From info at arin.net Tue Jan 30 09:33:38 2024 From: info at arin.net (ARIN) Date: Tue, 30 Jan 2024 09:33:38 -0500 Subject: [ARIN-consult] Consultation on RPKI/BGP Intelligence Message-ID: <3ED82CB7-B055-4C9F-93BD-1EFAA7C7F8EB@arin.net> ARIN is seeking feedback from the community (https://www.arin.net/participate/community/acsp/consultations/2024/2024-1/) regarding the level of information presented to the user when they are using ARIN?s Hosted Resource Public Key Infrastructure (RPKI) product. Currently when ARIN customers create Route Origin Authorizations (ROAs) in ARIN Online, they are only presented with the information in the ROA; they need to use third-party tools to predict the impact of creating the ROA on the global routing table. We plan to add this functionality to a new RPKI dashboard that will allow a user to view the current RPKI validity state and the resulting impact to routing for the resources covered by the ROA. This will let users make more informed decisions about creating ROAs before confirming the changes and without leaving ARIN Online. This functionality will be available to ARIN customers who use ARIN Online. ARIN API users will need to use third-party tools to collect the same information. Proposed Changes - Display a table in the RPKI dashboard with near-real-time route announcements for the Organization?s Internet number resources, as seen in the global BGP table. - The table will show the current RPKI validity state of the route announcements. - Display any mismatches between BGP announcements, existing ROAs, and the resulting RPKI validity state and offer suggestions on how to resolve any mismatches following current best practices. Because most ARIN organizations use the Hosted RPKI product, we believe adding this functionality would benefit a significant number of ARIN customers and enable network operators to make better informed routing decisions. We are seeking community input for any additional information or capabilities that should be included in this proposed new functionality development. The feedback you provide during this consultation will be instrumental in determining how ARIN moves forward with improvements to our routing security services. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at https://lists.arin.net/mailman/listinfo/arin-consult. This consultation will remain open until 5:00 PM ET on 29 February 2024. ARIN seeks clear direction through community input, so your feedback is important. Thank you for your continued support to improve ARIN?s routing security services. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) From job at fastly.com Tue Jan 30 09:53:43 2024 From: job at fastly.com (Job Snijders) Date: Tue, 30 Jan 2024 15:53:43 +0100 Subject: [ARIN-consult] Consultation on RPKI/BGP Intelligence In-Reply-To: <3ED82CB7-B055-4C9F-93BD-1EFAA7C7F8EB@arin.net> References: <3ED82CB7-B055-4C9F-93BD-1EFAA7C7F8EB@arin.net> Message-ID: Dear ARIN, community, On Tue, Jan 30, 2024 at 09:33:38AM -0500, ARIN wrote: > Proposed Changes > > - Display a table in the RPKI dashboard with near-real-time route > announcements for the Organization?s Internet number resources, as > seen in the global BGP table. > - The table will show the current RPKI validity state of the route > announcements. > - Display any mismatches between BGP announcements, existing ROAs, and > the resulting RPKI validity state and offer suggestions on how to > resolve any mismatches following current best practices. The above proposed changes seem a welcome improvement. Might I also suggest the addition of a workflow in which with a few clicks appropriate ROAs can be created for the NotFound and Invalid route announcements displayed in the table? Providing a workflow in which manual data entry (typing or copy+paste IP prefixes) can entirely be avoided, will likely reduce input errors and ROA misconfigurations. Kind regards, Job From athompson at merlin.mb.ca Tue Jan 30 12:21:17 2024 From: athompson at merlin.mb.ca (Adam Thompson) Date: Tue, 30 Jan 2024 17:21:17 +0000 Subject: [ARIN-consult] [General-members] Consultation on RPKI/BGP Intelligence In-Reply-To: References: Message-ID: This wasn't a pressing issue for us, but - assuming the data and analysis shown are *correct* - this sounds like an excellent idea. My one issue would be that it will be critical to expose the details of the calculation, i.e. where did the data come from, how recent is it, and as my math teacher always said "show your work". (Hiding it behind a collapsed UI element by default would probably be appropriate.) I can think of several situations where ARIN won't have the same GRT/DFZ tables as I do (e.g. NRENs) so I'll need to understand what ARIN's calculations are based on in order to understand their limitations and extrapolate to my scenario, and I'm certainly not alone in that. Overall though, great idea! -Adam Adam Thompson Consultant, Infrastructure Services MERLIN 100 - 135 Innovation Drive Winnipeg, MB R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) https://www.merlin.mb.ca Chat with me on Teams ________________________________ From: General-members on behalf of ARIN Sent: Tuesday, January 30, 2024 8:34:25 AM To: general-members at arin.net Subject: [General-members] Consultation on RPKI/BGP Intelligence ARIN is seeking feedback from the community (https://www.arin.net/participate/community/acsp/consultations/2024/2024-1/) regarding the level of information presented to the user when they are using ARIN?s Hosted Resource Public Key Infrastructure (RPKI) product. Currently when ARIN customers create Route Origin Authorizations (ROAs) in ARIN Online, they are only presented with the information in the ROA; they need to use third-party tools to predict the impact of creating the ROA on the global routing table. We plan to add this functionality to a new RPKI dashboard that will allow a user to view the current RPKI validity state and the resulting impact to routing for the resources covered by the ROA. This will let users make more informed decisions about creating ROAs before confirming the changes and without leaving ARIN Online. This functionality will be available to ARIN customers who use ARIN Online. ARIN API users will need to use third-party tools to collect the same information. Proposed Changes - Display a table in the RPKI dashboard with near-real-time route announcements for the Organization?s Internet number resources, as seen in the global BGP table. - The table will show the current RPKI validity state of the route announcements. - Display any mismatches between BGP announcements, existing ROAs, and the resulting RPKI validity state and offer suggestions on how to resolve any mismatches following current best practices. Because most ARIN organizations use the Hosted RPKI product, we believe adding this functionality would benefit a significant number of ARIN customers and enable network operators to make better informed routing decisions. We are seeking community input for any additional information or capabilities that should be included in this proposed new functionality development. The feedback you provide during this consultation will be instrumental in determining how ARIN moves forward with improvements to our routing security services. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at https://lists.arin.net/mailman/listinfo/arin-consult. This consultation will remain open until 5:00 PM ET on 29 February 2024. ARIN seeks clear direction through community input, so your feedback is important. Thank you for your continued support to improve ARIN?s routing security services. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) -- General-members mailing list General-members at arin.net https://lists.arin.net/mailman/listinfo/general-members -------------- next part -------------- An HTML attachment was scrubbed... URL: