How to get an ASN and start BGP peering
To peer at an internet exchange you need three things: an autonomous system number (ASN), address space of your own to announce, and a router that speaks BGP. This guide walks through each step in order, from the first registration to your first live session on an IXP VPS. It is written for engineers who have not done this before, so every step says what to do, why it matters and what breaks without it.
The short version
- Get a public ASN through a sponsoring LIR (or become a LIR yourself).
- Get address space: an IPv6 /48 is easy, an IPv4 /24 has to be leased or transferred.
- Register your routing data: IRR route objects, an AS-SET, RPKI ROAs and a PeeringDB record.
- Get somewhere to run BGP with a connection to an exchange.
- Configure BGP with strict filters, then bring up the route server sessions.
- Add bilateral sessions with the networks that matter most to you.
Want the background first? Read what an IXP VPS is.
1. Get an ASN
An ASN identifies your network on the internet. In Europe, ASNs are assigned by the RIPE NCC through a local internet registry (LIR). Exchanges only accept members with a public ASN. A private ASN (64512 to 65534 and 4200000000 to 4294967294) cannot be used on an exchange.
Two ways to get one
| Sponsoring LIR | Your own LIR | |
|---|---|---|
| Who holds the contract with the RIPE NCC | The sponsor | You |
| What you pay | A yearly fee to the sponsor, set by the sponsor | A RIPE NCC membership fee, plus your own administration |
| Effort | Low. The sponsor requests the resources for you | Higher. You handle the membership and the paperwork yourself |
| Suits | Small networks, labs, individuals, a first ASN | Networks that need many resources or want full control |
Fees and processing times differ per sponsor, so compare a few before you choose. If you need a sponsor, we can refer you to a partner that provides sponsored ASN and LIR services.
What to ask a sponsor
- Is the ASN and the address space registered in your name, so the resources are yours to keep?
- What happens to the resources if you stop paying or want to move to another sponsor?
- Can you manage your own IRR objects and RPKI ROAs, or does the sponsor do it for you?
2. Get address space
You need a prefix that is yours to announce. Across the internet, networks generally accept IPv4 prefixes down to a /24 and IPv6 prefixes down to a /48. Anything smaller is usually filtered, so it never becomes reachable.
| Protocol | Smallest prefix that is widely accepted | How to get it |
|---|---|---|
| IPv6 | /48 | A sponsoring LIR can assign you a /48 provider-independent block, often together with the ASN. |
| IPv4 | /24 | IPv4 is scarce. A /24 is leased from a LIR or broker, or bought on the transfer market. |
For IPv4, make sure the holder can prove the right to use the prefix, and that they create the correct route object and ROA for your ASN. Without that, other networks will drop your announcement. If you start with IPv6 only, you can still peer, and add IPv4 later.
3. Register your routing information
Networks and exchanges decide which routes to accept by checking public registrations. Set these up before you try to peer, because most of the problems new networks run into come from missing or incomplete records.
| Record | What it does | What breaks without it |
|---|---|---|
IRR route and route6 objects | States that your ASN originates this prefix. Peers build prefix filters from it. | Your prefixes are filtered out by networks that filter on IRR data. |
| AS-SET | A named list of the ASNs you announce, usually only your own, for example AS-EXAMPLE. | Peers cannot expand your filter, and some exchanges will not set you up. |
| RPKI ROA | A signed statement that your ASN may originate your prefix, with a maximum length. | Networks that validate origins treat your route as unknown or reject it. |
| PeeringDB record | Your public profile: ASN, AS-SET, contacts, policy. | Exchanges and potential peers cannot find or verify you. |
Create the route objects in the RIPE database, directly or through your sponsoring LIR. ROAs are created in the LIR portal of the RIPE NCC. Ask your sponsor if it does that for you. Keep the maximum length of a ROA equal to the prefix length you really announce, so a hijacker cannot use a more specific prefix.
4. Get a place to run BGP
You need a router that can reach an exchange. Running your own hardware at an exchange takes rack space, a cross-connect and a port, which is a lot of cost and effort for a small network. Many networks start on a virtual server instead.
An IXP VPS has a Layer 2 connection to an exchange at Nikhef, with one exchange included. The exchange shows up as its own network interface on the VPS, and you get full root access to run your own BGP daemon. If you also want a full-table upstream, add an IP transit BGP session. For the details, see what an IXP VPS is.
5. Configure BGP
Choose your router software
You run the router yourself, so the software is your choice. These three are common on a VPS:
| Software | What it is | Good to know |
|---|---|---|
| BIRD | A BGP daemon for Linux, configured with a text file. | Small and popular at exchanges. The example below uses BIRD 2. |
| FRRouting (FRR) | A routing suite for Linux with a Cisco-style command line. | Supports BGP and many other protocols in one package. |
| MikroTik RouterOS (CHR) | The Cloud Hosted Router: RouterOS as a virtual machine image. | Familiar if you already use MikroTik. The licence level sets the maximum throughput, so check it against the speed you need. |
Linux with BIRD or FRR is the easiest to start with. CHR is not in our standard images, but you can install it yourself from the console of a running Linux VPS, without a custom ISO. We support this method: Install MikroTik CHR on a VPS. It replaces the whole disk, so only use it on a VPS that holds nothing you want to keep. Whichever you pick, these rules apply to every setup.
Announce only what is yours
Filter on export so only your own prefixes leave your network. A missing export filter makes you a transit path by accident and is the most common cause of route leaks.
Filter what you receive
- Reject the default route and bogon prefixes.
- Reject your own prefixes when they come back to you.
- Reject prefixes more specific than a /24 (IPv4) or /48 (IPv6).
- Reject routes that are RPKI invalid.
Protect yourself
- Set a maximum-prefix limit on every session.
- Use the neighbor and peering addresses you were given. Do not guess them.
- Do not send traffic with a source address that is not yours. Source address filtering is applied on our network.
Example: a route server session in BIRD 2
This sketch uses documentation values (ASN 64496, prefix 2001:db8:1234::/48). Replace them with your own details and the route server addresses and ASN from your exchange, and check the syntax against the BIRD documentation for your version.
define MY_ASN = 64496;
define MY_PREFIXES = [ 2001:db8:1234::/48 ];
router id 192.0.2.1;
protocol device { }
protocol static my_v6 {
ipv6;
route 2001:db8:1234::/48 reject;
}
roa6 table rpki_v6;
protocol rpki validator {
roa6 { table rpki_v6; };
remote 127.0.0.1 port 3323; # your RPKI validator
retry keep 90;
refresh keep 900;
expire keep 172800;
}
filter rs_in_v6 {
if net = ::/0 then reject;
if net.len > 48 then reject;
if net ~ MY_PREFIXES then reject;
if roa_check(rpki_v6, net, bgp_path.last) = ROA_INVALID then reject;
accept;
}
filter rs_out_v6 {
if net ~ MY_PREFIXES then accept;
reject;
}
protocol bgp rs1_v6 {
local as MY_ASN;
neighbor 2001:db8:ffff::1 as 64511; # route server, from your exchange details
ipv6 {
import filter rs_in_v6;
export filter rs_out_v6;
import limit 100000 action block;
};
}This needs an RPKI validator running next to BIRD, for example Routinator. Start with one session to confirm that routes come in and your prefix goes out, then copy the block for the second route server and for IPv4.
6. Bring up sessions and start peering
- Order an IXP VPS and give us your ASN and AS-SET.
- Complete any registration the exchange asks for. Some exchanges have their own portal or form.
- We deliver the exchange interface and send you the MAC address, your addresses on the peering LAN and the route server addresses.
- Configure the interface and start with the route servers. A few sessions give you reachability to many members.
- Add bilateral sessions with the networks that carry most of your traffic. Check their peering policy in PeeringDB first.
Exchange connections are delivered by hand and depend on the exchange, so they take longer than the automatic deployment of the VPS itself. Prefix filters on our side are rebuilt every night from your IRR data and AS-SET, so a new prefix is usually picked up within about 24 hours.
Common problems
| Symptom | Likely cause | What to check |
|---|---|---|
| Session is up, but no routes are accepted | Missing route object, or an AS-SET that does not include your ASN | Your IRR objects and the AS-SET in PeeringDB |
| Routes are rejected as RPKI invalid | The ROA has the wrong origin ASN or a maximum length that is too short | The ROA for each prefix |
| Session does not come up | Wrong neighbor address, ASN or interface | The addresses and MAC address we sent you |
| Traffic from your own prefix is dropped | Source address filtering on your interface | Ask us to disable it for the prefixes you announce |
| A prefix you just registered is not accepted | Filters are refreshed once a night | Wait about 24 hours, then check the IRR data |
You can test the path to a destination from our network yourself with the looking glass.
Frequently asked questions
Do I need my own address space to peer?
Yes. Peering means announcing prefixes that belong to you. Without a prefix you have nothing to announce, and an IXP VPS will not change your routing. If you only need a well-connected server, a regular Amsterdam VPS is the better choice.
Can I use a private ASN?
No. Exchanges require a public ASN and your own address space. A private ASN is only meant for use inside your own network or behind an upstream.
Do I need IPv4, or is IPv6 enough to start?
You can start with IPv6 only. A /48 is easy to get, and most exchange members run IPv6 sessions. Add IPv4 when you have a /24 you can use.
What is an AS-SET and do I need one?
An AS-SET is a named list of the ASNs you announce. Peers and exchanges use it to build your prefix filter, and PeeringDB has a field for it. If you only announce your own ASN, the AS-SET can contain just that.
Can I use MikroTik CHR instead of BIRD or FRR?
Yes, any router software that speaks BGP will do. CHR runs RouterOS as a virtual machine. The same registrations and filter rules apply. We support installing it with the install script from the console of a fresh Linux VPS. No custom ISO is needed.
Do I need a full routing table?
No. Peering at an exchange gives you the routes of the networks you peer with, not the whole internet. If you also want to reach everything else, add an IP transit session as a second path.
How long does it take?
That depends mostly on your sponsoring LIR and the registrations, so start there. The VPS deploys within minutes. The exchange connection is delivered by hand and takes longer.
Need help?
Open a ticket in the client area or email [email protected]. We can run a traceroute or MTR from our network to a destination you care about before you order.