News

Indy Configuration of route server 206.53.139.2 at AS13681

By FD-IX Team
9 min read
Share:

Configuration of route server 206.53.139.2 at AS13681

BGP sessions default configuration

  • Passive sessions are configured toward neighbors.
  • GTSM (Generalized TTL Security Mechanism - RFC5082) is disabled on sessions toward the neighbors.
  • ADD-PATH capability (RFC7911) is not negotiated by default.

Route server general behaviours

Default filtering policy

NEXT_HOP attribute

  • The route server verifies that the NEXT_HOP attribute of routes received from a client matches the IP address of the client itself or one of the IP addresses of other clients from the same AS. This “allows an organization with multiple connections into an IXP configured with different IP addresses to direct traffic off the IXP infrastructure through any of their connections for traffic engineering or other purposes.” RFC7948, section 4.8

AS_PATH attribute

  • Routes whose AS_PATH is longer than 24 ASNs are rejected.
  • The left-most ASN in the AS_PATH of any route announced to the route server must be the ASN of the announcing client.
  • Routes whose AS_PATH contains private or invalid ASNs are rejected.
  • Routes with an AS_PATH containing one or more “never via route-servers” networks’ ASNs are rejected.

List of “never via route-servers” networks’ ASNs is generated from PeeringDB.

IRRDBs prefix/origin ASN enforcement

  • Origin ASN validity is enforced. Routes whose origin ASN is not authorized by the client’s AS-SET are rejected.
  • Announced prefixes validity is enforced. Routes whose prefix is not part of the client’s AS-SET are rejected. Longer prefixes that are covered by one entry of the resulting route set are accepted.

RPKI BGP Prefix Origin Validation

  • RPKI BGP Origin Validation of routes received by the route server is enabled.
  • When an INVALID route is received by the route server, it is rejected.

RPKI ROAs

Max-pref limit

  • A max-prefix limit is enforced; when it triggers, the session with the announcing client is restarted after 15 minutes.
  • The limit, if not provided on a client-by-client basis, is learnt from the client’s PeeringDB record.
  • If no more specific limits exist for the client, the general limit of 170000 IPv4 routes and 12000 IPv6 routes is enforced.

Min/max prefix length

  • Only prefixes whose length is in the following range are accepted by the route server:
    • IPv4: 8-24
    • IPv6: 12-48

Rejected prefixes

  • The following prefixes are unconditionally rejected:
PrefixMore specificComment
206.53.139.0/24any more specific prefixIXP peering network
2001:504:45:f3e8::/64any more specific prefixIXP peering network
  • Bogon prefixes are rejected too.
PrefixMore specificComment
0.0.0.0/0only the exact prefixDefault route
0.0.0.0/8any more specific prefixIANA - Local Identification
10.0.0.0/8any more specific prefixRFC 1918 - Private Use
127.0.0.0/8any more specific prefixIANA - Loopback
169.254.0.0/16any more specific prefixRFC 3927 - Link Local
172.16.0.0/12any more specific prefixRFC 1918 - Private Use
192.0.2.0/24any more specific prefixRFC 5737 - TEST-NET-1
192.88.99.0/24any more specific prefixRFC 3068 - 6to4 prefix
192.168.0.0/16any more specific prefixRFC 1918 - Private Use
198.18.0.0/15any more specific prefixRFC 2544 - Network Interconnect Device Benchmark Testing
198.51.100.0/24any more specific prefixRFC 5737 - TEST-NET-2
203.0.113.0/24any more specific prefixRFC 5737 - TEST-NET-3
224.0.0.0/3any more specific prefixRFC 5771 - Multcast (formerly Class D)
100.64.0.0/10any more specific prefixRFC 6598 - Shared Address Space
::/0only the exact prefixDefault route
::/8any more specific prefixloopback, unspecified, v4-mapped
64:ff9b::/96any more specific prefixRFC 6052 - IPv4-IPv6 Translation
100::/8any more specific prefixRFC 6666 - reserved for Discard-Only Address Block
200::/7any more specific prefixRFC 4048 - Reserved by IETF
400::/6any more specific prefixRFC 4291 - Reserved by IETF
800::/5any more specific prefixRFC 4291 - Reserved by IETF
1000::/4any more specific prefixRFC 4291 - Reserved by IETF
2001::/33any more specific prefixRFC 4380 - Teredo prefix
2001:0:8000::/33any more specific prefixRFC 4380 - Teredo prefix
2001:2::/48any more specific prefixRFC 5180 - Benchmarking
2001:3::/32any more specific prefixRFC 7450 - Automatic Multicast Tunneling
2001:10::/28any more specific prefixRFC 4843 - Deprecated ORCHID
2001:20::/28any more specific prefixRFC 7343 - ORCHIDv2
2001:db8::/32any more specific prefixRFC 3849 - NON-ROUTABLE range to be used for documentation purpose
2002::/16any more specific prefixRFC 3068 - 6to4 prefix
3ffe::/16any more specific prefixRFC 5156 - used for the 6bone but was returned
4000::/3any more specific prefixRFC 4291 - Reserved by IETF
5f00::/8any more specific prefixRFC 5156 - used for the 6bone but was returned
6000::/3any more specific prefixRFC 4291 - Reserved by IETF
8000::/3any more specific prefixRFC 4291 - Reserved by IETF
a000::/3any more specific prefixRFC 4291 - Reserved by IETF
c000::/3any more specific prefixRFC 4291 - Reserved by IETF
e000::/4any more specific prefixRFC 4291 - Reserved by IETF
f000::/5any more specific prefixRFC 4291 - Reserved by IETF
f800::/6any more specific prefixRFC 4291 - Reserved by IETF
fc00::/7any more specific prefixRFC 4193 - Unique Local Unicast
fe80::/10any more specific prefixRFC 4291 - Link Local Unicast
fec0::/10any more specific prefixRFC 4291 - Reserved by IETF
ff00::/8any more specific prefixRFC 4291 - Multicast
  • IPv6 prefixes are accepted only if part of the IPv6 Global Unicast space 2000::/3.

Blackhole filtering

  • Blackhole filtering of more specific IP prefixes can be requested by tagging them with the following BGP communities: 65535:666 (BLACKHOLE well-known community)
  • By default, routes are propagated to all the clients unless they have been explicitly configured to not receive them.
  • IPv4 routes are propagated unchanged to clients.
  • IPv6 routes are propagated unchanged to clients.
  • Before being announced to clients, all the routes are tagged with the BLACKHOLE well-known community. The NO_EXPORT well-known community is also added.
  • Blackhole filtering requests bypass any RPKI validation check and min/max length check.

Graceful BGP session shutdown

  • Routes tagged with the GRACEFUL_SHUTDOWN BGP community (65535:0) have their LOCAL_PREF attribute lowered to 0.

Announcement control via BGP communities

  • Routes tagged with the NO_EXPORT or NO_ADVERTISE communities received by the route server are propagated to other clients with those communities unaltered.
FunctionStandardExtendedLarge
Do not announce to any client0:13681rt:0:1368113681:0:13681
Announce to peer, even if tagged with the previous community13681:peer_asrt:13681:peer_as13681:13681:peer_as
Do not announce to peer0:peer_asrt:0:peer_as13681:0:peer_as
Prepend the announcing ASN once to peer65504:peer_asrt:65504:peer_as13681:65504:peer_as
Prepend the announcing ASN twice to peer65505:peer_asrt:65505:peer_as13681:65505:peer_as
Prepend the announcing ASN thrice to peer65506:peer_asrt:65506:peer_as13681:65506:peer_as
Prepend the announcing ASN once to any65501:13681rt:65501:1368113681:65501:13681
Prepend the announcing ASN twice to any65502:13681rt:65502:1368113681:65502:13681
Prepend the announcing ASN thrice to any65503:13681rt:65503:1368113681:65503:13681
Add NO_EXPORT to any65507:13681rt:65507:1368113681:65507:13681
Add NO_ADVERTISE to any65508:13681rt:65508:1368113681:65508:13681
Add NO_EXPORT to peer65509:peer_asrt:65509:peer_as13681:65509:peer_as
Add NO_ADVERTISE to peer65510:peer_asrt:65510:peer_as13681:65510:peer_as

Reject reasons

  • The following values are used to identify the reason for which routes are rejected. This is mostly used for troubleshooting, internal reporting purposes, looking glasses or in the route server log files.
IDReason
0Generic code: the route must be treated as rejected
1Invalid AS_PATH length
2Prefix is bogon
3Prefix is in global blacklist
4Invalid AFI
5Invalid NEXT_HOP
6Invalid left-most ASN
7Invalid ASN in AS_PATH
8Transit-free ASN in AS_PATH
9Origin ASN not in IRRDB AS-SETs
10IPv6 prefix not in global unicast space
11Prefix is in client blacklist
12Prefix not in IRRDB AS-SETs
13Invalid prefix length
14RPKI INVALID route
15Never via route-servers ASN in AS_PATH
65535Unknown

Related Posts

Ready to exchange traffic?

Join dozens of networks and reduce your transit costs today.

Start Peering Today Schedule a Consultation
No Setup Fees
24/7 Support
99.99% Uptime SLA