By Steven Wallace, Internet2 Security Architect
Estimated reading time: 3 minutes
Update: This blog has been updated to reflect ARIN’s revised deadline for the IRR transition.
With the April 2022 deadline for ARIN’s IRR transition fast approaching, here’s what network operators need to know now:
- Over 60 organizations that connect to the Internet2 network still use the ARIN non-authenticated IRR service that will be decommissioned on April 4, 2022.
- ARIN will NOT automatically migrate information from the legacy to the new IRR service.
- After April 4, many of the networks that interconnect with Internet2 – including Google, Amazon, and Hurricane Electric – will no longer accept Internet2 routes from organizations that are only published in ARIN’s decommissioned non-authenticated IRR, thereby adversely affecting traffic being sent via Internet2 (i.e., I2PX, R&E IP).
- If your organization is currently using the ARIN non-authenticated IRR, you must register with the new ARIN IRR or another eligible IRR before April 4 or your traffic destined to Internet2 will be adversely affected.
Read on for further explanation, including how to prepare for the April 4, 2022, deadline.
Why the Internet Routing Registry?
The American Registry for Internet Numbers (ARIN) provides a service, known as the Internet Routing Registry (IRR), that allows network operators to publish their routing policies. Network operators, including research and education campuses, publish their routing policies via an IRR to better protect the routing security of their networks. For example, using ARIN’s IRR service, a campus can publish the set of IP numbers that should be announced for its networks, helping to prevent other organizations from hijacking or otherwise misusing the IP numbers belonging to the campus.
As a part of their more robust assurance practices, networks upstream of a campus – such as state and regional networks, internet service providers, and Internet2 – can use a campus’s IRR entries to ensure they are accepting and forwarding traffic consistently with the campus’s published policy. Networks such as Google, Amazon, and Hurricane Electric also use IRR information to determine whether or not to accept routes.
Many of the networks that interconnect with Internet2, including those mentioned above, will accept Internet2 routes only from organizations that have published their routing policy via the IRR. If an organization’s IRR information is incorrect or missing, Google’s traffic would no longer flow over that organization’s Internet2 connection. Network users would still have access to Google, but that traffic would take the slower – and sometimes more costly – commodity connection.
ARIN to Decommission Legacy IRR in April
ARIN is in the process of transitioning to a new version of the IRR and will decommission the legacy IRR on April 4, 2022. Because the new IRR has different authentication requirements and more advanced services, ARIN will NOT automatically migrate information from the non-authenticated IRR to the new and improved version.
Network operators must migrate their information to ARIN’s new authenticated IRR, or another IRR (e.g., RADB, RIPE, APNIC, AFRINIC, ARIN, LACNIC, NTT, Level3), by April 4. Otherwise, those network operators will no longer have a published routing policy, and networks such as Google may stop accepting some of Internet2’s routes as a result.
How to Prepare for the ARIN IRR Transition
Here’s what you can do to prepare for the decommissioning of ARIN’s legacy IRR:
- If you are in a leadership position, ask your network operations group to review this blog post.
- If you are part of an organization’s network operations group, view the route reports that Internet2 produces to help identify the networks at risk of losing their IRR information after April 4: https://github.internet2.edu/ssw/IRR-report/tree/master/Connectors
These reports are organized by the Internet2 connector. If you see a network for your organization that has Column J colored red, that network’s IRR records will likely disappear after April 4. To prevent this from affecting your Internet2 connection, you’ll need to create a new record in ARIN’s new IRR or another IRR such as Merit’s RADB.
If you have questions concerning the route reports or how to manage your IRR entries, contact me at manrs@internet2.edu.