4 ms·

What I wish I knew when I got my ASN

211 points by signa11 3y ago

zamadatix 3y ago
ARIN NRPM 4.10 has special provisions for getting new IPv6 only ASNs under an org with no IPv6 addresses an IPv4 block to facilitate your IPv6 only network via NAT64 as well as hosting core services like DNS dual stacked (which you probably would do if getting your own ASN :)). In regards to peering the Vultr VPS option allows dirt cheap VPSs to peer so I'd recommend checking them out first. Question to the crowd: what's a cheap good way to get a peer for full tables? Vultr is restrictive on that, sensibly so, but it was nice/fun having my own looking glass. I used to have it with a $150/m quarter rack Colo but after my home internet went 5 gig symmetrical it seemed like a massive waste to maintain a remote Colo so I dropped that.
- quantum5 3y ago
  (original author here) Note that ARIN NRPM 4.10 now requires the requested range to be used exclusively for IPv6 transition and not anything else. As for full table, several providers I recommended in the original post are able to do a full table for less than $10/month. You can also join an IX and ask nicely for transit from other members. Some may even offer you free transit the moment you join.
  - zamadatix 3y ago
    4.10 still allows dual stacking core services like DNS but it is intended for NAT64 type deployment for other things (which I'm a fan of anyways! I'd encourage anyone to look into it while waiting for a different assignment, it's really quite good)... that said they are never going to be able to tell if your usage is from NAT64 or raw clients, not that I would condone lying in your application. Thanks, I'll poke around a few and see which looks best! A bit more than Vultr but well worth it for a full table.
  - dal 3y ago
    If you happen to have a pop in Sweden then there is an IX with free ports up to 100GE. https://sonix.network https://sonix.network
  - deleted 3y ago
    [deleted]
- candiddevmike 3y ago
  Out of curiosity, what do you want full tables for?
  - zamadatix 3y ago
    To be honest 90% "it's fun to mess with". I had written my own looking glass type software with some historical statistics. I'm sure you could get similar data elsewhere but it was more about hooking into the route daemon updates and seeing general things or even watching what I was doing on other networks propagate live. 10% is having my own looking glass was significantly faster and easier for me to use. But I probably wouldn't have done it all just for that, it was just fun to mess with.
  - Hikikomori 3y ago
    It's useful if you multi home.
    - Borg3 3y ago
      Its not necessary for multihoming. I am el-cheapo multihomed using Linux router. I use policy routing with 2 default routes (primary and secondary) and everything works like a charm. I could even try to do some ECMP but I care more about stability of ping/jitter that raw bandwidth. And you dont need to bother to ask ISP for BGP or static IPs. You just take whatever you have and slap it together.
      - Hikikomori 3y ago
        Yes, which is why I said useful. With a full table from two ISPs you know which ISP have a shorter path to a CIDR. It's also likely the same path where traffic also comes in from that CIDR.
- sirstan 3y ago
  There are a number of exceedingly niche one-man-show hosts on sites like lowendtalk that will peer and provide full tables for a couple dollars a month.
- pyvpx 3y ago
  try bgp.services
Hikikomori 3y ago
Dealt with RIPE quite a bit, but haven't done the work to set up a LIR from scratch. Once had to regain control and change some IPv4 and related assets in their database as the company was acquired, but they had not even updated the assets from the previous company name and the access key wasn't documented. RIPE demanded me to fax them the request on company letterhead of the previous company, did find that in storage and luckily enough the big office printer could also fax.
detourdog 3y ago
Anyone else trying to follow along. I want to try this but as group effort.
Macha 3y ago
One thing I find slightly confusing/frustrating about IPv6. You're discouraged from using ULAs (basically the equivalent of private addresses from v4) as they'd rather you use GUAs. But you get your GUAs from your ISP normally, which means if you change your ISP you need to renumber your network. They also generally frown on NPT66. So the supported solution is to get PI space. But to get PI space you need to have an ASN first, which requires you to have public peers, which are you just expected to get someone to peer you and then just firewall all the incoming traffic? These seems to be the one option for stable addresses on a IPv6 network that is not vaguely disapproved of. Or what people actually do is avoid all that complexity and run IPv4 locally and use RFC1918 addreses NAT46, which seems like a self inflicted defeat to the IPv6 first aims of the IETF, IANA and the RIRs.
- quantum5 3y ago
  You don't actually need an ASN to get PI though? You can use PI just fine with BYOIP. Actually... I don't think you are even required to announce them on the Internet.
  - throw0101c 3y ago
    You need the coöperation of the ISP(s), but what you can do is get PI space, run BGP on your router, and use a private ASN (64512-65534) to advertise to your ISP, and then your ISP advertises to the world with their ASN. One common scenario is two links to the same ISP, so everyone knows which link is active (you can do active-active (load balancing/sharing), or change weights or local preference for active-passive): * https://learn.nsrc.org/bgp/two_links_one_isp_backup https://learn.nsrc.org/bgp/two_links_one_isp_backup * https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing
    - quantum5 3y ago
      The whole BGP process with a private ASN that the ISP strips out and replace with their own ASN on the Internet is how "BYOIP" (bring your own IP) usually works.
easterncalculus 3y ago
https://dn42.eu/ https://dn42.eu/ is a big VPN that you can use to learn BGP, if anyone is interested.

211 points by signa11 3y ago

ARIN NRPM 4.10 has special provisions for getting new IPv6 only ASNs under an org with no IPv6 addresses an IPv4 block to facilitate your IPv6 only network via NAT64 as well as hosting core services like DNS dual stacked (which you probably would do if getting your own ASN :)). In regards to peering the Vultr VPS option allows dirt cheap VPSs to peer so I'd recommend checking them out first. Question to the crowd: what's a cheap good way to get a peer for full tables? Vultr is restrictive on that, sensibly so, but it was nice/fun having my own looking glass. I used to have it with a $150/m quarter rack Colo but after my home internet went 5 gig symmetrical it seemed like a massive waste to maintain a remote Colo so I dropped that.

quantum5 3y ago
(original author here) Note that ARIN NRPM 4.10 now requires the requested range to be used exclusively for IPv6 transition and not anything else. As for full table, several providers I recommended in the original post are able to do a full table for less than $10/month. You can also join an IX and ask nicely for transit from other members. Some may even offer you free transit the moment you join.
- zamadatix 3y ago
  4.10 still allows dual stacking core services like DNS but it is intended for NAT64 type deployment for other things (which I'm a fan of anyways! I'd encourage anyone to look into it while waiting for a different assignment, it's really quite good)... that said they are never going to be able to tell if your usage is from NAT64 or raw clients, not that I would condone lying in your application. Thanks, I'll poke around a few and see which looks best! A bit more than Vultr but well worth it for a full table.
- dal 3y ago
  If you happen to have a pop in Sweden then there is an IX with free ports up to 100GE. https://sonix.network https://sonix.network
- deleted 3y ago
  [deleted]
candiddevmike 3y ago
Out of curiosity, what do you want full tables for?
- zamadatix 3y ago
  To be honest 90% "it's fun to mess with". I had written my own looking glass type software with some historical statistics. I'm sure you could get similar data elsewhere but it was more about hooking into the route daemon updates and seeing general things or even watching what I was doing on other networks propagate live. 10% is having my own looking glass was significantly faster and easier for me to use. But I probably wouldn't have done it all just for that, it was just fun to mess with.
- Hikikomori 3y ago
  It's useful if you multi home.
  - Borg3 3y ago
    Its not necessary for multihoming. I am el-cheapo multihomed using Linux router. I use policy routing with 2 default routes (primary and secondary) and everything works like a charm. I could even try to do some ECMP but I care more about stability of ping/jitter that raw bandwidth. And you dont need to bother to ask ISP for BGP or static IPs. You just take whatever you have and slap it together.
    - Hikikomori 3y ago
      Yes, which is why I said useful. With a full table from two ISPs you know which ISP have a shorter path to a CIDR. It's also likely the same path where traffic also comes in from that CIDR.
sirstan 3y ago
There are a number of exceedingly niche one-man-show hosts on sites like lowendtalk that will peer and provide full tables for a couple dollars a month.
pyvpx 3y ago
try bgp.services

Hikikomori 3y ago

Dealt with RIPE quite a bit, but haven't done the work to set up a LIR from scratch. Once had to regain control and change some IPv4 and related assets in their database as the company was acquired, but they had not even updated the assets from the previous company name and the access key wasn't documented. RIPE demanded me to fax them the request on company letterhead of the previous company, did find that in storage and luckily enough the big office printer could also fax.

detourdog 3y ago

Anyone else trying to follow along. I want to try this but as group effort.

Macha 3y ago

One thing I find slightly confusing/frustrating about IPv6. You're discouraged from using ULAs (basically the equivalent of private addresses from v4) as they'd rather you use GUAs. But you get your GUAs from your ISP normally, which means if you change your ISP you need to renumber your network. They also generally frown on NPT66. So the supported solution is to get PI space. But to get PI space you need to have an ASN first, which requires you to have public peers, which are you just expected to get someone to peer you and then just firewall all the incoming traffic? These seems to be the one option for stable addresses on a IPv6 network that is not vaguely disapproved of. Or what people actually do is avoid all that complexity and run IPv4 locally and use RFC1918 addreses NAT46, which seems like a self inflicted defeat to the IPv6 first aims of the IETF, IANA and the RIRs.

quantum5 3y ago
You don't actually need an ASN to get PI though? You can use PI just fine with BYOIP. Actually... I don't think you are even required to announce them on the Internet.
- throw0101c 3y ago
  You need the coöperation of the ISP(s), but what you can do is get PI space, run BGP on your router, and use a private ASN (64512-65534) to advertise to your ISP, and then your ISP advertises to the world with their ASN. One common scenario is two links to the same ISP, so everyone knows which link is active (you can do active-active (load balancing/sharing), or change weights or local preference for active-passive): * https://learn.nsrc.org/bgp/two_links_one_isp_backup https://learn.nsrc.org/bgp/two_links_one_isp_backup * https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing https://learn.nsrc.org/bgp/two_links_one_isp_load_balancing
  - quantum5 3y ago
    The whole BGP process with a private ASN that the ISP strips out and replace with their own ASN on the Internet is how "BYOIP" (bring your own IP) usually works.

easterncalculus 3y ago

https://dn42.eu/ https://dn42.eu/ is a big VPN that you can use to learn BGP, if anyone is interested.