Route server reference

BGP sessions default configuration

• Passive sessions are configured toward peers.

• GTSM (Generalized TTL Security Mechanism – RFC 5082) is disabled on sessions toward peers.

• ADD-PATH capability (RFC 7911) is not enabled.

• MD5 Authentication (RFC 2385) is configured by default. Peers will be provided a password.

• BGP Peer Security – only configured BGP peers are able to reach the route servers.

Route server general behaviors

• Route server ASN is not prepended to the AS_PATH of routes announced to peers (RFC7947 section 2.2.2.1).

• Route server does implement path-hiding mitigation techniques (Per peer tables – RFC7947 section 2.3.1).

• BGP communities are unfiltered; If a peer sets a community, it will be propogated to all peers unchanged. This excludes the 10475:* and IRR/RPKI signaling communities.

• Route Server doe not advertize routes received from an AS back to that same AS.

• With limited exceptions (noted as REJECT), route servers only apply community tags on the BGP session in from peers (ADJ-RIB-IN). Rather each peer has it's own routing table (LOC-RIB) and then filtering on export to other peers (ADJ-RIB-OUT) based on community tags.

Default filtering policy

NEXT_HOP attribute

• The route server verifies that the NEXT_HOP attribute of routes received from a peer matches the IP address of the peer itself.

AS_PATH attribute

• Routes whose AS_PATH is longer than 31 ASNs are REJECTED.

• The left-most ASN in the AS_PATH of any route announced to the route server must be the ASN of the announcing peer.

• Routes whose AS_PATH contains *private or invalid ASNs are filtered on export to other peers.

IRRDBs and RPKI prefix/origin ASN enforcement

• IRRDB origin ASN validity is enforced for routes with LOCAL-ROUTE set. Routes whose origin ASN is not authorized by the peers's AS-SET are filtered on export to other peers.

• IRRDB announced prefixes validity is enforced for routes with LOCAL-ROUTE set. Routes whose prefix is not part of the peers's AS-SET are filtered on export to other peers. Longer prefixes covered by one entry of the resulting route set are accepted.

• RPKI ROAs to validate all routes including those whose origin ASN is authorized by the peer's AS-SET but whose prefix is not.

• RPKI BGP Origin Validation of routes received by the route server is enabled.

• When an RPKI-ROA-INVALID route is received by the route server, it is filtered on export to other peers.

• RPKI ROAs are fetched by Routinator and cached locally.

• IRRDB is updated every 4 hours using bgpq4 and aggregated to the route servers.

• Route validity state is signaled to route server peers using the following BGP communities:

• The above communities are stripped upon import from a BGP peer.

Max-pref limit

• A max-prefix limit is enforced; when it triggers, the session with the announcing peer is shutdown for 60 minutes.

• If no more specific limits exist for the peer, the general limit of 25,000 IPv4 routes and 12,000 IPv6 routes is enforced.

• This is manually configured and alarmed when 80% of the limit is reached.

Mininum and maximum prefix length

• Only prefixes whose length is in the following range are accepted by the route server:

  • IPv4: 8-24

  • IPv6: 12-48

• BLACKHOLE tagged routes are accepted up to a /32 and /128.

Rejected/filtered prefixes

• The following prefixes are unconditionally REJECTED:

• Bogon prefixes are filtered on export to other peers.

• * Default Routes are permitted from TRANSIT peers by special policy.
• IPv6 prefixes are accepted only if part of the IPv6 Global Unicast space 2000::/3.

Graceful BGP session shutdown

• Routes tagged with the GRACEFUL_SHUTDOWN BGP community (65535:0) have their LOCAL_PREF attribute lowered to 0. This is propagated out to all peers.

Announcement control via BGP communities

• Routes tagged with the NO_EXPORT or NO_ADVERTISE communities received by the route server are propagated to other peers with those communities unaltered.
• Prepending communities are stackable, tagging a route 65001:0, 65002:0, 65003:0, 65004:0 will prepend a total of 10 times.
• Prepending all and -ASN is not stackable; tagging both PREPEND-ONE and PREPEND-ONE-ASN will only add one prepend to the route.
• For suppression ANNOUNCE-{ASN} beats SUPPRESS-ALL but not SUPPRESS-{ASN}. This means if SUPPRESS-{ASN} and ANNOUNCE-{ASN} the route will be suppressed to that ASN.
• Using "-29881" as ASN will apply to all routes on WOW-IX

Informational BGP Communities

These communities provide information which a peer may use in their routing policy. TBAX makes no routing decisions based on these policies, other than peers sending a full table may signal LOCAL-ROUTE to identify what routes the IX should consider local.

• TAMPA-BAY, TAMSFLDE, TAMQFLTA, WOW-IX, are filtered on ingress from all BGP peers.
• TRANSIT-PROVIDER and DEFAULT-ROUTE are filtered on ingress from all BGP peers.
• LOCAL-ROUTE is only accepted from TRANSIT-PROVIDER peers.
• A route with LOCAL-ROUTE may have TRANSIT-PROVIDER too.