relationship Non-disclosure agreement signed by staff Policies

37. APNIC allocation policies Aggregation of allocation –Provider responsible for aggregation –Customer assignments /sub-allocations must be non-portable Allocations based on demonstrated need –Detailed documentation required All address space held to be declared –Address space to be obtained from one source routing considerations may apply –Stockpiling not permitted Policies

38. Initial IPv4 allocation Initial (portable) allocation: /20 (4096 addresses). –The allocation can be used for further assignments to customers or your own infrastructure. Criteria 1a.Have used a /22 from upstream provider –Demonstrated efficient address usage OR 1b.Show immediate need for /22 Can include customer projections & infrastructure equipment 2.Detailed plan for use of /21 within 1 year 3.Renumber to new space within 1 year /20 /8 APNIC Non-portable assignment Portable assignment Member allocation Policies Policy will change Based on the APNIC 17 consensus

39. Initial IPv4 allocation criteria 1.LIR have used a /23 from their upstream provider or demonstrate an immediate need for a /23; and 2.Detailed plan for use of a /22 within a year 3.Renumber to new space within 1 year –Meet all policy requirements Applicants may be required to show purchase receipts IP Req APNIC 17 Consensus Min allocation size may be lowered from /20 to /21

40. APNIC allocation policies Transfer of address space –Not automatically recognised Return unused address space to appropriate IR Effects of mergers, acquisitions & take- overs –Will require contact with IR (APNIC) contact details may change new agreement may be required –May require re-examination of allocations requirement depends on new network structure Policies

41. Address assignment policies Assignments based on requirements Demonstrated through detailed documentation Assignment should maximise utilisation –minimise wastage Classless assignments showing use of VLSM Size of allocation –Sufficient for up to 12 months requirement Policies

42. Portable assignments Small multihoming assignment policy –For (small) organisations who require a portable assignment for multi-homing purposes Criteria 1a. Applicants currently multihomed OR 1b. Demonstrate a plan to multihome within 1 month 2. Agree to renumber out of previously assigned space –Demonstrate need to use 25% of requested space immediately and 50% within 1 year Portable assignment /8 APNIC /20 Member allocation Non-portable assignment Policies

43. Portable assignments for IXPs Criteria –3 or more peers –Demonstrate “open peering policy” APNIC has a reserved block of space from which to make IXP assignments

44. Supporting historical resource transfer Allow transfers of historical resources to APNIC members –no technical review or approval –historical resource holder must be verified –the recipient of the transfer must be an APNIC member –resources will then be considered "current" Existing historical resource holders will still be able to update their information as previously

45. Questions ? Material available at: www.apnic.net/training/recent/

46. Checkpoint question Why are portable assignments discouraged? Portable assignments cannot be aggregated and need therefore to be announced separately, adding to the growing size of the Global Routing Table

47. The APNIC Database Introduction and Usage

48. Overview What is the APNIC database? Why use it? Database query Database updating process DB Intro

49. What is the APNIC database? Public network management database Operated by IRs Tracks network resources IP addresses, ASNs, Reverse Domains, Routing policies Records administrative information Contact information (persons/roles) Authorisation DB Intro

50. Object types OBJECT PURPOSE personcontact persons rolecontact groups/roles inetnumIPv4 addresses inet6numIPv6 addresses aut-numAutonomous System number domainreverse domains routeprefixes being announced mntner(maintainer) data protection DB Intro http://www.apnic.net/db/

51. Attributes & Values An object is a set of attributes and values Each attribute of an object... Has a value Has a specific syntax Is mandatory or optional Is single- or multi-valued Some attributes... Are primary (unique) keys Are lookup keys for queries Are inverse keys for queries –Object “templates” illustrate this structure DB Intro

52. Object templates whois -t person: [mandatory] [single] [primary/look-up key] address: [mandatory] [multiple] [ ] country: [optional] [single] [ ] phone: [mandatory] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [look-up key] nic-hdl: [mandatory] [single] [primary/look-up key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] % whois -h whois.apnic.net -t person To obtain template structure*, use : DB Intro *Recognised by the RIPE whois client/server

53. Person object example –Person objects contain contact information person: address:address: country: phone: fax-no: e-mail: nic-hdl: mnt-by: changed: source: Attributes Values Ky Xander ExampleNet Service Provider 2 Pandora St Boxville Wallis and Futuna Islands WF +680-368-0844 +680-367-1797 kxander@example.com KX17-AP MAINT-WF-EX kxander@example.com 20020731 APNIC DB Intro

54. What is a nic-hdl? Unique identifier for a person Represents a person object –Referenced in objects for contact details (inetnum, aut-num, domain…) –format: Eg: KX17-AP DB Intro person: Ky Xander address: ExampleNet Service Provider address: 2 Pandora St Boxville address: Wallis and Futuna Islands country: WF phone: +680-368-0844 fax-no: +680-367-1797 e-mail: kxander@example.com nic-hdl: KX17-AP mnt-by: MAINT-WF-EX changed: kxander@example.com 20020731 source: APNIC

55. Inetnum object example –Contain IP address allocations / assignments inetnum: netname: descr: country: admin-c: tech-c: mnt-by: mnt-lower: remarks: changed: status: source: 202.51.64.0 - 202.51.95.255 CCNEP-NP-AP Communication & Communicate Nepal Ltd VSAT Service Provider, Kathmandu NP AS75 -AP AS75-AP APNIC-HM MAINT-NP-ARUN -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+- This object can only be updated by APNIC hostmasters.To update this object, please contact APNIC hostmasters and include your organisation's account name in the subject line. -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+- hostmaster@apnic.net 20010205 ALLOCATED PORTABLE APNIC DB Intro

56. Inter-related objects inetnum: 202.64.10.0 – 202.64.10.255 … admin-c: KX17-AP tech-c: ZU3-AP … mnt-by: MAINT-WF-EX … IPv4 addresses person: … nic-hdl: ZU3-AP … Contact info person: … nic-hdl: KX17-AP … Contact info mntner: MAINT-WF-EX… Data protection DB Intro

57. Admin-c and tech-c Responsibility – ‘admin’ contacts Legal authority Technical management Network planning, backbone design Deployment, capacity, and upgrade planning Expertise - ‘tech’ contacts Routing, aggregation, BGP, etc Addressing, subnetting, CIDR, etc DB Intro

58. whois.apnic.net whois.ripe.netwhois.arin.net Server Unix Client ‘X’ Client Command Prompt / Web Interface Windows Client HTTP/CGIClient WHOIS Queries & responses DB Intro Database query - architecture

59. Database query - clients Standard whois client Included with many Unix distributions –RIPE extended whois client http://ftp.apnic.net/apnic/dbase/tools/ripe-dbase- client.tar.gz Query via the APNIC website http://www.apnic.net/apnic-bin/whois2.pl Query clients - MS-Windows etc –Many available DB Intro

60. Why use the database? Register use of Internet Resources IP assignments, reverse DNS, etc –Ascertain custodianship of a resource –Fulfill responsibilities as resource holder Obtain details of technical contacts for a network Investigate security incidents Track source of network abuse or “spam” email DB Intro

61. Basic database queries Unix –whois –h whois.apnic.net Web interface –http://www.apnic.net/apnic-bin/whois2.plhttp://www.apnic.net/apnic-bin/whois2.pl Look-up keys –usually the object name –Check template for look-up keys DB Intro

62. Database query – look-up keys OBJECT TYPE ATTRIBUTES – LOOK-UP KEYS * *whois supports queries on any of these objects/keys name, nic-hdl, e-mail maintainer name network number, name domain name as number route value network number, name person role mntner inetnum domain aut-num route inet6num DB Intro

63. % whois zulrich@example.com % whois zu3-ap % whois “zane ulrich” DB Intro person: Zane Ulrich address: ExampleNet Service Provider address: 2 Pandora St Boxville address: Wallis and Futuna Islands country: WF phone: +680-368-0844 fax-no: +680-367-1797 e-mail: zulrich@example.com nic-hdl: ZU3-AP mnt-by: MAINT-WF-EX changed: zulrich@example.com 20020731 source: APNIC Database query - UNIX

64. Database query - web Query the APNIC Whois Database http://www.apnic.net/apnic-bin/whois2.pl 2.Search options (flags) 1.Type in search key 3. ‘Search Whois’ DB Intro

65. Database query - web DB Intro Need help? General search help Help tracking spam and hacking % [whois.apnic.net node-1] % How to use this server http://www.apnic.net/db/ % Whois data copyright termshttp://www.apnic.net/db/dbcopyright.html role: OPTUS IP ADMINISTRATORS address: Optus Communications address: 101 Miller Street address: North Sydney NSW 2060 country: AU phone: +61-2-93427681 phone: +61-2-93420848 phone: +61-2-93420983 phone: +61-2-93420813 phone: +61-2-93420717 fax-no: +61-2-9342-0998 fax-no: +61-2-9342-6122 e-mail: ipadmin@optus.net.au trouble: send spam/abuse reports to abuse@optus.net.au trouble: please use http://www.apnic.net/db/spam.html trouble: to identify networks before sending reports and trouble: always include full headers/logs. admin-c: NC8-AP tech-c:NC8-AP tech-c:CN39-AP tech-c:GE7-AP tech-c:PS176-AP nic-hdl: OA3-AP notify: hostmaster@optus.net.au mnt-by: MAINT-OPTUSCOM-AP changed: ipadmin@optus.net.au 20021120 source: APNIC Query the APNIC Whois Database Result of search on nic-hdl “OA3-AP” (‘Optus IP administrators’ role object)

66. Database query - inetnum Note Incomplete addresses padded with “.0” Address without prefix interpreted as “/32” % whois 203.127.128.0 - 203.127.159.255 % whois SINGNET-SG % whois 203.127.128.0/19 inetnum: 203.127.128.0 - 203.127.159.255 netname: SINGNET-SG descr: Singapore Telecommunications Ltd descr: 31, Exeter Road, #02-00, Podium Block descr: Comcentre, 0923 country: SG admin-c: CWL3-AP tech-c: CWL3-AP mnt-by: APNIC-HM status: ALLOCATED PORTABLE changed: hostmaster@apnic.net 19990803 source: APNIC DB Intro

67. Creating a person object Whois Database Guide: http://www.apnic.net/services/whois_guide.html 1.Fill out person object form on web Name, e-mail, phone, address etc Tick ‘MNT-NEW’ for temporary protection 2. Completed template is sent to you 3. Forward template to 4. Person object created and nic-hdl is generated DB Intro

68. LIR registration responsibilities 1.Create person objects for contacts To provide contact info in other objects 2.Create mntner object To provide protection of objects –(To be discussed later) 3.Create inetnum objects for all customer address assignments (Allocation object created by APNIC) DB Intro

69. The ‘public’ attribute To protect privacy if customer records –New attribute – “public” be added to: inetnum and inet6num objects “public”: YES = public data “public”: No = private data –(not to be revealed by whois queries) Default (missing attribute) = private data –Customer assignments registration is still mandatory To be implemented Sept 2004

70. inetnum : Allocation (Created by APNIC) 3 Using the db – step by step Customer Assignments (Created by LIR) person: nic-hdl: KX17-AP Contact info 1 Data Protection mntner: 2 inetnum:... KX17-AP... mnt-by:... 4 inetnum:... KX17-AP... mnt-by:... 5 inetnum:... KX17-AP... mnt-by:... 6 DB Intro

71. Database auto-responses Successful update SUCCEEDED Objects accepted Warnings Objects accepted but ambiguous Objects corrected and accepted Errors FAILED Objects NOT accepted Don’t understand the error message? 1.Help documentation http://www.apnic.net/docs/database-update-info.html 2. Contact Include the error message ?

72. Parse Database mailboxes Automatic request processing –Automatic “robot” for all db updates –Email template for create/update/delete Database service support –E-mails answered by APNIC staff –1 day response time DB 2

73. Summary Use the APNIC whois database To register information To search information –troubleshooting, tracking of spamming/hacking etc Create a person object Register all your assignments! Fulfill your responsibility as a resource holder DB Intro - for all updates!

74. Questions ? Material available at: www.apnic.net/training/recent/

75. Checkpoint question How can I query the APNIC whois Database? By using the web interface: http://www.apnic.net/apnic-bin/whois.pl or Unix command line: whois –h whois.apnic.net

76. Internet Registry Procedures Addressing Plan

77. Addressing plan To complete documentation –First need a technical PLAN Documenting the architecture of the present and eventual goal –IP addressing is fundamental part of network design –IP addressing ‘planning’ example to follow.. Addressing Plan

78. Some icons Router (layer 3, IP datagram forwarding) Network Access Server (layer 3, IP datagram forwarding ) Ethernet switch (layer 2, packet forwarding) Addressing Plan

79. Addressing plan Identify components of network –Customer services –ISP internal infrastructure Identify phases of deployment –Starting off, 6 months, 12 months Identify equipment and topology changes –Need for redundancy –Need for increased scale Addressing Plan

80. Network plan Starting off ’ Leased line services 5-8 customers Dialup services 16 modems Interconnected resilience Upstream ISP 15 hosts NOC operations 10 hosts Internal DNS,Web Mail servers ISP Infrastructure Customer services 5 hosts Virtual web (name based) Addressing Plan

81. Network plan WAN point to point /30 5 hosts 15 hosts 10 hosts Upstream ISP 16 dialup modems 5-8 leased line customers ‘ip unnumbered’ to customers one loopback interface per assigned router /32 ‘ip unnumbered’ to upstream ISP Addressing Plan

82. Addressing plan network-plan: analogue dialup modems, vendor ‘x’ LAN -web hosting (Name-based hosting) 5-8 leased line customers (/28) network-plan: LAN -NOC and Ops management LAN -mail,DNS, web servers internal loopback router interfaces router WAN ports (x 5 lines) Initial addressing plan 16 5 128 15 10 4 2 - numbers of host addresses (interfaces) Addressing Plan

83. Network plan 16 → 60 dialup modems (2PRI) 5-8 → 30 leased line customers 5 →11 hosts name- based 8 hosts- 2ndary Servers 15 → 25 hosts- NOC 10 → 16 hosts- Servers 60 dialup modems (2PRI) Upstream ISP added new router and LAN for redundancy added new dial up equipment replaced original modem increased number of leased line customers increased number of hosts on all LANs 6 months later –scale increased –redundancy Addressing Plan

84. Addressing plan Network plan at 6 months 60 11 512 25 16 6 2 - increases in hosts (interfaces) New hardware 2 PRI dialup modems LAN-secondary servers network-plan: 0/ 60 8 network-plan: 2 PRI dialup modems, vendor ‘y’ LAN -web hosting (Name-based hosting) 30 leased line customers (pool) 16/ 5/ 128/ 15/ 10/ 4/ 2/ network-plan: LAN -NOC and Ops management LAN -mail,DNS, web servers internal loopback router interfaces router WAN ports (x 8 lines) Changed description Addressing Plan

85. Network plan 12 months total –site redundancy –greater complexity –efficiency 30 → 60 leased line customers ip unnumbered 11 hosts 8 hosts 16 → 35 host 60 → 240 dialup modems (8PRI) Upstream ISP A 60 → 240 dialup modems (8PRI) 40 hosts Upstream ISP B added new customer router redundancy of WAN connections now numbered links for BGP4 two pieces of essential equipment Addressing Plan

86. Addressing plan network-plan: 8 PRI dialup modems, vendor x 8 PRI dialup modems, vendor y LAN -web hosting (Name-based hosting) 60 leased line customers (pool) 16/60/ 0/60/ 5/11/ 128/512/ 15/25/ 10/16/ 0/8/ 2/2/ 4/6 network-plan: LAN -NOC and Ops management LAN -mail,DNS, web servers internal LAN-secondary servers router WAN ports (x 8 lines) loopback router interfaces Network plan at 12 months 240 11 1020 40 35 8 2 12 -increases in hosts (interfaces) -one year total Addressing Plan

87. Addressing plan network-plan: 8 PRI dialup modems, vendor x 8 PRI dialup modems, vendor y LAN -web hosting (Name-based hosting) 60 leased line customers (pool) 16/60/240 0/60/240 5/11/11 128/512/1020 15/25/40 10/16/35 0/8/8 2/2/2 4/6/12 network-plan: LAN -NOC and Ops management LAN -mail,DNS, web servers internal LAN-secondary servers router WAN ports (x 8 lines) loopback router interfaces 256 16 1024 64 8 16 Can now determine subnet sizes Addressing Plan

88. Addressing plan –Addressing plan for network-plan –re-ordered large to small according to relative subnet size –determination of relative subnet addresses network-plan: 0.0.0.01024128/512/1020 60 leased line customers (pool) network-plan:0.0.4.025616/60/240 8 PRI dial up modems, vendor x network-plan:0.0.5.02560/60/240 8 PRI dial up modems, vendor y network-plan:0.0.6.06410/16/35 LAN -mail,DNS, web internal network-plan:0.0.6.646415/25/40 LAN -NOC and Ops management network-plan:0.0.6.128165/11/11 LAN -web hosting (Name-based hosting) network-plan:0.0.6.144160/8/8 LAN -secondary servers network-plan:0.0.6.160164/6/12 loopback router interfaces network-plan:0.0.6.176162/2/2 router WAN ports (x8) –cumulative total 0.0.6.208 Addressing Plan

89. Addressing plan – Addressing plan for network-plan – connect to the Internet (full-time, part-time)? network-plan: 0.0.0.0255.255.252.0 YES 1024 128/512/1020 60 leased customers network-plan:0.0.4.0255.255.255.0 PART 256 16/60/240 8 PRI dial up modems.. network-plan:0.0.5.0255.255.255.0PART 256 0/60/240 8 PRI dial up modems.. network-plan:0.0.6.0255.255.255.192YES 6410/16/35 LAN -mail,DNS, web internal network-plan:0.0.6.64255.255.255.192YES 6415/25/40 LAN -NOC & Ops mgmt network-plan:0.0.6.128255.255.255.240YES 165/11/11 LAN -web hosting (Name-based) network-plan:0.0.6.144255.255.255.240 YES 16 0/8/8 LAN -secondary servers network-plan:0.0.6.160255.255.255.240YES 16 4/6/12 loopback router interfaces network-plan:0.0.6.176255.255.255.252YES 162/2/2 router WAN ports (x 8 ) Addressing Plan

90. –Addressing plan complete –total planned for customer assignments /22 –total planned for ISP infrastructure /24 + /23 network-plan: 0.0.0.0255.255.252.0 YES 1024 128/512/1020 60 leased line customers network-plan:0.0.4.0255.255.255.0 PART 256 16/60/2408 PRI dial up modems.. network-plan:0.0.5.0255.255.255.0PART 256 0/60/2408 PRI dial up modems.. network-plan:0.0.6.0255.255.255.192YES 6410/16/35LAN -mail,DNS, web internal network-plan:0.0.6.64255.255.255.192YES 6415/25/40 LAN -NOC & Ops mgmnt network-plan:0.0.6.128255.255.255.240YES 165/11/11 LAN -web hosting (Name-based) network-plan:0.0.6.144255.255.255.240 YES 16 0/8/8LAN -secondary servers network-plan:0.0.6.160255.255.255.240YES 16 4/6/12loopback router interfaces network-plan:0.0.6.176255.255.255.252YES 162/2/2router WAN ports (x 8 lines ) –detailed, efficient and accurate Addressing plan Addressing Plan

91. Questions ? Material available at: www.apnic.net/training/recent/

92. Checkpoint question What factors are important to consider when putting together an addressing plan? 1. Components of network (Customer services/ISP internal infrastructure) 2.Phases of deployment (Starting off, 6 months, 12 months) 3. Equipment and topology changes Need for redundancy, Need for increased scale

93. Internet Registry Procedures ISP Request

94. IP Growth in Asia Pacific Last Update Jan 2004 IP Req

95. ISP address request Hostmaster Administrivia – mailbox filtered Requires member account name –Subject: IP Address Request [CONNECT-AU] Ticketing system –Every request is assigned a ticket Please keep # in subject line of email eg. –[APNIC #14122] [CHINANET-CN] New staff at ISP –Require an ‘introduction’ to APNIC To ensure confidentiality members only ISP Req

96. ISP address request More documentation and clarification by Member no Member has completed documentation? Step 1 yes Evaluation of request by APNIC - OK? Step 2 yes update local records update APNIC database Notify Member Step 3 Allocation by APNIC no Life Cycle ISP Req

97. ISP address request - Overview Contact Details Network Information Existing Customer Network Information Existing Infrastructure Network Information Future Network Plan Additional Information ISP Req

98. ISP address request ISP Req

99. ISP address request instructions Complete the documentation –ISP Address Request Form Web Form: –http://www.apnic.net/services/ipv4/ Plain text –http://ftp.apnic.net/apnic/docs/isp-address-request The more detailed and precise –Fewer iterations with APNIC Quicker resolution time Read the quick tips! http://www.apnic.net/faq/isp-request-tips.html ISP Req APNIC- 084

100. Contact details ISP Req Administrative & Technical contacts, Maintainer Need to create maintainer objects Need to create person objects help files!

101. Network name ISP Req Description of organisation not entered… Name of network Description of Organisation Country

102. Error description ISP Req Error: “Description has not been entered”

103. Troubleshooting Guide ISP Req http://www.apnic.net/info/faq/troubleshooting.html

104. Description of organisation ISP Req Name of network, Description of Org., Country Description of Organisation

105. Connect-provider-1 Connect-provider-2 Internet Connectivity ISP Req Internet connectivity type, Connection providers Topological information Connection providers

106. Network configuration ISP Req Supernets, Subnets, All 0s subnet, All 1s subnet… Expectation is ‘classless’

107. Existing customer network ISP Req CUST-NET1 203.108.131.8 255.255.255.248 4 4 6 1 1 1 20030101 CUST-NET1 203.108.131.8 255.255.255.248 4/6/6 1/1/1 20030101 Upload text fileInstructionsAdd information

108. ISP address request evaluation ‘Customer network’ fields Registration –Check all customer assignments are in the APNIC ‘whois’ database accurately Policy –Prefix distribution of all customer assignments –‘Classless’ assignments NOT on /24 boundaries ISP Req

109. Existing network infrastructure ISP Req Address, Mask, Connect, Max, Hosts now, 6m, 1yr, description AddressMaskConnectMaxHosts nowHosts in 6mHosts in 1 yr Detailed descr of subnet Add informationUpload text file

110. New cable/DSL services ISP Req

111. New cable/DSL services ISP Req Use the form to build your CMTS details… Instructions Apply the “new cable/DSL bootstrap criteria”? Details of CMTS equipment

112. IP require- ment (max, now, in 6 months in 1 year Future network plan ISP Req Address, Mask, Connect, IP requirement, description Infra- structure & Projections

113. ISP request evaluation ‘Infrastructure’ & ‘network-plan’ fields Policy –Technical descriptions are detailed enough so APNIC can understand why subnet size was chosen –Do customer projections match infrastructure plans? –Efficient subnet assignments ‘Best current practice’ –Name based virtual web hosting –Dynamic dial up »More on this to follow... ISP Req

114. Additional comments ISP Req Upload Text File

115. Additional info - topology & deployment POP topology Diagrams showing network design Diagrams showing POP design –does network/POP topology description correlate with addressing plan and current infrastructure? –larger requests will require additional documentation Deployment plan Give details of phases of deploying equipment –does deployment plan match information in network-plan fields? ISP Req

116. Additional info - equipment and services Equipment and services Specifications, number of ports –information that cannot fit onto fields of form Details of how implement services –explain acronyms or special services Miscellaneous Anything not covered by the form, anything unusual –supplementary information very useful to the hostmaster when evaluating your request ISP Req

117. Confirm details ISP Req Check your information!

118. ISP address request - Checklist All fields are syntactically correct Supplied documentation correct format defined in the APNIC-084 Provided all IP addresses currently held Updated all customer assignments in DB Deleted objects that are no longer valid http://www.apnic.net/info/faq/isp_checklist.html ISP Req

119. ISP address request - parsing ISP Req Successful parsing of ISP Request

120. ISP address request - submission ISP Req

121. Questions ? Material available at: www.apnic.net/training/recent/

122. Checkpoint question The ISP request form is used for requesting an allocation from APNIC… but what is an allocation? A block of address space held by an IR (or downstream ISP) for subsequent allocation or assignment

123. Evaluation by APNIC - Virtual web hosting Name based hosting –‘Strongly recommended’ Use ‘infrastructure’ field to describe web servers IP based hosting –Permitted on technical grounds –SSL, virtual ftp.. –Use ‘infrastructure’ field to describe web servers –Special verification for IP based –If more than /22 used for this purpose –Requestor must send list of URLs of virtual domain and corresponding IP address ISP Req - Eval

124. Cable, DSL services 1:1 contention ratio Can be either statically or dynamically assigned Means 1 IP address per customer Greater than 1:1 contention ratio Preferred because conserves address space Choice of addressing is optional for members dynamic addressing is encouraged Verification for DSL Services –Equipment details Ex: BRAS, Number of ports –Purchase receipts ISP Req - Eval

125. Customer assignments Customer growth estimation –The invoice for the additional CMTS purchased for the expansion Required to report customer assignments greater than /30 –Through second opinion process –Register the assignment in APNIC whois database ISP Req - Eval

126. Residential networks For residential networks –Do not need to register on-site admin-c, ISP’s technical contact can be used Cable, DSL services –Special verification for 1:1 (permanently on-line) For anything over a /22 in total, verification through customer list for random head-ends or other alternative ISP Req - Eval

127. Evaluation by APNIC - Summary All address space held should be documented Check other RIR, NIR databases for historical allocations ‘No reservations’ policy Reservations may never be claimed Fragments address space Customers may need more or less address space than is actually reserved ISP Req - Eval

128. First allocation Must meet criteria (discussed in policy section) Requires clear detailed and accurate request Implementation of ‘Best Current Practice’ Efficient assignments planned Always a /20 ‘slow start’ Exceptions made for very large networks but not common IP Req APNIC 17 Consensus /21

129. Subsequent allocations 80% overall utilisation Unless large assignment pending Demonstrated conservative assignments Correct customer registrations in db Need to fix inconsistencies before next allocation Allocation size to cover 1 year need Based on previous utilisation rate Contiguous allocation not guaranteed But every effort made ISP Req - Eval

130. APNIC approval ISP Req - Eval Dear xxxx I am pleased to advise you that in response to your request for Internet resources, APNIC has allocated the following range of IPv4 addresses to the organisation below. ** IMPORTANT THINGS TO KNOW ** 1. The address range allocated to your organisation is portable If you change transit providers, the address range remains with your organisation. 2. Assignments and sub-allocations from this address range to customers are non-portable Customers who cease connectivity with your organisation must return any addresses your organisation has assigned or sub-allocated to them. 3. Assignment Window (AW) If the amount of address space your organisation wishes to assign or sub-allocate to a customer is greater than your assignment window then please email for approval. For more information on APNIC's new policy on sub-allocating space to customers, see: http://www.apnic.net/meetings/14/results.html 4. Aggregation This new allocation should, wherever technically possible, be aggregated with any other address ranges the organisation announces to its upstream or transit ISP. 5. No guarantee of routability APNIC cannot guarantee that any address space will be globally routable. APNIC expectation: Announce allocation as single aggregate Assignments & sub- allocations are non- portable

131. Allocation object & contacts person: Santosh Desai address: Rolta Center II, MIDC, Andheri, address: Mumbai-400 093 country: IN phone: +91-22-832 7708 fax-no: +91-22-836 5992 e-mail: santosh@rolta.com nic-hdl: SD34-AP mnt-by: MAINT-IN-SANTOSHDESAI changed: santosh@rolta.com 20000526 source: APNIC person: Vinay Sawarkar address:Rolta Center II, MIDC, Andheri, address:Mumbai-400 093 country: IN phone: +91-22-832 7708 fax-no: +91-22-836 5992 e-mail: vinay@rolta.com nic-hdl: VS9-AP mnt-by: MAINT-IN-SANTOSHDESAI changed:vinay@rolta.com 20000526 source: APNIC inetnum: 202.60.128.0 - 202.60.159.255 netname: ROLTANET descr: Rolta India Limited descr: Rolta Center II descr: MIDC Marol descr: Andheri(East)- Mumbai-400 093 country: IN admin-c: VS9-AP tech-c: SD34-AP mnt-by: APNIC-HM mnt-lower: MAINT-IN-SANTOSHDESAI changed: hostmaster@apnic.net 19990323 status: ALLOCATED PORTABLE source: APNIC Contacts for network ISP Req - Eval

132. Questions ? Material available at: www.apnic.net/training/recent/

133. Checkpoint question How much address space do I have to have used in my allocation before I request a new allocation? 80%

134. Internet Registry Procedures IP Address Management

135. Revision of routing protocols Interior Gateway Protocol (IGP) –Examples are OSPF, EIGRP, ISIS –Used to find optimum route to a host in ISP network –Convergence becomes important with scaling Border Gateway Protocol (BGP) –Can be interior (iBGP) and exterior (eBGP) –Used to carry traffic across your network and to/from the Internet –Can use BGP attributes for routing policy IP Mgmt

136. Principles of addressing Separate customer & infrastructure address pools –Manageability Different personnel manage infrastructure and assignments to customers –Scalability Easier renumbering - customers are difficult, infrastructure is relatively easy IP Mgmt

137. Principles of addressing Further separate infrastructure –‘Static’ infrastructure examples RAS server address pools, CMTS Virtual web and content hosting LANs Anything where there is no dynamic route calculation Customer networks Carry in iBGP, do not put in IGP –No need to aggregate address space carried in iBGP –Can carry in excess of 100K prefixes IP Mgmt

138. Hierarchy of routing protocols BGP4 (iBGP) & OSPF/ISIS Other ISPs Customers Local NAP eBGP Static/eBGP BGP4 (eBGP) ISP Internal Network IP Mgmt

139. Management - simple network First allocation from APNIC –Infrastructure is known, customers are not –20% free is trigger for next request –Grow usage of blocks from edges –Assign customers sequentially 20% Customers p2pp2p Infrastructure loops IP Mgmt

140. Management - simple network If second allocation is contiguous –Reverse order of division of first block –Maximise contiguous space for infrastructure Easier for debugging –Customer networks can be discontiguous CustomersInfrastructure 20%InfrastructureCustomers 1st allocation2nd allocation IP Mgmt

141. Management - many POPs WAN link to single transit ISP Server POP1 POP2 POP3 IP Mgmt

142. POP sizes –Choose address pool for each POP according to need –Loopback addresses Keep together in one block Assists in fault-resolution –Customer addresses Assign sequentially Management - many POPs Infrastructure POP 1POP2 loopbacks Customer IP Mgmt

143. Management - many POPs /20 minimum allocation not enough for all your POPs? –Deploy addresses on infrastructure first Common mistake: –Reserving customer addresses on a per POP basis Do not constrain network plans due to lack of address space –Re-apply once address space has been used IP Mgmt

144. Management - multiple exits WAN links to different ISPs Server POP1 POP2 POP3 IP Mgmt

145. Management - multiple exits Create a ‘national’ infrastructure pool –Carry in IGP Eg. loopbacks, p2p links, infrastructure connecting routers and hosts which are multiply connected –On a per POP basis Consider separate memberships if requirement for each POP is very large from day one. National Infrastructure POP1POP2POP3 20% free IP Mgmt

146. Questions ? Material available at: www.apnic.net/training/recent/

147. Checkpoint question Why doesn’t it make sense to carry the customer addresses in my IGP? By carrying the customer assignments in iBGP, there is no need to aggregate them. (iBGP can easily handle these routes.) The IGP should be kept small to optimise network performance and convergence time

148. Assignment and sub-allocation procedures Assignment Window & 2 nd Opinion process

149. Second opinion request Assignment Window Second Opinion Request Form Evaluation

150. What is an Assignment Window? “The amount of address space a member may assign without a ‘second opinion’” All members have an AW –Starts at zero, increases as member gains experience in address management Second opinion process –Customer assignments require a ‘second-opinion’ when proposed assignment size is larger than members AW 2 nd Opinion

151. Assignment Window Size of assignment window –Evaluated after about 5 2nd-opinion requests –Increased as member gains experience and demonstrates understanding of policies Prefix length normally reduced by 1 bit at a time Assignment window may be reduced, in rare cases Why an assignment window? –Monitoring ongoing progress and adherence to policies –Mechanism for member education 2 nd Opinion

152. Why Assignment Window? Motivation –Support the LIR during start up –Standardise criteria for request evaluation –Familiarise the LIR with APNIC policies –Ensure accurate data is being kept –Treat everyone fairly FAQ http://www.apnic.net/faq/awfaq.html 2 nd Opinion

153. Request < AW? APNICapprovesrequest? Member updates local records & DB & makes assignment Yes Member adds comments & recommendations & sends to hostmaster@apnic.net No Step 1 - Member and customer complete 2nd Opinion Request form Step 3 - Assignment Window procedure Step 2 - Member evaluates customers requirements iteration No Yes Assignment window process 2 nd Opinion

154. Second opinion request form Used to seek approval for: –IPv4 assignments & sub-allocations –Multiple/additional IPv6 /48s to a single customer Before you start: –Separate form for each request –Help buttons available –Form can be saved by use of password 2 nd Opinion

155. Overview of 2nd opinion form Applicant information Type of request Network name Future network plan Customer’s existing network Customer assignments to end-sites Sub-allocation infrastructure Additional information Confirm details Contact details, password IPv6 / IPv4, Assignment / Sub-allocation Network name, description, country Planned IP usage IPs held by customer IPs held by customer & customer’s customers IPv4 Sub-allocations IPv4/IPv6 Assignments Any additional info that may aid the evaluation Check your details 2 nd Opinion

156. Your name: Your email address: APNIC account name: Examples: Non-member: SPARKYNET-NON-ID Member example: SPARKYNET-ID Your relationship to organisation applying for membership: Please choose one Create a password for this request: Confirm password: (min. 8 characters) APNIC second opinion request Applicant information http://www.apnic.net/apnic-bin/second-opinion-form.pl Cancel Next Applicant information 2 nd Opinion http://www.apnic.net/apnic-bin/second-opinion-request.pl Help buttons Password allows saving work

157. Type of second opinion request 2 nd Opinion APNIC second opinion request Type of second opinion request Which IP version do you wish to request? Which type of second opinion are you requesting? Address prefix requested: /26 IPv4 IPv6 Assignment (IPv4 or IPv6) Select this if you are distributing IP addresses for the end user’s infrastructure Sub-allocation (IPv4 only) Select this if you are distributing IP addresses to an organisation that will further distribute the address space to their end users. IPv4 example: /26 IPv6 example: /47 Save Cancel Previous Next

158. Network name 2 nd Opinion APNIC second opinion request Network name The details you provide here will be used to identify the proposed network in the APNIC Whois Database Name of network: Description of organisation: Country: Select a country Select a Country Example: SparkyNet, Sdn Bhd, Indonesia Example: SPARKYNET Save Cancel Previous Next

159. APNIC second opinion request Future network plan Size of planned subnet: Deploy now: Deploy within 6 months: Deploy within 1 year: Detailed description of subnet: Example: 0.0.0.0/28 Example: /29 Example: /28 Example: web hosting facility Future network plan Upload text file Add informationInstructions 0.0.0.0/28 /29 /29 /28 web hosting facility 0.0.0.0/28 /29 /29 /28 web hosting facility 2 nd Opinion

160. Customer’s existing network - IPv4 assignment request Actual start address assigned: Total prefix size of subnet: Description of subnet: Example: 202.5.10.0 Example: /29 Example: 1 router and 4 workstations APNIC second opinion request Customer’s existing network 202.5.10.0 /29 1 router and 4 workstations 2 nd Opinion 202.5.10.0 /29 1 router and 4 workstations All previous assignments - Check whois db Upload text fileAdd information

161. Customer’s assignments to end-sites Sub Allocation Request Actual start address assigned: Total prefix size of subnet: Description of subnet: Example: 202.12.28.0 Example: /29 Example: FOO-AP Customer’s assignments to end-sites APNIC second opinion request Customer’s (downstream provider’s) customers Add information

162. Sub-allocation infrastructure Sub-Allocation Request Sub-allocation infrastructure APNIC second opinion request Actual start address assigned: Total prefix assigned to the infrastructure: Description of subnet: Example: 202.12.28.0 Example: /27 Example: server farm Customer’s (downstream provider’s) infrastructure Add information

163. Additional information 2 nd Opinion APNIC second opinion request Additional information  network topology diagrams  detailed explanations of the address space usage and subnetting plans Network design Network topology Deployment plan Equipment Services Renumbering Explanations etc Upload File

164. Confirm details & submit APNIC second opinion request Confirm details Submit APNIC second opinion request Submit request Your request has been submitted Please check your information: Your name: Your email address: Account name: Your relationship to organisation requesting second opinion: Address type: Request type: Prefix second opinion requested for: Netname: Description: Country code: Network plan: Customer's existing network: Ky Xander kxander@sparkynet.com sparkynet-id Employee / Manager IPv4 Assignment /27 SparkyNet, Sdn Bhd, Indonesia ID 0.0.0.0/28 /29 /29 /28 web hosting facility 202.5.10.0 /29 1 router and 4 workstations Check your request Click Submit Confirmation is also sent via email Request submitted! 2 nd Opinion

165. 2 nd opinion evaluation (policy) Efficiency –More than 50% used in any one subnet? –Can different subnet sizes be used? –More than 80% used for previous assignment? Stockpiling –Is all address space held declared on form? –Has organisation obtained address space from more than one member/ISP? Registration –Is previous assignment in APNIC database and are they correct and up to date? 2 nd Opinion

166. 2 nd opinion evaluation APNIC & Member evaluation –Should be the same If NO, APNIC will ask member to obtain more information –iterative process If YES, APNIC approves 2nd opinion request 2 nd Opinion

167. 2nd opinion request approval Dear XXXXXXX, APNIC has approved your "second opinion" request to make the following assignment: [netname] [address/prefix] * Please ensure that you update the APNIC whois database to register this assignment before informing your customer or requesting reverse DNS delegation. Do this using the form at: http://www.apnic.net/apnic-bin/inetnum.pl Important: Unregistered assignments are considered as "unused" 2 nd Opinion

168. Customer assignment Member updates internal records –Select address range to be assigned –Archive original documents sent to APNIC –Update APNIC database Clarify status of address space –APNIC requirement is ‘Non portable’ –‘Portable’ assignments are made by APNIC only with the end-user request form Organisation must have technical requirement 2 nd Opinion

169. Questions ? Material available at: www.apnic.net/training/recent/

170. Checkpoint question Do all customer assignments need to be registered in the APNIC whois Database…? Yes. (This can now be easily managed through myAPNIC.)

171. The APNIC Database Protection and Updating DB 2

172. Database protection - maintainer object mntner:MAINT-WF-EX descr: Maintainer for ExampleNet Service Provider country: WF admin-c: ZU3-AP tech-c: KX17-AP upd-to: kxander@example.com mnt-nfy: kxander@example.com auth: CRYPT-PW apHJ9zF3o mnt-by: MAINT-WF-EX referral-by: MAINT-APNIC-AP changed: kxander@example.com 20020731 source: APNIC DB 2 protects other objects in the APNIC database

173. Creating a maintainer object 1.Fill out webform –Provide: Admin-c & tech-c password email address etc 2.Completed form will be sent to you 3.Forward request to maint-request@apnic.net 4.Maintainer will be created manually Manual verification by APNIC Hostmasters 5.Update your person object with mntner http://www.apnic.net/services/whois_guide.html

174. Database protection Authorisation –“mnt-by” references a mntner object Can be found in all database objects “mnt-by” should be used with every object! Authentication –Updates to an object must pass authentication rule specified by its maintainer object DB 2

175. Authorisation mechanism mntner:MAINT-WF-EX descr: Maintainer for ExampleNet Service Provider country: WF admin-c: ZU3-AP tech-c: KX17-AP upd-to: kxander@example.com mnt-nfy: kxander@example.com auth: CRYPT-PW apHJ9zF3o mnt-by: MAINT-WF-EX changed: kxander@example.com 20020731 source: APNIC inetnum:202.137.181.0 – 202.137.185.255 netname: EXAMPLENET-WF descr: ExampleNet Service Provider ………. mnt-by: MAINT-WF-EX DB 2

176. Maintainer specific attributes mnt-nfy: Sends notification of any changes to maintained objects to email address specified mnt-by: Maintainers must also be protected! (Normally by themselves) auth: Authentication method for this maintainer DB 2

177. Authentication methods ‘auth’ attribute –Crypt-PW Crypt (Unix) password encryption Use web page to create your maintainer –PGP – GNUPG Strong authentication Requires PGP keys –MD5 Strong authentication Simple to use DB 2

178. Mnt-by & mnt-lower ‘mnt-by’ attribute Can be used to protect any object Changes to protected object must satisfy authentication rules of ‘mntner’ object. ‘mnt-lower’ attribute Also references mntner object Hierarchical authorisation for inetnum & domain objects The creation of child objects must satisfy this mntner Protects against unauthorised updates to an allocated range - highly recommended! DB 2

179. Inetnum: 203.146.96.0 - 203.146.127.255 netname: LOXINFO-TH descr: Loxley Information Company Ltd. Descr: 304 Suapah Rd, Promprab,Bangkok country: TH admin-c: KS32-AP tech-c: CT2-AP mnt-by: APNIC-HM mnt-lower: MAINT-TH-LOXINFO changed: hostmaster@apnic.net 19990714 Status:ALLOCATED PORTABLE source: APNIC Authentication/Authorisation –APNIC allocation to member Created and maintained by APNIC 1. Only APNIC can change this object 2. Only Loxinfo can create assignments within this allocation 1 2 DB 2

180. Inetnum: 203.146.113.64 - 203.146.113.127 netname: SCC-TH descr: Sukhothai Commercial College Country: TH admin-c: SI10-AP tech-c: VP5-AP mnt-by: MAINT-TH-LOXINFO changed: voraluck@loxinfo.co.th 19990930 Status:ASSIGNED NON-PORTABLE source: APNIC Authentication/Authorisation –Member assignment to customer Created and maintained by APNIC member Only LOXINFO-IS can change this object DB 2

181. Database update process –Email requests to –Each request contains an object template Update Request Template Parse Warnings/Errors returned Error Auth. Data Base Whois Server DB 2

182. Database update process Update transactions –Create a new object –Change an object –Deletean object Updates are submitted by email E-mail to: Email message contains template representing new or updated object Template DB 2

183. Template Database update - web Creates a template through the web form Template will be sent to you by email This should be forwarded to: –Common error to reply to the email –(Adds extra character in front of each line) http://www.apnic.net/services/whois_guide.html DB 2

184. Updating an existing object Change relevant fields Add your maintainer password Update the changed attribute Email updated object to: Note –Primary keys cannot be modified DB 2

185. Deleting an object –Copy object as-is in database into email –Add your maintainer password –Leave the changed attribute inetnum: 202.182.224.0 - 202.182.225.255 netname: SONY-HK... mnt-by: MAINT-CNS-AP changed: ph@macroview.com 19990617 source: APNIC password: x34zky delete: no longer required me@company.com Note: Referenced objects cannot be deleted (02/99) DB 2

186. Forgotten the password ? We do not recommend using personal names for maintainer objects Send an e-mail to hostmaster@apnic.nethostmaster@apnic.net If you are a ‘contact person’ of APNIC If NOT, requires legal documentation DB 2 Unfortunately we cannot change the password for the maintainer until we have received a fax with your company’s letterhead confirming the request to modify the password. In the fax, please include the following: 0. Attention: APNIC Database Administration Department 1.The APNIC Account name of your company and your personal nic handle. If you do not have an APNIC account, then please state ‘NON-MEM’. 2.The current maintainer object which is to be modified, as obtained from ‘whois –h whois.apnic.net MAINTAINER- OBJECT’ 3.The new password/authorisation for the maintainer. 4.The signature of a contact for the maintainer. Confirmatio n by fax required on company letter head

187. Questions ? Material available at: www.apnic.net/training/recent/

188. Checkpoint question What is the difference between mnt-by and mnt-lower? - mnt-by protects the object itself. - mnt-lower prevents the unauthorised creation of child objects.

189. MyAPNIC

190. Autonomous System Numbers Procedures

191. Overview What is an AS? Guidelines and procedures Application form (documentation) Policy expression ASN

192. What is an Autonomous System? –Collection of networks with same routing policy –Usually under single ownership, trust and administrative control AS 100 ASN

193. When do I need an ASN? When do I need an AS? –Multi-homed network to different providers and –Routing policy different to external peers Recommended reading! –RFC1930: Guidelines for creation, selection and registration of an Autonomous System ASN RFC 1930

194. When don’t I need an ASN? Factors that don’t count –Transition and ‘future proofing’ –Multi-homing to the same upstream RFC2270: A dedicated AS for sites homed to a single provider –Service differentiation RFC1997: BGP Communities attribute RFC 2270 RFC 1997 ASN

195. Requesting an ASN Complete the request form –web form available: http://www.apnic.net/db/aut-num.html Request form is parsed - real time –Must include routing policy multiple import and export lines –Is checked for syntactical accuracy based on RPSL (rfc2622) –Peers verified by querying routing table –[NO-PARSE] will not send request to parser ASN RFC 2622

196. Requesting an ASN - Customers 1.Requested directly from APNIC AS number is “portable” 2.Requested via member ASN is “non-portable” ASN returned if customer changes provider Transfers of ASNs –Need legal documentation (mergers etc) –Should be returned if no longer required ASN

197. ASN request form http://www.apnic.net/apnic-bin/creform.pl Guide to the ASN request form ASN

198. Request form – routing policy ASN

199. aut-num:AS4777 as-name: APNIC-NSPIXP2-AS descr:Asia Pacific Network Information Centre descr: AS for NSPIXP2, remote facilities site import:from AS2500 action pref=100; accept ANY import:rom AS2524 action pref=100; accept ANY import:from AS2514 action pref=100; accept ANY export: to AS2500 announce AS4777 export:to AS2524 announce AS4777 export:to AS2514 announce AS4777 default:to AS2500 action pref=100; networks ANY admin-c:PW35-AP tech-c: NO4-AP remarks: Filtering prefixes longer than /24 mnt-by: MAINT-APNIC-AP changed: paulg@apnic.net 19981028 source:APNIC Aut-num object example POLICY RPSL ASN

200. Representation of routing policy Routing and packet flows AS 1AS 2 routing flow packet flow accepts announces accepts ASN For AS1 and AS2 networks to communicate AS1 must announce to AS2 AS2 must accept from AS1 AS2 must announce to AS1 AS1 must accept from AS2

201. Representation of routing policy AS 1AS 2 aut-num: AS1 … import:from AS2 action pref=100; accept AS2 export:to AS2 announce AS1 aut-num: AS2 … import: from AS1 action pref=100; accept AS1 export: to AS1 announce AS2 Basic concept “action pref” - the lower the value, the preferred the route ASN

202. Representation of routing policy AS 123 AS4 AS5 AS10 More complex example AS4 gives transit to AS5, AS10 AS4 gives local routes to AS123 ASN

203. Representation of routing policy AS 123 AS4 AS5 AS5 AS10 import: from AS123 action pref=100; accept AS123 aut-num: AS4 import: from AS5 action pref=100; accept AS5 import: from AS10 action pref=100; accept AS10 export: to AS123 announce AS4 export: to AS5 announce AS4 AS10 export: to AS10 announce AS4 AS5 Not a path ASN

204. Representation of routing policy AS123 AS4 More complex example AS4 and AS6 private link1 AS4 and AS123 main transit link2 backup all traffic over link1 and link3 in event of link2 failure AS6 private link1 link3 transit traffic over link2 ASN

205. Representation of routing policy AS123 AS4 AS6 private link1 link3 AS representation transit traffic over link2 import:from AS123 action pref=100; accept ANY aut-num: AS4 import:from AS6 action pref=50; accept AS6 import:from AS6 action pref=200; accept ANY export:to AS6 announce AS4 export:to AS123 announce AS4 full routing received ASN higher cost for backup route

206. Routing Policy Specification Language RPSL –Derived from RIPE-181 –Introduced with v3 Database 20 August 2002 –“New” object specification language more expressive syntax advanced aut-num and routing policy options –Especially useful in an Internet Routing Registry ASN RFC 2622

207. Questions ? Material available at: www.apnic.net/training/recent/

208. Checkpoint question When do I need an AS number? An AS number is used when multihoming to two different providers and when you have a unique routing policy

209. Reverse DNS Delegation Registry Procedures Rev. DNS

210. Overview Reverse DNS Delegation APNIC & Member responsibilities Reverse network delegations (/16) Reverse network delegations (/24) Subnet delegations Delegation procedures Rev. DNS

211. What is ‘Reverse DNS’? ‘Forward DNS’ maps names to numbers –svc00.apnic.net -> 202.12.28.131 ‘Reverse DNS’ maps numbers to names –202.12.28.131 -> svc00.apnic.net Rev. DNS

212. In-addr.arpa Hierarchy of IP addresses –Uses ‘in-addr.arpa’ domain INverse ADDRess IP addresses: –Less specific to More specific 210.56.14.1 Domain names: –More specific to Less specific delhi.vsnl.net.in –Reversed in in-addr.arpa hierarchy 14.56.210.in-addr.arpa Rev. DNS

213. whois Root DNS Reverse DNS delegation net edu com au whois apnic 202 203 210 211.. 202 22 in-addr arpa 64 22.64.in-addr.202.arpa Rev. DNS - Mapping numbers to names - ‘reverse DNS’

214. Reverse DNS - why bother? Service denial That only allow access when fully reverse delegated eg. anonymous ftp Diagnostics Assisting in trace routes etc Registration Responsibility as a member and Local IR Rev. DNS

215. APNIC & Member responsibilities APNIC –Manage reverse delegations of address block distributed by APNIC –Process members requests for reverse delegations of network allocations Members –Be familiar with APNIC procedures –Ensure that addresses are reverse-mapped –Maintain nameservers for allocations Minimise pollution of DNS Rev. DNS

216. Reverse delegation requirements /24 Delegations Address blocks should be assigned/allocated At least two name servers /16 Delegations Same as /24 delegations APNIC delegates entire zone to member Recommend APNIC secondary zone < /24 Delegations Read “classless in-addr.arpa delegation” RFC 2317 Rev. DNS

217. Delegation procedures Upon allocation, member is asked if they want /24 place holder domain objects with member maintainer –Gives member direct control Standard APNIC database object, –can be updated through online form or via email. Nameserver/domain set up verified before being submitted to the database. Protection by maintainer object –(current auths: NONE, CRYPT-PW, PGP). Zone file updated 2-hourly Rev. DNS

218. Example ‘domain’ object domain: 124.54.202.in-addr.arpa descr:co-located server at mumbai country: IN admin-c: VT43-AP tech-c: IA15-AP zone-c: IA15-AP nserver: dns.vsnl.net.in nserver: giasbm01.vsnl.net.in mnt-by: MAINT-IN-VSNL changed: gpsingh@vsnl.net.in 20010612 source: APNIC Rev. DNS

219. Delegation procedures – request form Complete the documentation http://www.apnic.net/db/domain.html On-line form interface –Real time feedback –Gives errors, warnings in zone configuration serial number of zone consistent across nameservers nameservers listed in zone consistent –Uses database ‘domain’ object examples of form to follow.. Rev. DNS

220. Reverse DNS request form

221. Request form

222. Evaluation Parser checks for –‘whois’ database IP address range is assigned or allocated Must be in APNIC database –Maintainer object Mandatory field of domain object –Nic-handles zone-c, tech-c, admin-c Rev. DNS

223. Evaluation Nameserver checks –Minimum 2 nameservers required –Check serial versions of zone files are the same –Check NS records in zones are the same as listed on form –Nameserver can resolve itself, forward and reverse Rev. DNS

224. Online errors (also via email) Rev. DNS

225. Request submission error Rev. DNS Update failed Authorisation failed

226. Successful update Rev. DNS Update ok!

227. Use of maintainer object Domain objects protected by maintainers hierarchical protection using “mnt-lower” Bootstrap period –‘MAINT-AP-DNS-DEFAULT’ for all objects imported by APNIC from existing zone files Changing delegations requires valid maintainer Maintainer creation & authorisation is manual – Turnaround time 2 days –/24 place holder objects created upon allocation gives members direct control No need to contact APNIC when changing nservers Rev. DNS

228. Delegation process summary on-line feedback given no Step 1 yes Step 2 Step 3 update APNIC database notify upd-to contact for maintainer object zone files reloaded Every 2 hrs, 24hrs a day on everyday Delegation by APNIC request forwarded to APNIC for manual processing no yes request parsed OK? authorisation OK? Rev. DNS Reverse DNS Troubleshooting Guide: http://www.apnic.net/services/help/rd/troubleshooting.html

229. Questions? Are all your zones, and your customer zones registered? Material available at: www.apnic.net/training/recent/

230. Checkpoint question What is reverse DNS? It is the mapping of numbers (IP addresses) to names (domain names)

231. Summary What we have covered today

232. Summary Introduction to APNIC Policy development Internet Registry Policies IPv4 Allocation & Assignment Procedures IP Address Management APNIC Database Procedures ASN Assignment Procedures Reverse DNS Procedures

233. Summary - Responsibilities As an APNIC member and custodian of address space –Be aware of your responsibilities –Register customer assignments in APNIC database Keep this data up-to-date & accurate –Educate your customers –Document your network in detail Keep local records –Register reverse DNS delegations

234. More personalised service –Range of languages: Cantonese, Filipino, Mandarin, Hindi, Vietnamese etc. Faster response and resolution of queries IP resource applications, status of requests, obtaining help in completing application forms, membership enquiries, billing issues & database enquiries Member Services Helpdesk - One point of contact for all member enquiries Helpdesk hours 9:00 am - 7:00 pm (AU EST, UTC + 10 hrs) ph: +61 7 3858 3188fax: 61 7 3858 3199

235. Summary “Do the right thing” –Think about routing table size & scalability of Internet –Encourage renumbering –Announce aggregate prefixes –Think global not local

236. Thank you !! Your feedback is appreciated Material available at: http://www.apnic.net/training/recent/

237. Supplementary Reading

238. Training material Today’s training material will be made available at: http://www.apnic.net/training/recent/

239. Introduction Regional Registry web sites APNIC: http://www.apnic.net ARIN: http://www.arin.net LACNIC: http://www.lacnic.net RIPE NCC: http://www.ripe.net APNIC past meetings http://www.apnic.net/meetings

240. Introduction APNIC members http://www.apnic.net/members.html Membership Membership procedure http://www.apnic.net/membersteps.html Membership application form http://www.apnic.net/apnic-bin/membership-application.pl Membership fees http://www.apnic.net/docs/corpdocs/FeeSchedule.htm

241. Introduction to APNIC & IP Policy Classless techniques CIDR http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1517-19.txt Network Addressing when using CIDR ftp://ftp.uninett.no/pub/misc/eidnes-cidr.ps.Z Variable Length Subnet Table http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1878.txt http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1878.txt Private Address Space Address Allocation for Private Internets http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1918.txt Counter argument: “Unique addresses are good” http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1814.txt

242. Bit boundary chart +------------------------------------------------------+ | addrs bits pref class mask | +------------------------------------------------------+ | 1 0 /32 255.255.255.255 | | 2 1 /31 255.255.255.254 | | 4 2 /30 255.255.255.252 | | 8 3 /29 255.255.255.248 | | 16 4 /28 255.255.255.240 | | 32 5 /27 255.255.255.224 | | 64 6 /26 255.255.255.192 | | 128 7 /25 255.255.255.128 | | 256 8 /24 1C 255.255.255 | | 512 9 /23 2C 255.255.254 | | 1,024 10 /22 4C 255.255.252 | | 2,048 11 /21 8C 255.255.248 | | 4,096 12 /20 16C 255.255.240 | | 8,192 13 /19 32C 255.255.224 | | 16,384 14 /18 64C 255.255.192 | | 32,768 15 /17 128C 255.255.128 | | 65,536 16 /16 1B 255.255 | | 131,072 17 /15 2B 255.254 | | 262,144 18 /14 4B 255.252 | | 524,288 19 /13 8B 255.248 | | 1,048,576 20 /12 16B 255.240 | | 2,097,152 21 /11 32B 255.224 | | 4,194,204 22 /10 64B 255.192 | | 8,388,608 23 /9 128B 255.128 | | 16,777,216 24 /8 1A 255 | | 33,554,432 25 /7 2A 254 | | 67,108,864 26 /6 4A 252 | | 134,217,728 27 /5 8A 248 | | 268,435,456 28 /4 16A 240 | | 536,870,912 29 /3 32A 224 | |1,073,741,824 30 /2 64A 192 | +------------------------------------------------------+

243. APNIC Mailing Lists apnic-talk –Open discussions relevant to APNIC community & members apnic-announce –Announcements of interest to the AP community sig-policy –IPv4 and IPv6 allocation and assignment policies global-v6 –Global IPv6 policy mailing list subscribe via archives: http://ftp.apnic.net/apnic/mailing-lists http://www.apnic.net/net_comm/lists/

244. The RIR System “ Development of the Regional Internet Registry System” Internet Protocol Journal Vol. 4, Number 4 Short history of the Internet http://www.cisco.com/warp/public/759/ipj_4-4/ipj_4-4_regional.html

245. Policies & Policy Environment Policy Documentation Policies for address space management in the Asia Pacific region http://www.apnic.net/docs/policy/add-manage-policy.html RFC2050: Internet Registry IP allocation Guidelines http://ftp.apnic.net/ietf/rfc/rfc2000/rfc2050.txt

246. Address Request Procedures Addressing Guidelines “Designing Addressing Architectures for Routing & Switching”, Howard C. Berkowitz Address Request Forms ISP Address Request Form http://www.apnic.net/services/ipv4/ Second-opinion Request Form http://www.apnic.net/services/second-opinion/ No Questions Asked http://ftp.apnic.net/apnic/docs/no-questions-policy

247. APNIC Database APNIC Database Documentation Updating information in the APNIC Database http://ftp.apnic.net/apnic/docs/database-update-info Maintainer & Person Object Request Form http://ftp.apnic.net/apnic/docs/mntner-person-request APNIC Maintainer Object Request http://www.apnic.net/apnic-bin/maintainer.pl APNIC Whois Database objects resource guide http://www.apnic.net/services/whois_guide.html

248. APNIC Database RIPE Database Documentation RIPE Database Reference Manual http://www.ripe.net/docs/databaseref-manual.html Database ‘whois’ Client http://ftp.apnic.net/apnic/dbase/tools/ripe-dbase-client.tar.gz Database web query http://www.apnic.net/apnic-bin/whois2.pl

249. Reverse DNS Request Forms Guide to reverse zones http://www.apnic.net/db/revdel.html Registering your Rev Delegations with APNIC http://www.apnic.net/db/domain.html Relevant RFCs Classless Delegations http://ftp.apnic.net/ietf/rfc/rfc2000/rfc2317.txt Common DNS configuration errors http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1537.txt

250. AS Assignment Procedures Policy Guidelines for the creation, selection, and registration of an AS http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1930.txt RFCs Routing Policy Specification Language (RPSL) http://ftp.apnic.net/ietf/rfc/rfc2000/rfc2280.txt A dedicated AS for sites homed to a single provider http://ftp.apnic.net/ietf/rfc/rfc2000/rfc2270.txt RFC1997: BGP Communities attribute http://ftp.apnic.net/ietf/rfc/rfc2000/rfc2270.txt

251. Other supplementary reading Operational Content Books ISP Survival Guide, Geoff Huston Cisco ISP Essentials, Philip Smith BGP Table http://www.telstra.net/ops/bgptable.html http://www.merit.edu/ipma/reports http://www.merit.edu/ipma/routing_table/mae- east/prefixlen.990212.html http://www.employees.org/~tbates/cidr.hist.plot.html Routing Instability http://zounds.merit.net/cgi-bin/do.pl

252. Other supplementary reading Routing & Mulithoming Internet Routing Architectures - Bassam Halabi BGP Communities Attribute http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1997.txt http://ftp.apnic.net/ietf/rfc/rfc1000/rfc1998.txt Filtering Egress Filtering http://www.cisco.com/public/cons/isp Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing http://ftp.apnic.net/ietf/rfc/rfc2000/rfc2267.txt

253. Person object template person: [mandatory] [single] [lookup key] address: [mandatory] [multiple] [ ] country: [optional] [single] [ ] phone: [mandatory] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] nic-hdl: [mandatory] [single] [primary/look-up key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

254. Role object template role: [mandatory] [single] [lookup key] address: [mandatory] [multiple] [ ] country: [optional] [single] [ ] phone: [mandatory] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] trouble: [optional] [multiple] [ ] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] nic-hdl: [mandatory] [single] [primary/look-up key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

255. Maintainer Object Template mntner: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] [ ] country: [optional] [single] [ ] admin-c: [mandatory] [multiple] [inverse key] tech-c: [optional] [multiple] [inverse key] upd-to: [mandatory] [multiple] [inverse key] mnt-nfy: [optional] [multiple] [inverse key] auth: [mandatory] [multiple] [ ] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] referral-by: [mandatory] [single] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

256. Inetnum object template inetnum: [mandatory] [single] [primary/look-up key] netname: [mandatory] [single] [lookup key] descr: [mandatory] [multiple] [ ] country: [mandatory] [multiple] [ ] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] rev-srv: [optional] [multiple] [inverse key] status: [mandatory] [single] [ ] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] mnt-routes:[optional] [multiple] [inverse key] mnt-irt: [optional] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

257. Aut-num Object Template aut-num: [mandatory] [single] [primary/look-up key] as-name: [mandatory] [single] [ ] descr: [mandatory] [multiple] [ ] country: [optional] [single] [ ] member-of: [optional] [multiple] [ ] import: [optional] [multiple] [ ] export: [optional] [multiple] [ ] default: [optional] [multiple] [ ] remarks: [optional] [multiple] [ ] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] cross-mnt: [optional] [multiple] [inverse key] cross-nfy: [optional] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] mnt-routes: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

258. Domain object template domain: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] [ ] country: [optional] [single] [ ] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] zone-c: [mandatory] [multiple] [inverse key] nserver: [mandatory] [multiple] [inverse key] sub-dom: [optional] [multiple] [inverse key] dom-net: [optional] [multiple] [ ] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] refer: [optional] [single] [ ] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]