RIPE NCC account & database setup for your sponsored ASN

RIPE NCC Access is the single sign-on for every RIPE tool, including the RIPE Database web UI you will use for the next steps.

1. Go to access.ripe.net/registration.
2. Enter your email and set a password.
3. Enable two-factor authentication — it is mandatory.
4. Confirm the verification email to finish.

A mntner (maintainer) is the key that protects your other objects. A role object holds contact details. They reference each other, so the RIPE Database creates them together through one self-service form.

1. Open the create role + maintainer form (logged in to RIPE NCC Access).
2. Fill the fields below and submit.
3. Record the nic-hdl primary key it returns (for example AB1234-RIPE) and the maintainer name.

How they fit together: the maintainer protects an object through its mnt-by attribute — any change needs the maintainer's authentication. The role is linked from other objects through admin-c and tech-c. The maintainer's own admin-c points back at the role.

Every organisation object must reference a contact that carries an abuse-mailbox attribute. Abuse complaints about your network are sent there.

Quick way: when you create the organisation object in step 4, click the bell icon next to the abuse-c field — the RIPE Database generates a role with an abuse-mailbox for you.

Manual way:

1. Open the RIPE Database query page and look up the role primary key from step 2.
2. Choose Update object.
3. Add an abuse-mailbox attribute with a working address.
4. Submit.

The organisation object represents you as the resource holder and is what the ASN is linked to.

1. Open the create organisation form.
2. Complete the fields below.
3. Record the identifier it returns (for example ORG-EN123-RIPE).

Once steps 1–4 are done, send us the following through your order page or by email. We file the ASN request with the RIPE NCC using it.

Processing time depends on how complete the application is and on any follow-up questions from the RIPE NCC. We do not promise a fixed turnaround.

A route6 object is an IRR record, not an identity object. It links a prefix to the ASN allowed to originate it, and some upstreams build their prefix filters from it. Many do not require one.

1. Ask each upstream whether they need a route6 object.
2. Check the authorisation path. If it runs through Hexraa-managed PA records, ask us to create the object rather than doing it yourself.
3. Otherwise, in the RIPE Database web UI choose Create an Object → route6, fill the fields, and submit.

A Route Origin Authorization (ROA) is a signed statement that a given ASN may originate a given prefix. Networks that validate RPKI reject announcements that conflict with a published ROA.

Your PA prefix ROA is managed by Hexraa

Because the IPv6 PA /48 comes from the sponsoring LIR's allocation, the RPKI authority for it sits with Hexraa. We create, change and withdraw the ROA. You cannot manage it yourself in the RIPE NCC Portal.

Before you bring up BGP, send us a request like this:

Please create a ROA for:
  prefix:     2001:db8:1a2b::/48
  origin:     AS215123
  maxLength:  /48

We publish the ROA; you can confirm it on RIPEstat or bgp.tools.

Understanding maxLength

maxLength is the most-specific prefix length the ROA authorises. Anything more specific, or from a different origin ASN, is RPKI Invalid. Example ROA: prefix 2001:db8:f000::/44, maxLength /46, origin AS215123:

RPKI and IRR are separate controls

An RPKI ROA validates origin ASN and prefix length. An IRR route6 object is a routing-policy record used for filtering. A valid ROA does not create an IRR object, and an IRR object does not change RPKI. Upstreams may check either or both.

If you need independent (PI) resources

The sponsorship package includes an IPv6 PA /48, which means Hexraa manages its ROA and the prefix stays with the sponsor. IPv6 PI is a separate request with its own eligibility check, fee and RPKI arrangement — it is not an upgrade that keeps the same addresses. If you know you need independent addressing, raise PI with a sponsoring LIR before ordering PA service.

An as-set groups ASNs so upstreams and IXPs can generate prefix filters for you and your downstreams. Create one only when a routing policy or an upstream actually needs it. It is not part of the standard service.

1. In the RIPE Database web UI choose Create an Object → as-set.
2. Fill the fields and submit.

1. Confirm the ROA origin and prefix match what you will announce, and create any IRR objects your upstream requires.
2. Install a BGP daemon — BIRD 2 or FRRouting are the common choices.
3. Get session parameters (peer IP, ASN, MD5 if any, prefix limits) from each upstream or peer and bring the sessions up.