ARIN-prop-192 [Archived]

ARIN-prop-192 Out of Region Use

Proposal Originator: David Farmer

Date: 16 December 2013

Problem statement:

APNIC and RIPE have implemented their last /8 austerity policies for IPv4, providing one last minimal allocation (up to /22) for each member organization. This has caused demand for IPv4 resources to shift to the ARIN region and significantly increased the amount of IPv4 resources that are being requested for out of region use, as reported by ARIN staff. As a result, several proposals have attempted to restrict or otherwise limit out of region use, the latest of which was ARIN-2013-6. None of these proposals to restrict out of region use have achieved consensus within the ARIN community.

While on the other hand, current policy is ambiguous on the issue of out of region use, it is neither explicitly forbidden or permitted. This results in some people assuming they cannot use ARIN issued resource out of the region at all. Therefore, they assume they cannot get IPv6 resources from AIRN to operate a global network, and they must get IPv6 resources from multiple RIRs. In spite of the fact that this will result in more unique non-aggregatable IPv6 prefixes within the IPv6 route table.

However, as a result of language and logistical barriers that the regionality of the RIR system was originally conceived to mitigate, it is much more difficult for ARIN to independently verify the utilization of resources that are reassigned or otherwise used outside of the ARIN service region.

This proposal intends to defines out of region use and explicitly permits it without any limits. While also requiring ARIN to verify out of region use to no less than an equivalent standard as in region use. Further, it intends to assist ARIN in that task by allowing independent external entities to be engaged to assist in the verification of information related to any resources used outside the ARIN region.

Policy statement:

Create new Section X;

X. Out of Region Use

ARIN registered resources may be used outside the ARIN service region. Resources are considered to be used outside the ARIN service region, if any of the following are located outside the region.

A. The user or customer billing address

B. The user or customer service address

C. The technical infrastructure address, such as the point of presence (POP), data center, or other similar location

X.1 Verification of Out of Region Use

The utilization of ARIN registered resources must be verified when evaluating a request for additional resources or during a resource review, including any resources used outside the ARIN service region. Resources used outside the region must be verified to no less than an equivalent standard as resources used within the region. To this end, ARIN, in its sole discretion, may engage independent external entities to assist it in the verification of information related to any resources used outside the region.

X.2 Incidental Use Exempt

Out of region use of ARIN registered resources by an organization that totals less than an equivalent of a /20 of IPv4, a /36 of IPv6, and 10 ASNs are considered incidental use and as such are exempt.

X.3. Critical Infrastructure Exempt

Resources justified through critical infrastructure policies are exempt.

X.4 Multi-Instance Use

Any resources used simultaneously in multiple locations, such as an anycast prefix or ASN, are considered as used within the ARIN service region, provided at least one instance is located within the region, regardless of how many other instances are located outside the region.

Comments:

a. Timetable for implementation: Immediate

b. Anything else

Over the past couple years several policy proposals have attempted to place limits on out of region use. None of these proposals gained consensus within the ARIN community. During the latest of these proposals, ARIN-2013-6, several standards were explored, a majority of use within region, a plurality of use within region, and some discussion of a minimum of 20 percent use within region. It was felt by most that each of these standards would interfered, to one extent or another, with the legitimate operations of many global businesses or global service providers based within the ARIN region.

The major concept behind this proposal is to allow out of region use without any limits, but bring an economic factor to play on the issue. It requires ARIN to verify out of region use to no less than an equivalent standard as in region use, and enables ARIN to engage external entities to assist in this verification. It is expected ARIN will have agreements with all such external entities that ensure the confidentiality of all supporting documentation is preserved.

The additional expense and complexity involved in verifying out of region use, as a result of language and logistical barriers that the regionality of the RIR system was originally conceived to mitigate, justifies a recommendation to the Board of Trusties to create a separate fee structure for out of region use, and creates the aforementioned economic factor. Furthermore, it seems reasonable that these expenses should be born by those that make substantial use of ARIN registered resources outside the region, and not by those that primarily use resources within the region.

This proposal defines incidental out of region use, to ensure that trivial, insignificant or otherwise incidental use are exempt from this economic factor. Some minimal amount of out of region use should be considered normal even for a network primarily based within the ARIN region. The currently proposed policy statement, X.2, defines incidental use in terms of an absolute thresholds for each type of resource.

Another option would be a percentage based threshold, say 20%. However, a percentage based threshold has the disadvantage that even a minimal change in usage can cause the ratio between in region and out of region use to change, potentially causing an oscillation around this threshold. This creates significant uncertainty for organizations as to if this economic factor applies to them. Where as once an absolute threshold has been crossed by a significant amount, it is highly unlikely that any additional changes in usage will cause an oscillation around the threshold, providing much more certainty for organizations.

Additionally, the proposal deal with a couple special cases. It makes clear how anycast prefixes should be considered when they are used both inside and outside the region. And, that critical infrastructure is exempt due to its relatively small resource impact and its high importance to overall Internet stability.

In summary, this proposal ensures that global organizations or service providers base within the ARIN region may receive resources to operate their global network solely from ARIN, if they wish to do so. As long as the utilization of the out of region resources are verified to no less than an equivalent standard as in region resource. This is particularly important for IPv6, to minimize the number of unique non-aggregatable prefixes within the IPv6 route table on a global basis.

Finally, a separate but somewhat related issue; regardless of where ARIN registered resources are used, inside or outside the the ARIN service region, organizations must first qualify to receive resources from ARIN. ARIN’s current operational practice is that an organization must be formed within the ARIN service region in order to qualify to receive any resources from ARIN. The issue of who should be eligible to receive resources was commingled with out of region use in ARIN-2013-6. It was felt these issues should be considered separately. Therefore, the issue of who should be eligible to receive resources is purposefully not dealt with by this proposal, and there may be other policy proposals that deal with that issue independently.