Openfactory

FreeTransit guide

How to use the RIPE Database for ASN and PI resources

This guide explains the RIPE Database objects you need before Openfactory can request sponsored assignments from the RIPE NCC.

Start request Back to FreeTransit

You are expected to have an account with the RIPE NCC. If you do not have one yet, register at my.ripe.net. RIPE also provides deeper training and certification at RIPE Academy.

Overview

This document provides guidance on how to properly set up your RIPE Database objects in order to receive assignments from the RIPE NCC.

There are three sections:

  1. MAINTAINER and PERSON pair
  2. ORG object
  3. ROUTE(6) objects and RPKI

These cover the basics to get your database side of things set up for your network. If you have improvements to suggest, e-mail support@freetransit.ch.

1. MAINTAINER and PERSON pair

In order to do anything in the RIPE Database, you need a MAINTAINER and PERSON pair. These link your identity and RIPE NCC account, or your e-mail or PGP key if you use those, to your objects within the database.

To get started, visit https://my.ripe.net and log in. You should now have the LIR portal in front of you.

Navigate to RIPE Database, then Create an Object. You should see role and maintainer pair displayed as a suggested object type. Click Create. Four fields should appear.

Field 1: mntner

Enter your maintainer name. You can use your online username or a FIRSTLAST-style name.

Field 2: role

First click Switch to person on the right. Then enter your first and last names, plus middle names if you want to include them.

Examples: Jans Janssens, John Doe.

Field 3: address

Enter your postal address as you would write it on letters.

Field 4: phone

Enter your phone number. This can be a landline, SIP or VoIP line, or mobile number.

Example: +31 20 535 4444.

Click Submit. Write the resulting MAINTAINER and PERSON object names down somewhere safe, because you will not have an easy reference to them until your ASN and PI prefix have been assigned to you.

You can make your address formatting cleaner later by going to Query the RIPE Database, looking up your person object, and adding multiple address attributes.

You now have your MAINTAINER and PERSON pair. With this, you can manage your own objects, link yourself back to other objects, and allow other operators to reference you where needed.

2. ORG object

The ORG object links your name or organisation to INETNUM, INET6NUM, AUT-NUM, and other RIPE Database objects. The RIPE NCC requires an ORG object before you can receive assignments or allocations.

It also contains important information such as an abuse-mailbox attribute, giving network operators a point of contact for abuse reports or bad traffic from your network.

Return to https://my.ripe.net. Navigate to RIPE Database, then Create an Object, select Organisation, and click Create.

organisation

Leave this as-is.

org-name

Enter the displayed name of the ORG object. Use either your full name or the name of the company you are registering for, including the company type where applicable.

Examples: John Doe, AccounTing LLC, Deliux BV.

org-type

This cannot be changed. Leave it as-is.

address

Enter your full postal address, either on one line or on multiple lines. You can create multiple address lines by pressing the downward-facing arrow on the right.

e-mail

Enter your e-mail address.

abuse-c

This is the abuse contact. To create one, click the bell icon on the right-hand side. Enter the e-mail address you want to use as your abuse mailbox and press Submit. A new ROLE object should then be filled into this field.

mnt-ref

This controls which maintainers may reference this ORG object. Enter the maintainer you created in the previous step here, and any other maintainers you want to authorize to reference the ORG object.

If you receive an allocation or assignment from our parent PA IPv6 prefix, we will ask you to add a secondary mnt-ref attribute with OPENFACTORY-NOC as value.

Click Submit. You should receive a success page for the organisation object.

3. ROUTE(6) objects and RPKI

Route and route6 objects, together with RPKI ROAs, allow networks to verify that a specific ASN is authorized to announce a specific prefix. For ROAs this can include a maximum prefix length.

This prevents unauthorized prefix announcements from propagating widely. For your own network, you should create both valid route(6) objects and RPKI ROAs so your space has optimal reachability and is authorized by other networks.

RPKI example

AS64501 Example Company BV announces:

Valid route6 objects exist for all of these. 2001:db8:600::/40 has a ROA for AS65541 down to /48. 2001:db8:4c6::/48 has a ROA for AS64501 as-is. 2001:db8:f0::/44 has a ROA for AS64501 from /44 down to /46.

This means:

IRR example

AS64501 Example Company BV announces:

A valid ROA exists for 2001:db8:850::/44 and a valid route6 object exists for 2001:db8:850::/44. No route6 object exists for 2001:db8:841::/48, but a valid ROA exists for 2001:db8:841::/48.

This means both 2001:db8:841::/48 and 2001:db8:850::/44 will be accepted. A ROA should serve as authorization for announcing a prefix regardless of the route6 object. IRR route(6) objects should be used as fallback where RPKI ROAs are not present or cannot be found.

It is still important to set up route(6) objects because older networks may not filter based on RPKI yet.

Create a route6 object

Assume you received AS210000 and 2001:678:1000::/48.

Go back to https://my.ripe.net. Navigate to RIPE Database, then Create an Object, and select route6.

In the field route6, enter your prefix, for example 2001:678:1000::/48. In the field origin, enter your ASN, for example AS210000. Click Submit.

You now have a route6 object authorizing your AS to originate your network.

Create an RPKI ROA

For RPKI you need to set up a Certificate Authority first. Go to https://my.ripe.net/#/rpki. If you have received a PI assignment, this should ask you to set up a Certificate Authority. Select Hosted CA.

You should now have the RPKI Dashboard in front of you. Go to Route Origin Authorizations (ROAs) and press New ROA on the right.

Three input boxes should appear:

Press the save icon on the right of your column, then click Review and publish changes. If everything looks correct, press Apply the changes to create the ROAs.

You have now set up your ROA for your space. If you received multiple PI assignments, repeat the same process for each one.

ASPA for upstream transit relationships

If you use upstream transit providers, also publish ASPA information in RPKI. ASPA, the Autonomous System Provider Authorization object, lets you state which ASNs are authorized providers for your ASN. This helps networks validate the AS path, not only the route origin.

FreeTransit treats ASPA as part of the expected routing-security setup. When you use FreeTransit or another upstream, add the correct provider ASNs in the RIPE RPKI dashboard and keep them updated when you add or remove upstream transit providers.

ROAs authorize which ASN may originate a prefix. ASPA authorizes which ASNs may appear as providers for your ASN. You should maintain both.