MIX Peering LAN connection: Technical Specifications

Size: px

Start display at page:

Download "MIX Peering LAN connection: Technical Specifications"

Jasmin Gilbert
5 years ago
Views:

1 MIX Peering LAN connection: Technical Specifications Pag. 1 of 5

2 DOCUMENT CODE : MIX-202E VERSION : 2.0 DEPARTMENT : TECHNICAL COMMITTEE STATUS : DEFINITIVE DOCUMENT DATE : 22/03/2011 NUMBER OF PAGES : 7 RELEASED BY : VALERIA ROSSI LIST OF MODIFICATIONS VERSION DATE DESCRIPTION /07/06 ORIGINAL DOCUMENT /05/07 2.8: ADDED IT CAN BE MADE THROUGH PRIVATE VLAN OR PRIVATE BACK-TO-BACK CONNECTIONS [RIF. MIX-106E]; 4.7: SUBSTITUTION OF WITH /03/2011 COMPLETE REVISION Pag. 2 of 5

3 1. Purpose Base Rules Layer 2 Rules Layer 3 Rules Unwanted Traffic on MIX Peering LAN...6 Pag. 3 of 5

4 1. Purpose The present document describes the Technical Specifications which must be followed by ISP connecting to the MIX Public Peering LAN. These specifications give deeper detail on the basic rules presented in the MIX Memorandum of Understanding (Ref. MIX-101). It is worth noting that the following set of rules apply both to co-located peering routers within MIX premises and remotely connected routers, if not specified accordingly. For general discussion on the ways to connect to MIX please see MIX Base Rules 2.1. peering equipment are physically placed wihtin MIX datacenter or can be kept remote according to the type of interconnection chosen (see. MIX-302); 2.2. in case of peering equipment co-located within MIX premises the criteria introduced in the MOU and his Annex Documents apply; 2.3. in the same case, all the equipment is installed and racked by the ISP itself, and everything must executed following the best practices of installation of electronic equipment followed by MIX Technical Department. (for the list of the required materials see MIX-302); 2.4. every installed equipment is identified as property of the ISP with a clearly visible label and upon installation is registered in the Installed Equipment Register managed by MIX personnel; 2.5. the geographical link between the peering equipment and the ISP backbone can be done only crossing routers belonging to the same Autonomous System; 2.6. Internet transit is preferred to be made through private VLANs or private back-to-back connections; 2.7. interfaces belonging to the peering equipment connected to the peering LAN must be configured in full duplex mode, fixed speed at all times. Auto-sensing configurations should never be used; 2.8. to every interface connected to the Peering LAN MIX assigns a static MAC address. Upon this MAC address are build security filters for Layer 2 Traffic over the public peering LAN so once assigned no other MAC address should be used by theisp on the Peering LAN. 3. Layer 2 Rules 3.1. Only Ethernet II (802.3) or DIX Ethernet frames are allowed on the MIX peering LAN, LLC/SNAP encapsulation is not allowed 3.2. The following Ethertypes are accepted: 0x0800 IPv4 0x0806 ARP 0x086dd IPv The statically assigned MAC Address will have the following logical structure: Where: 00:17:A3:<cust_id>:<mix code> Field Description 00:17:A3 (24 bits) Cust id (16 bits) mix code (8 bit) OUI Prefix assigne to MIX by IEEE Taken from ISP AS Number Interface Id Pag. 4 of 5

5 3.4. Ethernet frames going to/from a MIX switch port share all just the MAC addresses authorize on that port Ethernet frames going to/from a MIX switch port can not address broadcast or multicast destinations but the ARP traffic. MIX will anyhow apply a broadcast traffic limitation threshold on every port Peering equipment interfaces can not be configured with Proxy Arp service enabled Peering equipment interfaces should be configured with ARP timeouts no less than two hours, four hours as the preferred value. This will reduce the amount of broadcast traffic on the MIX peering LAN, while BGP session restart mechanisms, based on TCP, will prevent these long timeouts from influencing session downtimes Link-local protocols (excluding ARP and IPv6ND) are not allowed : A incomplete list of Link local protocols explicitly forbidden follows: IRDP ICMP redirects Proprietary Protocols like: Device Discovery Protocols like CDP, EDP VLAN Management Protocols like VTP and DTP Assisted Boot or IP addressing assignment Protocols like BootP or DHCP OAM Protocols like UDLD and L2 Keepalives 4. Layer 3 Rules 4.1. Peering Interfaces must not be configured to perform IP directed broadcast on the Peering LAN 4.2. Public IP addresses over the Peering LAN are provided by MIX from his own public IP addresses space. Netmask boundaries set up by MIX must be followed without exceptions the only Layer 3 Protocol permitted over the MIX peering LAN is BGP version 4; 4.4. ISP peering equipment must not have IGP instances active on the MIX peering LAN, including OSPF IS-IS RIP EIGRP IGRP; 4.5. network announced on the MIX Peering LAN must be registered at RIPE or other Registry and belonging to the ISP himself or to his connected customers; 4.6. Network announcements must follows RIPE recommendation on CIDR aggregation in order to limit as much as possible the number of announced prefixes; 4.7. every Member must maintain a peering Session with MIX border routers, for monitoring purposes: following the MIX AS details:: AS: IPv4 addresses: e Ipv4 announced blocks: /21 IPv6 addresses: 2001:7F8:B:100:1D1:A5D1:6004:1/64 IPv6 announced blocks: 2001:1AC0::/ peering sessions with AS16004 must be considered as local peering session and MIX announcements must not be redistributed outside the Member network, unless explicitly agreed with MIX; Member peering equipment must never announce MIX peering LAN blocks to any other peer, customer or transit provider. Pag. 5 of 5

6 5. Unwanted Traffic on MIX Peering LAN All other kind of traffic which is not listed in Chapter 3 Layer 2 Rules must be considered as Illegal traffic on MIX Peering LAN. Following a list of the most common violations is available, together with an explanation of the reason why that type of traffic is forbidden. Traffic to/from multiple MAC addresses on a Member Peering port. With the exception of Pooling@MIX service, MIX applies the paradigm: one-port = one member = one active MAC address on MIX peering LAN In this way it is easier for MIX to detect and troubleshoot mis-configuration or effects coming from malfunctioning equipment, or in general any kind of traffic which is not relevant for the Exchange Point. There is absolutely no reason to inject no relevant traffic on the MIX peering LAN while there is no reason to keep the peering port as active for the Spanning Tree algorithm or other L2 topology control protocol. MIX implements port security filters on each Member port to maximise availability of the Peering LAN. Port security filters can affect the member traffic or even the port availability. In case of pool member the basic considerations above are still valid, even if the paradigm identified above is not valid anymore frm the MIX s perspective. Spanning Tree (STP) This type of traffic is unwanted for the same reasons explained in the previous point. There is no reason why the network devices directly connected to MIX should be visible as active at Layer 2 level. There is no reason to inject towards MIX a STP instance or other L2 Topology control protocols. Layer 3 Internal Routing Protocols There is no reason to have the MIX peering LAN as active for protocols like RIP, EIGRP, ISIS OSPF and such. The only routing protocol which can be used over MIX is EBGP. Auto-Discovery Protocols Protocols like CDP and EDP belong to this famil. They are used in a scenario where an auto-configuration solution is used. This scenario has nothing to do with MIX so either the unicast or the multicast traffic they generate is un wanted over MIX peering LAN. Non-unicast IPv4 Protocols Protocols like IGMP, DHCP and TFTP belong to that family. These protocols generate non unicast IP traffic which is useless on the MIX peering LAN Proxy ARP Being all traffic exchanged over MIX controller by BGP-4 there is no reason for anyone to make available proxy-arp functionalities on MIX. Unfortunately this feature is on by default on many routers: proxy-arp can have negative impacts not only for the Exchange point itself but also for the Member routing equipment. For this reason this must be switched off on all peering ports. Pag. 6 of 5 IPv6 ND-RA

7 There is no IPv6 default router on the MIX peering LAN so there is no reason to have IPv6 router advertisements on MIX as they generate a lot of unnecessary traffic. No IP traffic Any kind of traffic which is not IP can not be sent over the MIX peering LAN. Several vendors often enable ethernet ports to manage other types of non IP traffic like DEC MOP for instance: these must be disabled on MIX peering ports. Pag. 7 of 5

2. Seconded by Name: Company:

2. Seconded by Name: Company: Our Ref: / / ( DD / MM / YY ) Chairman Persatuan Pengendali Internet Malaysia (MyIX) 63000 Cyberjaya, Selangor Darul Ehsan Dear Sir Application for Membership Item 1 Name of company (and registration number)