Security and Restrictions

Basic Protection For the IX and You

The safest way to connect to an IX is with a router, and we prefer you connect to us with a router. However we do recognize many switches can perform most all of the routing functions that most enterprises need from a router these days.  We just ask if you are connecting with a switch that you make your switch’s port facing IX-Denver as router like as possible; for example 1 MAC address, L3 terminated p2p connection, no loops, no spanning-tree, no discovery protocols, but mostly a p2p broadcast domain between the IX fabric and your port. If you implement these basic best practices then our other basic protections listed below will likely be invisible to you and your network.

Current Implemented IX-Denver Fabric Protections:

  • BUM (Broadcast, Multicast, Unknown Unicast) traffic is rate limited to 5% of interface bandwidth.
  • 1 MAC address is permitted on a port configured as an access port and this MAC can be dynamically learned by IX-Denver’s switch(s).
  • 1 MAC address is permitted on a port configured as a trunk port but the MAC address of your router must be configured statically by IX-Denver.
  • Access ports on VLAN 100 will receive a link down for 3 minutes if more than 1 MAC address is received.
  • No BPDUs are accepted on any port – If IX-Denver receives a BPDU from your router this will result in a link-down for 5 minutes.
  • IX-Denver runs VSTP (RSTP) on all VLANs with the intent that the port will never receive a STP negotiation in response, this is a strategy in conjunction with our bpdu-block. If we receive a response to the bpdus or if we see our own bpdus come back to us the port will never leave a blocked state, this should prevent any hard loops or other accidents in most circumstances.
  • ICMP echos directed at switch IPs are rate-limited for both IPv4 and IPv6, testing to the switch with ICMP is accepted for brief periods if needed.
  • A small dedicated queue is available for network control traffic, this traffic must be sourced from your IX /24 or /64 IP and it must have dscp markings of cs6 or cs7 to be eligible to be forwarded in this queue.
  • The route server(s) accept ICMP, ICMP6 and TCP/179 traffic only.
  • We implement IETF BCP 214 “BGP Session Culling” during all maintenance activity.