Recent IRR changes
Matsuzaki ʻmazʼ Yoshinobu<maz@iij.ad.jp>

SANOG41/INNOG7

maz@iij.ad.jp

1Internet Routing Registry (IRR)• To publish your own routing intentions• route/route6• Specify the origin AS for an IP prefix• as-set• Specify a list of ASes to be advertised• To construct route filters based on the registered objects• APNIC IRR and RADB are popular IRR in AP region• Some NIRs are also operating its IRR such as JPIRR by JPNICSANOG41/INNOG7

maz@iij.ad.jp

2

IRR as-set• Publishing your advertisement in advance• Important technical information exchanged when peeringwith peers and upstreams
as-set:descr:
members::
mnt-by:source:SANOG41/INNOG7

maz@iij.ad.jp

AS-IIJ
ASes routed by IIJ
AS-IIJ-T1, AS2497,
MAINT-AS2497
JPIRR

3

APNIC IRR and Hierarchical as-set• prop-151: Restricting non-hierarchical as-set• Reached consensus at APNIC 55 (2023)• To fix the Name Collision Issue• AS-AMAZON, AS-TWITTER and so on…

as-set:descr:
members:
admin-c:tech-c::mnt-by:source:

AS-AMAZON
Amazon ASNs
AS-AMAZON-NA, AS-AMAZON-AP,AS-AMAZON-EU
AC6-ORG-ARIN
AC6-ORG-ARIN

as-set:tech-c:admin-c::
mnt-by:source:

AS-AMAZONDUMY-RIPE
DUMY-RIPE
KATERINA-MNT
RIPE

MAINT-AS16509
RADB

SANOG41/INNOG7

maz@iij.ad.jp

4

Hierarchical as-set (RFC2622)• Non-hierarchical as-set example• AS-APNIC (This is not an APNICʼs as-set)• AS-4608 (APNICʼs as-set, not in Hierarchical naming scheme)• Hierarchical as-set example• AS17494:AS-CUSTOMERS• The notation is <AS#>:AS-<as-set name>• Only that AS number's maintainer can create the object• Resolving Name Collision Issues

SANOG41/INNOG7

maz@iij.ad.jp

5Safe Transition Plan
• Step 1: Create a new Hierarchical as-set• Register a new as-set with Hierarchical naming scheme• Letʼs say itʼs AS2497:AS-IIJ• This has the same members as the existing as-set (AS-IIJ)• Step 2: Make the old as-set a reference to the new one• Modify the member of the existing as-set as AS2497:AS-IIJ• Thereafter, only AS2497:AS-IIJ needs to be updated• Step 3: Notify peers• Update the peeringdb information• Ask peers and upstreams to use to the new as-set• Step 4: Delete the old as-set• Delete the old non-hierarchical as-set after this transition
completes

SANOG41/INNOG7

maz@iij.ad.jp

6Our Current AS-SET (Non-hierarchical as-set)
as-set:descr:
members::
mnt-by:source:New AS-SET (Hierarchical as-set)
as-set:descr:
members::
mnt-by:source:SANOG41/INNOG7

AS2497:AS-IIJ
ASes routed by IIJ
AS2497:AS-IIJ-T1,
AS2497,
MAINT-AS2497
JPIRR

AS-IIJ
ASes routed by IIJ
AS-IIJ-T1, AS2497,
MAINT-AS2497
JPIRR

For backward compatibility (Non-hierarchical)
To be deleted after migration
as-set:descr:
members:
mnt-by:source:maz@iij.ad.jp

AS-IIJ
Please refer AS2497:AS-IIJ
AS2497:AS-IIJ
MAINT-AS2497
JPIRR

7

RADB and RPKI
• RADB migrated to IRRDv4 on November 13th, 2023
• New features related to RPKI have been implemented• route/route6 objects falling under RPKI Invalid• RPKI Invalid objects will no longer visible in a query• Objects that have not_found or valid RPKI will not be effected• Any new objects that are Invalid will be rejected and any
modification of an existing Invalid object will be rejected as well

SANOG41/INNOG7

maz@iij.ad.jp

8

ROA and RPKI ROV Invalid• A route object registration that is inconsistent with thecorresponding ROA will be rejected by RADB

ROA
prefix: 1.1.1.0/24
as:13335

route: 1.1.1.0/24
origin: AS13335
source: RADB
route: 1.1.1.0/25
origin: AS13335
source: RADB

Registrable

To be rejectedroute: 1.1.1.0/24
origin: AS12345
source: RADBSANOG41/INNOG7

maz@iij.ad.jp

9ROA and RPKI ROV Invalid• RPKI Invalid objects will no longer visible in a query
RADBROA
prefix: 1.1.1.0/24
as:13335

route: 1.1.1.0/24
origin: AS13335
source: RADB
route: 1.1.1.0/25
origin: AS13335
source: RADBvisible

Not visible

route: 1.1.1.0/24
origin: AS12345
source: RADBSANOG41/INNOG7

maz@iij.ad.jp10Creating a minimal ROA• Assume we have the following ROA and route object
ROA

route: 2001:db8::/32
origin: AS64512
source: RADB

prefix: 2001:db8::/32
as:64512• If for some reason I want to create a route object with a
sub prefix (/34), how should I modify/issue ROA?
idea 1: max-length

ROA
prefix:2001:db8::/32
as:
64512
max-length:34
SANOG41/INNOG7

idea 2: additional ROA
ROA

ROA

prefix: 2001:db8::/32
as:
64512

prefix: 2001:db8::/34
as:
64512

maz@iij.ad.jp

11Summary• APNIC account holders are only permitted to create
hierarchical as-sets at APNIC IRR• For transition, Safe Transition Plan (P.6) is available• RADB is rejecting RPKI ROA Invalid• This protects you because no one can register a route object
that is inconsistent with the ROA!

• Keep your ROA minimal as possible to protect yournetwork

SANOG41/INNOG7

maz@iij.ad.jp

12