Disclosure up front: I run IPYE, a company that leases IP space. It gets one short paragraph at the end; the rest is plain networking.
An Internet Exchange Point (IXP) is a shared layer 2 network where many networks connect so they can exchange traffic directly instead of through a transit provider. For a small network the attraction is shorter paths and less transit traffic; the price is operational care, because a mistake on a shared LAN affects other members. This article explains how an exchange works, the difference between bilateral peering and route servers, what PeeringDB is for, and the safety habits that make you a good neighbour. Examples use AS64496 as you, AS64497 as a peer, and 2001:db8:ffff::/64 standing in for an IXP peering LAN.
How an IXP works
Members connect a port from their router to the exchange's switching fabric and receive an address from the IXP's peering LAN, in both IPv4 and IPv6. They then run eBGP sessions with each other across the fabric. The exchange only forwards Ethernet frames; it does not route, and it does not see your BGP sessions as anything but traffic. Exchanges publish member rules, which commonly include:
- One MAC address per port, and no proxy ARP or similar tricks.
- Only IPv4, ARP, and IPv6 frames on the peering LAN, with no discovery protocols that leak onto the fabric, such as spanning tree or vendor neighbour-discovery protocols.
- Do not announce the peering LAN prefix into global BGP, and do not point a default route at another member.
The last rule matters: a default route toward a peer uses that peer's network as transit without asking. Send across an IXP only traffic for prefixes the peer announced to you.
Bilateral sessions and route servers
There are two ways to learn routes at an exchange.
| Approach | How it works | Strengths | Limits |
|---|---|---|---|
| Bilateral | You configure a separate eBGP session with each peer | Full control of policy and per-peer limits | One agreement and one session per peer |
| Route server | You peer with the IXP's route server, which redistributes members' routes | One or two sessions give many peers | You accept what members announce, filtered by the server |
A route server (RFC 7947) is a BGP speaker that passes routes between members without adding its own AS number to the AS_PATH, and without changing the next hop, so traffic still flows directly between the members. Route servers are an efficient way for a small network to reach many peers quickly. Many networks use both: route servers for the long tail and bilateral sessions with the largest partners.
Peering policies and PeeringDB
Every network chooses whom it will peer with. Policies are often summarised as open, selective, or restrictive, which are the values the PeeringDB policy field uses. Open means the network will usually agree to peer with anyone who asks. Selective means it applies conditions, such as a minimum traffic level or a presence in specific locations. Restrictive means peering only in particular circumstances.
PeeringDB is a community-maintained database where networks, exchanges, and facilities publish their details. A network record typically includes its ASN, the AS-SET used for filtering, expected prefix counts for IPv4 and IPv6, its policy, contact addresses, and the exchanges where it has ports. Use it two ways:
- As a requester: look up a prospective peer, read its policy, and send a short message to its listed peering contact with your ASN, the exchange, and the traffic you expect.
- As an operator: keep your own record accurate. Many networks build filters and maximum-prefix limits from the listed AS-SET and prefix counts, and many refuse to peer with networks that have no usable record.
Treat the data as a starting point and check it against the IRR and RPKI.
What to configure on each session
The baseline filters for any peer, whether bilateral or via a route server, follow RFC 7454:
- Prefix filters: accept only the prefixes the peer is entitled to announce, built from its AS-SET, or rely on the route server's filtering and still apply your own checks.
- No bogons: reject private, documentation, and reserved address space and ASNs.
- RPKI: reject routes that validate as invalid.
- Maximum prefixes: set a limit from the peer's expected count, with a margin, so a leak ends the session instead of filling your table.
- Next hop check: accept routes from a peer only if the next hop is that peer's address on the exchange, unless you are using a route server.
- First AS check: for a bilateral session, require the peer's own ASN to be first in the AS_PATH. Do not enable it on route server sessions, since the route server does not insert its own ASN.
- Outbound: announce only your own prefixes and your customers' prefixes, never routes learned from other peers or transit, or you turn yourself into a free transit path.
A sketch in FRR for a bilateral IPv6 peer:
router bgp 64496
neighbor 2001:db8:ffff::2 remote-as 64497
neighbor 2001:db8:ffff::2 description AS64497 at IXP
!
address-family ipv6 unicast
neighbor 2001:db8:ffff::2 activate
neighbor 2001:db8:ffff::2 maximum-prefix 100
neighbor 2001:db8:ffff::2 prefix-list PEER-AS64497-IN in
neighbor 2001:db8:ffff::2 route-map PEER-OUT out
exit-address-family
The names and the limit of 100 are placeholders. Your prefix-list and route-map must still be written, as discussed in the earlier customer filtering and communities articles.
Local preference and traffic engineering
Operators commonly give peer routes a higher local preference than transit routes, which is a policy choice, not a protocol rule. Tag routes with communities on receipt, so you can recognise their origin and avoid re-exporting them.
Is it worth it?
An exchange port has a cost, and you need a presence or a remote connection. Before joining, use flow data, as described in the NetFlow article, to estimate how much of your traffic goes to networks present there.
Summary
An IXP is a shared Ethernet fabric over which you run BGP with other members. Use route servers for breadth and bilateral sessions where you need control, keep your PeeringDB record accurate, apply the baseline filters to every session, and announce only what you are entitled to announce.
About IPYE
IPYE (https://my.ipye.com) leases IPv4, IPv6, and ASN space; a /48 IPv6 block is free for the first year. LOA, ROA, rDNS, and WHOIS are handled by IPYE. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, and Frankfurt. Questions: ipye@turnel.com.
Disclosure: I run IPYE
Top comments (0)