Shikanoko Networks (SKNK)

RIPE NCC Account Registration and Database Setup Guide

Last updated: July 2026

Audience: Customers applying for ASN sponsorship services from SKNK (Shikanoko Networks). SKNK submits the ASN request to RIPE NCC on your behalf and assigns an IPv6 PA /48 from SKNK's LIR allocation. This document covers the parts you need to do yourself: registering a RIPE NCC Access account, creating your identity records, and the necessary setup after receiving your resources. For the covered SKNK PA prefix, the standard service includes creating and maintaining the matching IRR route/route6 object; AS-SET follows the actual filtering need and available maintainer authority.

Scope note: RIPE Database identity records and IRR routing objects are different things. You maintain your own RIPE NCC Access, organisation, contact, and maintainer records. Put any identifiers or planned network details that are already available into the single order form before payment; do not open a separate customer-assistance request for a new order. For the covered SKNK PA prefix, the standard service includes creating and maintaining the matching IRR route/route6 object. AS-SET creation and ongoing maintenance are not included; if you need one, you or your routing provider must arrange it with the relevant maintainer authorization.

Disclaimer: This guide is provided for informational purposes only and does not constitute legal or professional advice. RIPE NCC policies, procedures, and interface designs may change at any time — always refer to the official RIPE NCC documentation for the most current information. Shikanoko Networks is not liable for any issues arising from the use of this guide. SKNK is an independent RIPE NCC LIR member and is not affiliated with or endorsed by RIPE NCC. RIPE NCC is a trademark of RIPE NCC.

1. Prerequisites

Before you begin, make sure you have the following ready:

Item Description
Identity or registration documents A valid Passport or National ID card for an individual; verifiable registration documents for an organisation or registered sole trader.
Evidence supporting the network need Information or documents showing a policy-compliant ASN need connected to the RIPE NCC service region. The exact evidence depends on the case.
Planned upstream or peering information The networks you expect to connect or peer with. SKNK reviews whether the information is sufficient and may request clarification.
Contact email Used for RIPE NCC Access registration and RIPE Database contacts. Important: This email will receive verification messages, so be sure to use a real, accessible address.
Postal address The applicant's verifiable residential, registered, or business address.

2. Registering RIPE NCC Access Account

RIPE NCC Access is your unified portal for managing RIPE resources. All RIPE services require this account to log in.

  1. Navigate to https://access.ripe.net/registration
  2. Enter your email address and set a password
  3. Two-Factor Authentication (2FA) is mandatory -- RIPE NCC now requires it
  4. Complete registration after verifying your email

⚠️ Keep your RIPE NCC Access account credentials safe. You will need it to log in for all subsequent RIPE Database operations.

3. Creating Role and Maintainer Objects

This is the most critical step. In the RIPE Database, a contact object (role or person) represents your contact information, and a maintainer (mntner) object controls who can modify your database records. These two objects must be created together, because they reference each other.

💡 Contact objects: An individual may use a person object for their own contact. An organisation or sole trader may use a person object for an individual technical contact or a role object for a function such as a NOC. This choice does not change SKNK's applicant-eligibility rules. The steps below use a role as an example.

3.1 Creating role + mntner Together

Open the following link: 👉 https://apps.db.ripe.net/db-web-ui/webupdates/create/RIPE/role/self

Fill in the following fields:

Field Description Example
mntner Maintainer identifier. May only contain letters (A-Z, a-z), digits, _- YOURNAME-MNT
role Role object name. If using person, enter your full name YOURNAME NOC or John Doe
address Your postal address (can be multi-line) 128 City Road, London, UK
e-mail Your contact email [email protected]
phone Phone number (person object has this field; role does not) +44 20 1234 5678

Click SUBMIT once done.

📌 Important: After successful submission, the page will display role with primary key "XXXX-RIPE". Make a note of this value (e.g., AB1234-RIPE) -- enter it in the RIPE details section of your order if the form asks for it. Also note your mntner name. Until the ASN is allocated, you will not be able to find these objects by searching the RIPE Database, so keep them on record yourself.

3.2 Understanding the Relationship Between role/person and mntner

  • The mntner object protects other objects via the mnt-by attribute -- any modification to an object requires maintainer authentication.
  • The role/person object is linked to the maintainer via the admin-c attribute, providing administrator contact information.
  • They reference each other: the mntner's admin-c points to the role, and the role's mnt-by points to the mntner. This is why they must be created together.

4. Setting Up Abuse Notification Mailbox

RIPE NCC requires every organisation object to be associated with a contact object that has an abuse-mailbox attribute.

Quick method (recommended): When creating your organisation in the next step, click the 🔔 bell icon next to the abuse-c field. The system will automatically create a role object with abuse-mailbox and populate it for you. Done in one click.

Manual method (if you have already created the organisation or prefer to manage it manually): Add the abuse notification mailbox to the role you created in Step 3.

  1. Open https://apps.db.ripe.net/db-web-ui/query
  2. Enter the role primary key from Step 3 (e.g., AB1234-RIPE) in the search box and click search
  3. Click Update object in the top-right corner of the search results
  4. Click the + sign next to the e-mail field and add the abuse-mailbox attribute
  5. Enter your abuse notification email (can be the same as your contact email)
  6. Click SUBMIT to save

⚠️ RIPE NCC will verify that this mailbox is valid, so please ensure it is real and accessible. The abuse notification mailbox is used to receive network abuse complaints -- hopefully you will never need it, but it is mandatory.

5. Creating Organisation Object

The organisation object represents the applicant in the RIPE Database, and the ASN is associated with this object.

  1. Open https://apps.db.ripe.net/db-web-ui/webupdates/create/RIPE/organisation
  2. Fill in the following fields:
Field Description Example
mnt-by Who manages this object. Auto-filled with the mntner from Step 3 YOURNAME-MNT (auto-filled)
organisation Defaults to AUTO-1. The system will generate an identifier automatically Leave blank
org-name Full legal name of the organisation or sole trader, or the individual's full name YOUR COMPANY LLC or Jane Doe
address Residential, registered, or business address 128 City Road, London, UK
e-mail Contact email [email protected]
abuse-c Abuse contact. Click the 🔔 bell icon on the right to create one automatically System auto-generates from your email
mnt-ref Who may reference this organisation. At minimum, include your own mntner + SKNK's mntner (SKNK will provide theirs) YOURNAME-MNT, lir-uk-shikanoko-1-MNT
  1. Click SUBMIT

📌 After successful submission, the page will display organisation "ORG-XXXX-RIPE". Make a note of this value and enter it in the RIPE details section of your order if requested.

6. RIPE details in your order

Complete the registration and setup in steps 1–6, then enter the following information in the RIPE details section of the same order form before payment. This keeps the application, peer details, evidence, and RIPE identifiers together:

Item Where to get it
organisation Organisation identifier from Step 5 (e.g., ORG-XX1-RIPE)
admin-c Role primary key from Step 3 (e.g., AB1234-RIPE)
tech-c Can be the same as admin-c, or create a dedicated role
Email associated with abuse-c The abuse-mailbox email address set in Step 4, e.g., [email protected]. Enter the email in this order form; the RIPE Database abuse-c attribute still takes a role primary key
mnt-by Mntner identifier from Step 3 (e.g., YOURNAME-MNT)
as-name Desired AS name (e.g., YOURCOMPANY-AS)
Registration and identity documents For applicant verification
Evidence supporting the network need Case-appropriate network, upstream, or peering information

SKNK uses the saved order information to prepare the ASN request. RIPE NCC reviews each request independently, and timing varies with the case and any follow-up questions. Complete these details on the order page before payment; there is no separate supplementary-details or customer-assistance page.

7. If Your Upstream Requires a route or route6 Object

A route or route6 object is an IRR routing record. It is not the same as your RIPE Database identity records, and it is not required by every upstream. First ask your upstream which object, IRR source, exact-match rule, and Origin ASN it expects. For the covered SKNK PA prefix, the standard service includes creating and maintaining the matching route/route6 object. AS-SET follows the actual filtering need and available maintainer authority.

Before SKNK creates or updates one, confirm the requirement and authorization path with us. RIPE Database validates the maintainer authorization for the relevant address space; a customer's usual mntner is not automatically sufficient. Send SKNK the exact prefix, Origin ASN, IRR source, and upstream requirement so we can confirm the covered resource and the applicable authorization.

Once the upstream requirement and authorization are confirmed:

  1. Send SKNK the exact prefix, Origin ASN, IRR source, and upstream filtering requirements.
  2. SKNK creates or updates the matching route/route6 object when it is within the covered PA prefix and the required authorization is confirmed.
  3. Query the exact prefix and Origin ASN in the RIPE Database and confirm the published result with your upstream. A route/route6 object does not create or change a ROA.

💡 If you have multiple covered prefixes, each one needs its own matching route or route6 object. Prefixes outside the covered service scope require separate assessment.

8. Setting Up RPKI / ROA

RPKI (Resource Public Key Infrastructure) uses ROAs (Route Origin Authorizations) so relying parties can validate whether a given ASN is authorized to originate a prefix, within an approved maximum prefix length. A ROA does not guarantee that an upstream will accept an announcement, but it is an important route-origin security control.

8.1 RPKI Setup for PA Prefixes

Because the IPv6 PA /48 comes from Provider Aggregatable address space held by SKNK's LIR, RPKI authority for that resource is controlled by SKNK. SKNK creates, maintains, and withdraws the corresponding ROA. You have the right to use the prefix but do not directly hold its RIPE NCC resource certificate, so you cannot independently manage the PA prefix's ROA in the RIPE NCC Portal.

What you need to do: Before configuring BGP or changing the Origin ASN for the PA prefix, contact SKNK (via email or order system) and specify:

Please add a ROA for 2001:db8:abcd::/48 with origin AS215000 and maxLength /48.

SKNK will create the ROA for you. After it is created, you can verify the RPKI status on RIPEstat.

8.2 The Role of ROA maxLength (Important)

The maxLength in a ROA is the most-specific prefix length that the ROA authorizes. An announcement that is more specific than maxLength, or uses a different Origin ASN, is RPKI Invalid.

Example: Your prefix is 2001:db8:f0::/44, and the ROA sets maxLength to /46:

Prefix you announce Result Reason
2001:db8:f0::/44 ✅ Accepted Within allowed range
2001:db8:fa::/46 ✅ Accepted Equal to maxLength, allowed
2001:db8:f3::/48 ❌ RPKI Invalid /48 is more specific than maxLength /46
2001:db8:f8::/48 ❌ RPKI Invalid Same as above

💡 Simple rule: If you will announce one /48 only as a /48, use maxLength /48. Request a longer maxLength only when you will legitimately originate more-specific sub-prefixes, and agree the change with SKNK first.

8.3 RPKI and IRR route6 Objects Are Separate Controls

  • RPKI ROA lets RPKI validators classify whether an Origin ASN and prefix length are authorized.
  • route6 objects (IRR) are routing-policy records that some networks use when building prefix filters.

An RPKI-valid ROA does not create an IRR object, and an IRR route6 object does not change RPKI authorization. Your upstream may check either control or both. SKNK manages the ROA and matching route/route6 object for its covered PA /48; AS-SET follows the actual filtering need, while IRR work for other resources follows each resource's maintainer authority.

8.4 If You Need Independent Address Resources

SKNK's standard package provides an IPv6 PA /48, so SKNK must manage its ROA. IPv6 PI is a separate independent-resource request with different eligibility, agreement, fees, and RPKI operating arrangements; it is not an upgrade that preserves the same PA addresses. If independent addressing is a requirement, assess PI with a sponsoring LIR before ordering the PA service.

9. Creating AS-SET (Optional)

An as-set object groups ASNs together. Some upstream providers and IXPs use it to generate prefix filters. Create one only when it serves your actual routing policy or an upstream requirement. The standard service does not include creating or maintaining AS-SET objects; you or your routing provider must use the applicable maintainer authorization.

  1. In the RIPE Database, select Create an Object
  2. Choose as-set as the object type
  3. Fill in:
Field Description Example
as-set AS-SET name. Must begin with AS- AS-YOURNAME
descr Short description Your Company AS-SET
members Your ASN AS215000
tech-c Technical contact role primary key AB1234-RIPE
admin-c Administrative contact role primary key AB1234-RIPE
mnt-by The maintainer authorized for this object YOURNAME-MNT only if it is authorized
  1. Click SUBMIT

10. Frequently Asked Questions

Q: I am an individual, not a company. Can I still apply?

Yes. SKNK accepts individuals, legally registered organisations, and registered sole traders through the same process: place the order and pay, have both parties sign the agreement, complete the RIPE details and review, then submit the application to RIPE NCC. An individual must provide one of the following: a valid Passport or National ID card; an organisation or registered sole trader must provide verifiable registration evidence. Every application still needs a policy-compliant network purpose and remains subject to SKNK and RIPE NCC review.

Q: The relationship between role/mntner/org in the RIPE Database is too complicated. What should I do?

Here is a simple way to think about it:

  • organisation = your identity (who owns these resources)
  • role = your contact information (who to contact when something goes wrong)
  • mntner = your key (only you can modify your own objects)

Q: I keep getting authentication errors when creating objects?

Make sure you are logged in to RIPE NCC Access. Use the dedicated link provided above for creating role + mntner -- it handles initial authentication automatically.

Q: Forgot mntner password / lost access?

Use RIPE NCC's mntner recovery tool. You will need to log in with your RIPE NCC Access account to verify your identity.

Q: Is my IPv6 prefix PA or PI?

SKNK provides an IPv6 PA (Provider Aggregatable) /48 from its LIR allocation. It can be announced when your upstream accepts it, but RIPE NCC does not guarantee global routability. It is not functionally or contractually identical to PI: the PA prefix depends on SKNK, its ROA is managed by SKNK, and service termination normally requires withdrawal and renumbering.

Q: How do I start running BGP after receiving my ASN?

You need to:

  1. Confirm that SKNK's ROA and matching route/route6 object match your Origin ASN. If your upstream requires AS-SET or other out-of-scope IRR work, arrange it with the applicable maintainer authorization.
  2. Install a BGP daemon on your VPS or server (BIRD 2 or FRRouting recommended)
  3. Contact your upstream providers for BGP session configuration parameters
  4. Configure and establish BGP peering

SKNK does not provide BGP configuration support, but plenty of tutorials are available online.

Q: Can I switch LIR?

ASN and IPv6 need to be considered separately:

  • ASN: The ASN is an independent resource assigned to your organisation. You can generally keep it when changing sponsoring LIR after signing a new agreement and completing RIPE NCC's contractual relationship change process; this is not a transfer of ownership to another organisation.
  • IPv6 PA prefix: No, it cannot be taken with you. PA prefixes are allocated from SKNK's LIR resources and belong to SKNK, not your ORG. After switching LIR, the new LIR will need to allocate a new prefix.
  • If you need a portable IPv6 prefix, assess a separate PI (Provider Independent) request before ordering. It is not an automatic conversion of the existing PA addresses.

Appendix A: PA vs PI Comparison

SKNK's standard package provides PA (Provider Aggregatable) space. PI (Provider Independent) is a separate resource request, not an upgrade of the same prefix.

PA (SKNK standard service) PI (separate request)
Prefix ownership Registered under SKNK's LIR Allocated directly to your ORG
Routing Subject to upstream acceptance and route policy Subject to upstream acceptance and route policy
Portability Does not move to another sponsor; renumbering normally required Designed as an independent end-user assignment, subject to its sponsoring agreement
RPKI management Managed by SKNK Confirm the exact CA/ROA operating model with the PI sponsoring LIR
Use case Projects that accept sponsor dependency and PA lifecycle End-user infrastructure that requires independent addressing

Verify Your Live Routing Data

After publishing a ROA or route object, verify the public result rather than relying only on the portal confirmation:

Last updated: 17 September 2026

Questions? Contact SKNK: [email protected]

Questions? Contact SKNK: [email protected]