Routing security

NIX runs its route servers to keep the exchange clean: we filter what members announce so a mistake in one network does not propagate to the others. Filtering only works, though, if members publish the data it relies on. This page explains what NIX does and what we ask you to do. It follows the MANRS framework (Mutually Agreed Norms for Routing Security).

What NIX does

The NIX route servers filter every route they accept:

• Bogon and martian prefixes, RFC 1918 space, and prefixes that are too short or too long are dropped.
• IRR filtering is mandatory. We build a prefix list for each member from their IRR data and accept only prefixes that appear in it.
• RPKI Route Origin Validation is applied. Routes whose origin is RPKI-invalid are rejected before they reach any peer. Routes with no ROA (not-found) are still accepted, so the policy is drop-invalid only.

What we ask you to do

Three things, in order of impact. The first is the one most networks are still missing.

1. Publish RPKI ROAs for your prefixes.
   Create a Route Origin Authorisation in your RIR's portal (RIPE NCC for most NIX members) stating which AS is allowed to originate each prefix, and set the max length correctly. Because our route servers drop RPKI-invalid routes, a wrong or missing-but-covered ROA can cause your own routes to be dropped, so get this right and keep it current when you change announcements. Only you can create your ROA; NIX cannot do it for you.
2. Register your routes and AS-set in an IRR.
   Create route and route6 objects for every prefix you announce, and an as-set listing your own ASN and any downstreams. This is required for your routes to be accepted by our route servers.
3. Keep your PeeringDB record accurate.
   Point the "IRR as-set" field at the as-set above, keep the IPv4 and IPv6 prefix counts current so max-prefix limits do not cut you off, and keep your NOC and peering contacts reachable. We build route-server filters from this.

Going further

Consider joining MANRS as a network operator. It commits you to the same practices across all your interconnections, not just at NIX, and the signup and guides are on the MANRS site.

Links

• MANRS, network operator programme: https://manrs.org/netops/
• RPKI at RIPE NCC: https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/
• PeeringDB: https://www.peeringdb.com/
• Generating IRR prefix lists (bgpq4): https://github.com/bgp/bgpq4
• NIX route server details: https://www.nix.no/technical-information/route-server/