Route servers

Two servers, eight checks, nothing hand-edited.

Both servers run in transparent mode under AS202192 (RFC 7947): they do not appear in AS_PATH and do not touch next-hop. Their configuration is generated from the member database and validated before every reload, so a configuration that fails validation never reaches a server.

Endpoints

Peer with both

ServerSiteAddressASN
RS1FSN2a0b:4e07:42::1202192
RS2HEL2a0b:4e07:42::2202192

Sessions are passive on our side, so your router initiates. Both servers see the same members: a route learned at one site is reachable through either server.

Inbound policy

In this order

  1. 01
    Next-hop must be your own LAN address. Anything else is rejected.
  2. 02
    First ASN in AS_PATH must be your ASN.
  3. 03
    AS_PATH no private or reserved ASNs, no more than 32 hops, no default route.
  4. 04
    Bogons our own block and every known IXP peering LAN rejected.
  5. 05
    Prefix length /16 to /48 accepted. Anything longer is dropped, except a blackhole /128.
  6. 06
    RPKI invalid is rejected, valid is accepted, not-found goes to the next check. Two independent validators, one per site, and each server talks to both.
  7. 07
    IRR prefix and origin must appear in the AS-SET published in your PeeringDB record. A route covered by a valid ROA is accepted even when the IRR data lags behind.
  8. 08
    max-prefix taken from your PeeringDB IPv6 prefix count plus 20 %, never below 20, and 20 000 for a network with no PeeringDB data. Rejected routes count towards it. A session that exceeds it is stopped and we get in touch, rather than flapping.

A rejected route is kept in the servers' table and tagged with the check that dropped it, so the looking glass can tell you why a prefix is missing instead of leaving you to guess. Steering is done with large communities.

Acceptance

How we know it holds

Every policy change is applied to a laboratory copy of the exchange first and has to pass the same three assertions before it ships: an RPKI-invalid prefix announced by member A never appears in member B's table; a prefix outside A's AS-SET is rejected with cause 12; a route that A marks do-not-announce-to-B reaches C and not B. How this policy lines up with the MANRS actions for exchanges is tracked separately, row by row.