Current hosted RPKI implementations across all RIRs follow a hierarchical structure, where access to manage ROAs terminates at the party directly allocated corresponding resources. IPv6 reverse DNS is another example. If you've received a small IPv6 subnet through reallocation, you may face similar restrictions in managing name servers through ARIN Online, necessitating contact with the LIR/ISP responsible.

To address the limitation, one solution is to implement a delegated RPKI setup at LIR/ISP level. This allows the chain of trust to be extended to end users, granting more control over the specific IP resources reallocated. See https://www.arin.net/resources/manage/rpki/delegated/

It's worth noting that this issue primarily stems from technical constraints of the hosted RPKI implementation, rather than being a direct policy matter related to NRPM. There's an opportunity for ARIN to consider adapting its hosted setup to align with the allocation structure in whois database. This integration could facilitate better RPKI adoption.

On 2023-06-23 12:20 p.m., Richard Laager wrote:
It is my understanding that the downstream Org cannot create RPKI ROAs for Reallocated IP Networks. For example, 206.9.80.0/24 is reallocated to me (OrgID WIKSTR-1), but I cannot make a ROA for it.

This is obviously suboptimal for adopting RPKI.

Is this something that we could fix with Policy development, or do I need to bark up some other tree?

--
Richard
--
Best regards
August Yang

Attachment: OpenPGP_0x9C1B40F09053AE75.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature
Description: OpenPGP digital signature

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-PPML@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact i...@arin.net if you experience any issues.

Reply via email to