1 of 16

ARIN & Routing Security

Steven Wallace

Director - Routing Integrity

ssw@internet2.edu

2 of 16

Why is Routing Integrity Important

Routing attacks & misconfigurations can:

  • Disrupt your internet connection (usually easy to detect)
  • Detour your internet traffic (harder to detect)
  • Make unauthorized use of your IP addresses (can be very hard to detect)

​

Practicing routing security mitigates these attacks, for your network and others.

​

“Each of us protecting all of us”

​

3 of 16

Nearly half of the US R&E IP addresses lack an ARIN agreement

What we see in the Internet2 R&E table:

  • 2,203 ARIN direct IP address assignments
  • 1,023 (46%) without an ARIN Agreement
  • $1,876,124,160 Market value of IP numbers not covered by ARIN agreement!

​

Many mistakenly believe their IP addresses are covered by an ARIN agreement

  • No agreement required to manage whois information (i.e., portal access doesn’t require an agreement)
  • You may be receiving and paying ARIN bills for other resources

​

​

​

​

4 of 16

As of February, Organizations in SoX region that lack an ARIN agreement

(lack Easy Button Access)

[ 4 ]

5 of 16

TL;DR (key points)

Covering your IP numbers with an ARIN agreement allows you to make your network more secure.

​

Signing the ARIN agreement this year locks-in lower fees (20-40 times lower).

​

It’s easier to successfully request changes in the agreement if you follow ARIN’s guidance.

​

ARIN has changed the “No Property Rights” section, to make it more appealing.

6 of 16

We can’t afford to have an Easy Button Gap!

7 of 16

Benefits of the ARIN agreement

  • Access to routing security services:
    • Authenticated IRR
    • Hosted RPKI-ROAs
  • Participation in ARIN’s governance
  • Better sleep knowing you have an agreement that specifies the registration services that announce to the Internet who holds your IP addresses�

NOTE: Using ARIN Hosted RPKI-ROA service is, by far, the easiest way to mitigate the risk of outage due to route hijacking. No equipment changes required. It’s only a bit more complicated than filling out a simple web form!

8 of 16

Routing Integrity

  • Creating RPKI-ROAs for your IP addresses is the
  • Lock in your legacy ARIN fees this year. If you’re in this list, please talk to Steve Wallace.
  • Working with I2 Connectors to resolve rejected prefixes. Five Connectors in the pipeline, the rest before the end of the year. Benefits include higher performance, symmetric routing, routing over intended path.
  • New features to help understanding routing intentions vs implementation in the route reports.
  • ROA planning webinar 2.0 coming soon!
  • Remember, routing integrity is about “Each of us protecting all of us”

8

9 of 16

[ 9 ]

10 of 16

SOX Members that pushed the easy button!

Vanderbilt University

Tennessee Technological University

Vanderbilt University Medical Center

University of South Alabama

​

10

11 of 16

ARIN agreement fee changes (for legacy resources)

For legacy resources in 2023, ARIN’s fees are $175/yr. That’s $175/yr for any number of legacy resources. Signing an agreement this year locks in fee increases of $25/yr.

​

Waiting until next year (or longer) to sign an ARIN agreement will result in fees subject to ARIN’s normal fee schedule. For a single /16, the current fee schedule is $4,000/yr (22 times higher than the legacy fee schedule).

​

Across the Internet2 community, this difference adds up to $2M/yr in fees for agreements signed after 2023, vs $75K/yr in fees for agreements signed this year.

12 of 16

ARIN’s L/RSA Guidance

“To maintain uniformity and consistency, and in fairness to other organizations, modifications to the agreements are not permitted.

​

However, ARIN will consider limited modifications for governmental entities in circumstances where there is a demonstrated need.

​

Demonstrated need refers to circumstances where a governmental entity would not be able, under applicable law, to execute the agreement absent the modification(s).”

13 of 16

ARIN Provides Instructions for How to Request Changes to the L/RSA

https://www.arin.net/resources/guide/legacy/governments/

​

Not following ARIN’s guidance may result in infinite delays!

14 of 16

When requesting changes to the agreement…

  1. In the first line of the Ask ARIN ticket include “ATTN: Lisa Liedel”
  2. Provide information that shows your organization is a governmental entity, state university, etc. For example, charters, legislative documents, funding/budget documents.
  3. Provide, for ARIN’s review, the specific changes to the agreement text that are being requested as necessary to remain compliant with applicable law.
  4. For each change that is being requested, please provide the legal/statutory citation that demonstrates the necessity for the requested change. ARIN cannot consider changes to the RSA/LRSA if this information is not provided.

​

15 of 16

Your members may attend Routing Integrity Office Hours

The next two Routing Integrity Office Hours will be:

​

16-May-2023 4pm ET https://internet2.zoom.us/j/85274238521

​

13-June-2023 4pm ET https://internet2.zoom.us/j/85274238521

​

16 of 16

Resources

​