Summary

  • Ondřej Caletka told RIPE 92 that the meeting network dropped ASPA-invalid paths and then could not reach CZ.NIC over IPv6. Its single upstream had supplied only a best path through an unlisted provider, leaving the meeting router no alternative.
  • An ASPA update restored reachability in about ten minutes, by Caletka’s account. The argument that followed concerned where filtering belongs when an upstream is the last route out, and who can see the path that never reaches the customer.

The filter did exactly what it had been told. That was the trouble. During RIPE 92, Ondřej Caletka and the meeting-network team signed an ASPA object for their own ASN and began rejecting paths that ASPA marked invalid. Then another Ondřej, from CZ.NIC, reported that his network had vanished from the meeting network’s IPv6 view. Caletka took the incident to Friday’s plenary rather than filing it under “interesting things best kept offstage.”

His account in the official transcript describes a small but revealing topology. The meeting network had one upstream, a full BGP table and no default route. The best path it received to CZ.NIC passed through AS6939, Hurricane Electric, which provided free IPv6 transit but was missing from the relevant signed provider lists. ASPA saw an implausible relationship. The meeting router rejected the path. Its upstream had sent only that best path, so a perfectly usable alternative farther up the network never reached Caletka’s router. A rule intended to remove a bad route removed the only route it could see.

The immediate repair was crisp. CZ.NIC’s operator added AS6939 to its ASPA provider list; Caletka said the new data reached the router’s information base in roughly ten minutes. The RIPE NCC operating guide explains why this is an ongoing job: a registry dashboard cannot infer an ASN holder’s actual provider relationships. Operators must list every relevant upstream, including a peer that also acts as a provider, and maintain the object as those relationships change. A free service can still be transit, whatever the contract drawer says.

The room did not hand Caletka a tidy moral. Job Snijders argued that the remote authorization or the transit relationship needed fixing, and warned against blaming validation for exposing that problem. Caletka’s point was about the single-homed customer’s view: it could not choose the authorised alternative its upstream had withheld. Gert Doering suggested accepting routes from a last-resort upstream while filtering at peerings. Those positions appear in the same public discussion. The useful part of the clash is its precision. “Reject invalid” is an easy instruction until the router has no second path to choose.

Caletka builds training labs at the RIPE NCC, according to his staff profile. At RIPE 93 he returned with a tutorial that includes configuring ASPA validation and troubleshooting failures. His Edinburgh experiment supplies the opening exercise: before congratulating a filter on being correct, ask what routes your upstream actually hands you.