IXP Policy

Section 1. Technical Hygiene and Fabric Integrity

1.1 Interface and Layer 2 Configuration Constraints

1.1.1 Single MAC Address Enforcement: The Member shall present exactly one (1) source MAC address per allocated physical or virtual port interface connected to the IXP switching fabric. The IXP will implement port security configurations to automatically disable any interface violating this limit.

1.1.2 Prohibited Traffic Types: The Member shall strictly filter its interface to prevent the transmission of non-IP traffic into the IXP fabric. Prohibited traffic types include, but are not limited to:

  1. Link Layer Discovery Protocol (LLDP) and Cisco Discovery Protocol (CDP)
  2. Spanning Tree Protocol (STP) Bridge Protocol Data Units (BPDUs)
  3. Interior Gateway Routing Protocols (e.g., OSPF, IS-IS)
  4. Any unapproved Multicast, Broadcast, or Unknown Unicast traffic, with the explicit exception of Address Resolution Protocol (ARP) and IPv6 Neighbor Discovery (ND) packets.

1.2 Routing Security and BGP Compliance

1.2.1 MANRS Alignment: The Member agrees to maintain operational compliance with the Mutually Agreed Norms for Routing Security (MANRS) ISP and IXP member modules.

1.2.2 RPKI and Route Filtering: The Member shall explicitly validate all advertised prefixes using Resource Public Key Infrastructure (RPKI) Route Origin Authorizations (ROAs). The IXP Route Servers will systematically drop prefixes evaluated as "RPKI Invalid."

1.2.3 Prefix Limits: The Member shall maintain an accurate maximum prefix limit on its BGP sessions and register its expected maximum prefix count in its member profile. The IXP reserves the right to terminate BGP sessions that exceed the stated prefix threshold by more than 10% without prior notice to protect fabric stability.

Section 2. Emergency Disconnection Rights

2.1 Right of Immediate Mitigation

The IXP Operations Team reserves the right to immediately and without prior notice suspend, disable, or rate-limit any Member port, BGP session, or cross-connect if the Member's connection causes an active threat to the stability, performance, or security of the shared switching fabric.

2.2 Triggering Events for Emergency Disconnection

Immediate disconnection protocols will be initiated upon detection of any of the following events:

  1. Layer 2 Loops: Broadcast storms or rapid MAC address learning transitions indicating a loop on the Member side.
  2. Malicious Network Traffic: Evidence of Distributed Denial of Service (DDoS) amplification vectors originating from the Member port, or traffic matching known malicious patterns targeting the IXP management infrastructure.
  3. Severe BGP Flapping or Route Leaks: Advertising unauthorized or leaked routing tables that degrade the processing capacity of the IXP core Route Servers.
  4. Physical Interface Errors: Faulty transceivers or flapping physical links causing high error rates or destabilizing the core switch fabric.