Route Server Information
DE-CIX operates so-called route server systems (s. RFC7947 for a detailed description) to facilitate the exchange of BGP announcements between peers at DE-CIX. Each peer needs only to set up a BGP connection to the route server in order to receive the BGP announcements of all other peers having a BGP connection with the route server.
BGP Session Parameters
This section provides a brief overview of the BGP session parameters to connect to the route servers:
|RIR macro (AS-SET)|| IPv4: AS-DECIX-NYC|
|Recommended prefix limit rs1/rs2 (your side):||IPv4: 200,000|
BGP Announcement Filtering
This section describes the filtering mechanism that can be used to filter BGP announcements.
You can safely accept any BGP announcements received via the route servers as DE-CIX filters all incoming BGP announcements from all peers. The filtering mechanism is described in the Section "DE-CIX Side".
If you additionally want to filter on your side based on AS-SETs, you can do so by using one or more of the following AS-SETs registered in the RIPE database:
|RIR macro (AS-SET)||Purpose|
|AS-DECIX-NYC||AS-SETs of all DE-CIX NYC customers (IPv4)|
|AS-DECIX-NYC-V6||AS-SETs of all DE-CIX NYC customers (IPv6)|
|AS-DECIX-NYC-CONNECTED||ASNs of all DE-CIX NYC customers |
At DE-CIX, the route servers filter based on AS-path as well as IP prefixes. The BGP announcements a route server receives from a peer are checked against the AS-SET the peer provided beforehand. The AS-SET can be changed by contacting the DE-CIX customer service team.
Based on an AS-SET provided by a peer an BGP announcement is checked as follows:
- The IP prefix is checked against martians (private and reserved IP prefixes as defined by RFC 1918, RFC 5735, and RFC 6598).
- The IP prefix is checked to be registered in a RIR database by an AS as part of the recursively resolved AS-SET.
- The origin AS is checked by resolving the AS-SET provided by the peer recursively.
- The AS-path is checked against martians (private and reserved ASN numbers as defined by RFC5398, RFC6793, RFC6996, RFC7300, RFC7607).
The DE-CIX filters are updated every 4 hours. Don't forget to register your IP prefixes in the RIR database well in advance (at least 24h before announcing the first time).
Route Server Setup
The route servers at DE-CIX consists of two machines. The software utilized to provide the route server service is BIRD.
Even so that the route server system consists of two machines only one is required. However, every peer is requested to connect to both machines so that in case one machines is out of order (e.g. maintenance), the route server service can still be consumed.
If the route server system receives a BGP announcement marked as a Blackhole the NO-EXPORT community and the BLACKHOLE Community are added if these communities are not already available. This makes sure each BGP announcement marked as Blackhole can be easily filtered and does not spread widely in the Internet routing system.
Route Server Control
Please note that if the $PEERAS is a four byte AS number you have to use the BGP Extended or Large Communities.
Control of Re-distribution
You can control which BGP announcements you send to the route servers are redistributed to other peers. In fact, you can also control which peer / AS receives which BGP announcements you send to the route servers. For this, BGP Communities, BGP Extended Communities and BGP Large Communities can be used.
The following BGP Communities are supported:
|Action||BGP Standard Community (RFC 1997)||BGP Extended Community (RFC 4360)||BGP Large Community (RFC 8092)|
|Redistribute to all (default)||63034:63034||rt:63034:63034||63034:1:0|
|Do not redistribute||0:63034||rt:0:63034||63034:0:0|
|Redistribute to $PEERAS|
(in combination with 0:63034)
|Do not Redistribute to $PEERAS||0:$PEER-AS||rt:0:$PEER-AS||63034:0:PEERAS|
The route servers remove the aforementioned BGP Communities and BGP Extended Communities from a BGP announcement before re-distributing it. The well-known BGP Communities NO-EXPORT (65535:65281) and NO-ADVERTISE (65535:65282) are also honored meaning that a BGP announcement marked by one of these communities is not re-distributed to any peer. If you want the route server system to add a NO-EXPORT or NO-ADVERTISE community for a given BGP announcement before re-distributing, you have to add the community (63034:65281) or (63034:65282) respectively. This is also possible on a per-peer basis using BGP Large Communities (63034:901:$PEERAS) for selective NO-EXPORT and (63034:902:$PEERAS) for selective NO-ADVERTISE.
More than one of the aforementioned BGP Communities and BGP Extended Communities can be added to a single BGP announcement. DE-CIX recommends not to add more than 50 of these communities as it makes handling complex and error-prone. If you need to do this, please contact Customer Service (firstname.lastname@example.org). The following table lists the evaluation order of the different BGP Communities and BGP Extended Communities which helps to build complex filter rules. In case two or more BGP (extended) Communities are contradicting the community with the lowest evaluation order wins.
All BGP Communities and BGP Extended Communities that are not listed above are not touched by the route servers and transparently re-distributed. For backwards compatibility, routes with no community at all are distributed to all peers as well.
You can obtain a list of BGP announcements received from a peer by entering the peer's IP address in "neighbor info" tab of the DE-CIX looking glass.
The following section contains examples showing how the different BGP Communities and BGP Extended Communities can be used.
BGP announcements marked with the following communities are only re-distributed to AS64501 and AS64502:
BGP announcements marked with the following communities are re-distributed to all peers / ASNs except AS64501 and AS64502:
BGP announcements tagged with the following communities are only re-distributed to AS65550 (4 Byte ASN) and AS64501 (2 Byte ASN):
- (rt:63034:65550) or (ro:63034:21345)
You can use BGP communities to prepend your own ASN up to three times. This can be done to all other peers or selective to only certain peers.
BGP Standard Communities
Prepend your ASN to all peers once: 65001:0
Prepend your ASN to all peers twice: 65002:0
Prepend your ASN to all peers three times: 65003:0
Prepend your ASN to $PEERAS once: 65001:$PEERAS
Prepend your ASN to $PEERAS twice: 65002:$PEERAS
Prepend your ASN to $PEERAS three times: 65003:$PEERAS
BGP Extended Communities
Prepend your ASN to $PEERAS once: rt:65001:$PEERAS
Prepend your ASN to $PEERAS twice: rt:65002:$PEERAS
Prepend your ASN to $PEERAS three times: rt:65003:$PEERAS
BGP Large Communities
Prepend your ASN to all peers once: 63034:101:0
Prepend your ASN to all peers twice: 63034:102:0
Prepend your ASN to all peers three times: 63034:103:0
Prepend your ASN to $PEERAS once: 63034:101:$PEERAS
Prepend your ASN to $PEERAS twice: 63034:102:$PEERAS
Prepend your ASN to $PEERAS three times: 63034:103:$PEERAS
Route Server Session Types
We offer two session types:
Standard/Public Session (default)
- We re-distribute all your announcements to other peers while honoring the BGP Communities which allow you to restrict your announcements
- We advertise all announcements from other peers to you while honoring the BGP Communities which allow others peers to restrict their announcements
From an operational point of view, it is advised to set up BGP sessions to both route servers, even if you do not want to peer with (i.e. advertise prefixes to) the route servers. This helps DE-CIX staff to quickly monitor the availability of each peer.
Please note that you are required to set up BGP sessions with (but do not need to advertise prefixes to) the DE-CIX route servers to be able to claim credits for the GlobePEER service. Otherwise DE-CIX may not be able to comply with its SLA (DE-CIX GlobePEER Technical Service Description: III. IP LAYER CONFIGURATION (ISO/OSI LAYER 3) - Interface configuration).
If your decision not to establish BGP sessions with the route servers was made due to your peering policy, please contact us for establishing a monitoring only session. You do not have to advertise any prefixes and you will not receive any prefixes from us on that session.