Port & Routing Security

Port MAC Limit

We request only one (1) layer 3 MAC per port on any of our peering points. This means frames forwarded to an individual IX port shall have the same MAC address. Additional MAC(s) for maintenance/migration purposes are allowed.

To change the MAC address of your peering service, see Editing a Peering Service.

Port Rate Limits

We ingress rate limit Broadcast, Unknown Unicast and Multicast (BUM) traffic to 500 packets per second on all IX ports.

Prefix Lengths

In accordance with RFC 7454 (section 6.1.3) guidelines, and to align with the prefix lengths generally accepted by BGP providers on the internet, we impose the following limits:

IPv4 max length = /24
IPv6 max length = /48

Routing Security

We would appreciate it if you practice good network hygiene on your side, to protect both your network and the broader internet community. This includes:

Creating ROAs (Route Origin Authorisations) for your prefixes.
Using RPKI to sign your route announcements, ensuring their authenticity and preventing route hijacking.
Implementing BCP38 broadly across your network to prevent IP address spoofing.
Enabling uRPF (Unicast Reverse Path Forwarding) on your ports into the IX to prevent spoofed traffic.

In combination with the AS-Set provided for your peering service, we use RPKI Route Origin Validation (ROV) to validate your announcements: RPKI invalid prefixes are dropped, and RPKI unknown prefixes are tagged.

If you need assistance with RPKI, check out APNIC's RPKI pages or contact us.