Port hygiene

What is allowed on the peering LAN#

The peering LAN is one shared broadcast domain. Every frame a router sends there reaches all other members. Only the ethertypes needed for IP peering are therefore allowed (AUP § 2):

Every frame must come from the registered MAC address of the port. Exactly one MAC address is allowed per port, frames from other source addresses are dropped. A router swap with a new MAC address must be reported to support@frankonix.net beforehand (AUP § 5).

What is not allowed on the peering LAN#

Prohibited under AUP § 3, among others:

• IPv6 router advertisements and router solicitations. Many platforms send RAs automatically as soon as IPv6 routing is enabled and the interface has a global address.
• Discovery protocols: CDP, LLDP, EDP, MNDP and other vendor-specific neighbour protocols.
• Spanning tree (STP, RSTP, MSTP) and other layer 2 control protocols, as well as vendor keepalives such as Ethernet loopback and MOP.
• DHCP and BOOTP, as well as IGMP and MLD queries.
• IGPs such as OSPF, IS-IS, RIP or EIGRP.
• Proxy ARP, ICMP redirects and directed broadcast.
• Multicast and broadcast other than ARP and IPv6 Neighbor Discovery.
• VLAN tags: the port is untagged, QinQ and further tags only by agreement.

Basic port settings#

• Routed interface, no switchport and no bridge member. No layer 2 network may sit behind the port through which further devices could talk to the peering LAN (AUP § 5).
• Untagged, MTU 1500, autonegotiation off (see Route servers and connection details).
• Use only the assigned IPv4 and IPv6 address, no additional addresses and no SLAAC or DHCP addresses on the interface.
• Keep the IPv6 link-local address enabled, it is needed for Neighbor Discovery.
• Do not redistribute the peering LAN into other networks, so no redistribute connected into your own BGP or IGP (AUP § 4).

Example configurations#

The examples show only the lines relevant to port hygiene. Replace interface names and the x in the addresses with your own values. Syntax and defaults differ between software releases, so check against the vendor documentation before use.

Cisco IOS and IOS-XE#

IOS sends router advertisements as soon as ipv6 unicast-routing is enabled. This is the most common mistake on the peering LAN.

interface TenGigabitEthernet0/0/0
 description frankonIX peering LAN
 ip address 193.34.203.x 255.255.255.192
 ipv6 address 2001:7f8:15b:1::x/64
 no ip redirects
 no ip proxy-arp
 no ip directed-broadcast
 no ipv6 redirects
 ipv6 nd ra suppress all
 no cdp enable
 no lldp transmit
 no lldp receive
 no mop enabled
 no mop sysid
 no keepalive

Cisco IOS-XR#

Proxy ARP, redirects and CDP are off by default. Router advertisements and LLDP (if enabled globally) must be disabled per interface.

interface TenGigE0/0/0/0
 description frankonIX peering LAN
 ipv4 address 193.34.203.x 255.255.255.192
 ipv6 address 2001:7f8:15b:1::x/64
 ipv6 nd suppress-ra
 lldp
  receive disable
  transmit disable
 !
!

Juniper Junos#

Junos only sends router advertisements on interfaces listed under protocols router-advertisement. The peering interface must not be listed there.

set interfaces xe-0/0/0 description "frankonIX peering LAN"
set interfaces xe-0/0/0 unit 0 family inet address 193.34.203.x/26
set interfaces xe-0/0/0 unit 0 family inet no-redirects
set interfaces xe-0/0/0 unit 0 family inet6 address 2001:7f8:15b:1::x/64
set system no-redirects-ipv6
set protocols lldp interface xe-0/0/0 disable
delete protocols router-advertisement interface xe-0/0/0.0

Arista EOS#

interface Ethernet1
   description frankonIX peering LAN
   no switchport
   ip address 193.34.203.x/26
   ipv6 address 2001:7f8:15b:1::x/64
   ipv6 nd ra disabled all
   no lldp transmit
   no lldp receive
!
no ip icmp redirect

MikroTik RouterOS#

Through its default entry interface=all, RouterOS sends router advertisements on all interfaces and speaks MNDP, CDP and LLDP. Disable the default entry and create RA entries only for your own customer-facing interfaces.

/interface ethernet set sfp-sfpplus1 loop-protect=off
/ip address add address=193.34.203.x/26 interface=sfp-sfpplus1
/ipv6 address add address=2001:7f8:15b:1::x/64 interface=sfp-sfpplus1 advertise=no
/ipv6 nd set [find default=yes] disabled=yes
/ip neighbor discovery-settings set discover-interface-list=none
/ip settings set send-redirects=no
/ipv6 settings set accept-router-advertisements=no

Linux (BIRD, FRR)#

No radvd, no lldpd and no DHCP client on the peering interface. arp_ignore and arp_announce stop the server from answering ARP requests on the peering LAN for addresses of other interfaces.

net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.<if>.send_redirects = 0
net.ipv4.conf.<if>.accept_redirects = 0
net.ipv4.conf.<if>.proxy_arp = 0
net.ipv4.conf.<if>.arp_ignore = 1
net.ipv4.conf.<if>.arp_announce = 2
net.ipv6.conf.<if>.accept_ra = 0
net.ipv6.conf.<if>.autoconf = 0
net.ipv6.conf.<if>.accept_redirects = 0

With systemd-networkd, also add this to the interface's .network file:

[Network]
DHCP=no
IPv6AcceptRA=no
IPv6SendRA=no
LLDP=no
EmitLLDP=no

Check it yourself#

On a Linux router, tcpdump shows what your device actually sends. If both commands print nothing, the port is clean.

tcpdump -eni <if> -Q out 'not (ether proto 0x0800 or ether proto 0x0806 or ether proto 0x86dd)'

tcpdump -eni <if> -Q out 'icmp6 and ip6[40] == 134'

On hardware routers, the interface protocol counters help, for example:

show ipv6 interface
show lldp interface

Questions about the configuration to support@frankonix.net.

What happens in case of violations#

The port automatically drops frames from unregistered MAC addresses. In case of an acute threat to the peering LAN, frankonIX may filter traffic or temporarily shut down ports and sessions (AUP § 6). Keep your NOC contact in PeeringDB up to date for that reason (AUP § 7).