BGP sessions default configuration
Passive sessions are configured toward neighbors.
GTSM (Generalized TTL Security Mechanism - RFC5082) is disabled on sessions toward the neighbors.
ADD-PATH capability (RFC7911) is not negotiated by default.
Route server general behaviours
Route server ASN is not prepended to the AS_PATH of routes announced to clients (RFC7947 section 2.2.2.1).
Route server does not implement path-hiding mitigation techniques (RFC7947 section 2.3.1).
Default filtering policy
NEXT_HOP attribute
The route server verifies that the NEXT_HOP attribute of routes received from a client matches the IP address of the client itself or one of the IP addresses of other clients from the same AS. This "allows an organization with multiple connections into an IXP configured with different IP addresses to direct traffic off the IXP infrastructure through any of their connections for traffic engineering or other purposes." RFC7948, section 4.8
AS_PATH attribute
Routes whose AS_PATH is longer than 32 ASNs are rejected.
The left-most ASN in the AS_PATH of any route announced to the route server must be the ASN of the announcing client.
Routes whose AS_PATH contains private or invalid ASNs are rejected.
Routes with an AS_PATH containing one or more of the following "transit-free" networks' ASNs are rejected.
List of "transit-free" networks' ASNs: 174, 209, 286, 701, 1239, 1299, 2828, 2914, 3257, 3320, 3356, 3549, 5511, 6453, 6461, 6762, 6830, 7018, 12956
IRRDBs prefix/origin ASN enforcement
Origin ASN validity is enforced. Routes whose origin ASN is not authorized by the client's AS-SET are rejected.
Announced prefixes validity is enforced. Routes whose prefix is not part of the client's AS-SET are rejected. Longer prefixes that are covered by one entry of the resulting route set are accepted.
Use RPKI ROAs to validate routes whose origin ASN is authorized by the client's AS-SET but whose prefix is not.
Use ARIN Whois DB dump to validate routes whose origin ASN is authorized by the client's AS-SET but whose prefix is not.
Database is fetched from http://irrexplorer.nlnog.net/static/dumps/arin-whois-originas.json.bz2.
Route validity state is signalled to route server clients using the following BGP communities:
Validity state Standard Extended Large Prefix is included in client's AS-SET None None 46210:11:1 Prefix is NOT included in client's AS-SET None None 46210:11:2 Origin ASN is included in client's AS-SET None None 46210:11:3 Origin ASN is NOT included in client's AS-SET None None 46210:11:4 Prefix matched by a RPKI ROA for the authorized origin ASN None None 46210:11:5 Prefix matched by an entry of the ARIN Whois DB dump None None 46210:11:6
RPKI BGP Prefix Origin Validation
RPKI BGP Prefix Origin Validation of routes received by the route server is enabled.
RPKI ROAs
RPKI ROAs are fetched from the RIPE RPKI Validator cache file at https://rpki.meerval.net/api/export.json. The following Trust Anchors are used: APNIC RPKI Root, ARIN, AfriNIC RPKI Root, LACNIC RPKI Root, RIPE NCC RPKI Root
Max-pref limit
A max-prefix limit is enforced; when it triggers, the session with the announcing client is restarted after 15 minutes.
The limit, if not provided on a client-by-client basis, is learnt from the client's PeeringDB record.
If no more specific limits exist for the client, the general limit of 1000 IPv4 routes and 500 IPv6 routes is enforced.
Min/max prefix length
-
Only prefixes whose length is in the following range are accepted by the route server:
- IPv4: 8-24
- IPv6: 12-48
Rejected prefixes
The following prefixes are unconditionally rejected:
Prefix More specific Comment 206.71.11.0/24 any more specific prefix Local network 2001:504:69::/48 any more specific prefix Local network Bogon prefixes are rejected too. Click to expand the list of these prefixes.
Prefix More specific Comment 0.0.0.0/0 only the exact prefix Default route 0.0.0.0/8 any more specific prefix IANA - Local Identification 10.0.0.0/8 any more specific prefix RFC 1918 - Private Use 127.0.0.0/8 any more specific prefix IANA - Loopback 169.254.0.0/16 any more specific prefix RFC 3927 - Link Local 172.16.0.0/12 any more specific prefix RFC 1918 - Private Use 192.0.2.0/24 any more specific prefix RFC 5737 - TEST-NET-1 192.168.0.0/16 any more specific prefix RFC 1918 - Private Use 198.18.0.0/15 any more specific prefix RFC 2544 - Network Interconnect Device Benchmark Testing 198.51.100.0/24 any more specific prefix RFC 5737 - TEST-NET-2 192.88.99.0/24 any more specific prefix RFC 3068 - 6to4 prefix 203.0.113.0/24 any more specific prefix RFC 5737 - TEST-NET-3 224.0.0.0/3 any more specific prefix RFC 5771 - Multcast (formerly Class D) 100.64.0.0/10 any more specific prefix RFC 6598 - Shared Address Space ::/0 only the exact prefix Default route ::/8 any more specific prefix loopback, unspecified, v4-mapped 64:ff9b::/96 any more specific prefix RFC 6052 - IPv4-IPv6 Translation 100::/8 any more specific prefix RFC 6666 - reserved for Discard-Only Address Block 200::/7 any more specific prefix RFC 4048 - Reserved by IETF 400::/6 any more specific prefix RFC 4291 - Reserved by IETF 800::/5 any more specific prefix RFC 4291 - Reserved by IETF 1000::/4 any more specific prefix RFC 4291 - Reserved by IETF 2001::/33 any more specific prefix RFC 4380 - Teredo prefix 2001:0:8000::/33 any more specific prefix RFC 4380 - Teredo prefix 2001:2::/48 any more specific prefix RFC 5180 - Benchmarking 2001:3::/32 any more specific prefix RFC 7450 - Automatic Multicast Tunneling 2001:10::/28 any more specific prefix RFC 4843 - Deprecated ORCHID 2001:20::/28 any more specific prefix RFC 7343 - ORCHIDv2 2001:db8::/32 any more specific prefix RFC 3849 - NON-ROUTABLE range to be used for documentation purpose 2002::/16 any more specific prefix RFC 3068 - 6to4 prefix 3ffe::/16 any more specific prefix RFC 5156 - used for the 6bone but was returned 4000::/3 any more specific prefix RFC 4291 - Reserved by IETF 5f00::/8 any more specific prefix RFC 5156 - used for the 6bone but was returned 6000::/3 any more specific prefix RFC 4291 - Reserved by IETF 8000::/3 any more specific prefix RFC 4291 - Reserved by IETF a000::/3 any more specific prefix RFC 4291 - Reserved by IETF c000::/3 any more specific prefix RFC 4291 - Reserved by IETF e000::/4 any more specific prefix RFC 4291 - Reserved by IETF f000::/5 any more specific prefix RFC 4291 - Reserved by IETF f800::/6 any more specific prefix RFC 4291 - Reserved by IETF fc00::/7 any more specific prefix RFC 4193 - Unique Local Unicast fe80::/10 any more specific prefix RFC 4291 - Link Local Unicast fec0::/10 any more specific prefix RFC 4291 - Reserved by IETF ff00::/8 any more specific prefix RFC 4291 - Multicast IPv6 prefixes are accepted only if part of the IPv6 Global Unicast space 2000::/3.
Announcement control via BGP communities
Routes tagged with the NO_EXPORT or NO_ADVERTISE communities received by the route server are propagated to other clients with those communities unaltered.
| Function | Standard | Extended | Large |
|---|---|---|---|
| Do not announce to any client | 46210:65535 | None | 46210:0:0 |
| Announce to peer, even if tagged with the previous community | 65499:peer_as | None | 46210:1:peer_as |
| Do not announce to peer | 0:peer_as | None | 46210:0:peer_as |
| Prepend the announcing ASN once to peer | 65501:peer_as | None | 46210:101:peer_as |
| Prepend the announcing ASN twice to peer | 65502:peer_as | None | 46210:102:peer_as |
| Prepend the announcing ASN thrice to peer | 65503:peer_as | None | 46210:103:peer_as |
| Prepend the announcing ASN once to any | 46210:65500 | None | 46210:2:1 |