Deutsch English

Configuration Examples

Ready-to-use building blocks for connecting to the frankonIX route servers, including RPKI validation. Everything you need to fill in yourself is marked as <PLACEHOLDER>.

These examples are deliberately minimal: three route servers, both address families, RPKI, a prefix limit and an outbound filter on your own prefixes. They do not replace checking against your own software version – RPKI and enforce-first-as in particular differ between releases of the same platform. Where we know about it, there is a note.

All addresses, filtering rules and communities are listed on the Route Servers page.

What you need to fill in
PlaceholderMeaning
<IHRE-ASN>Your AS number
<IHRE-IPV4>Your address from 193.34.203.192/26
<IHRE-IPV6>Your address from 2001:7f8:15b:1::/64
<IHRE-ROUTER-ID>Your BGP router ID
<MAXPFX-V4> / <MAXPFX-V6>Your prefix limit per address family
<IHR-PREFIX-V4> / <IHR-PREFIX-V6>The prefixes you announce

The placeholder names are kept identical in both language versions so the snippets stay interchangeable. If you announce more than one prefix, extend the relevant prefix list accordingly – the examples deliberately contain a single entry. On prefix limits: the route servers apply their own limit to what they accept from you, derived from your PeeringDB record. Without an entry the defaults are 250 (IPv4) and 50 (IPv6). The values in your own configuration are independent of that – they protect your router, not ours.

Choose your platform

Juniper Junos Arista EOS Cisco IOS-XR Cisco IOS / IOS-XE BIRD 2 FRRouting VyOS OpenBGPD

Juniper Junos

Junos does not enforce enforce-first-as by default – nothing to disable here. Just make sure you have not enabled it elsewhere.

routing-options {
    autonomous-system <IHRE-ASN>;
    validation {
        group frankonIX-rpki {
            session 193.34.203.196 {
                port 3323;
                local-address <IHRE-IPV4>;
            }
            session 193.34.203.197 {
                port 3323;
                local-address <IHRE-IPV4>;
            }
        }
    }
}

policy-options {
    prefix-list meine-prefixe-v4 {
        <IHR-PREFIX-V4>;
    }
    prefix-list meine-prefixe-v6 {
        <IHR-PREFIX-V6>;
    }

    policy-statement frankonIX-import {
        term rpki-invalid {
            from validation-database invalid;
            then reject;
        }
        term rest {
            then accept;
        }
    }

    policy-statement frankonIX-export-v4 {
        term meine {
            from {
                prefix-list meine-prefixe-v4;
            }
            then accept;
        }
        then reject;
    }

    policy-statement frankonIX-export-v6 {
        term meine {
            from {
                prefix-list meine-prefixe-v6;
            }
            then accept;
        }
        then reject;
    }
}

protocols {
    bgp {
        group frankonIX-rs-v4 {
            type external;
            peer-as 214591;
            local-address <IHRE-IPV4>;
            family inet {
                unicast {
                    prefix-limit {
                        maximum <MAXPFX-V4>;
                        teardown 90 idle-timeout 30;
                    }
                }
            }
            import frankonIX-import;
            export frankonIX-export-v4;
            neighbor 193.34.203.193;
            neighbor 193.34.203.194;
            neighbor 193.34.203.195;
        }

        group frankonIX-rs-v6 {
            type external;
            peer-as 214591;
            local-address <IHRE-IPV6>;
            family inet6 {
                unicast {
                    prefix-limit {
                        maximum <MAXPFX-V6>;
                        teardown 90 idle-timeout 30;
                    }
                }
            }
            import frankonIX-import;
            export frankonIX-export-v6;
            neighbor 2001:7f8:15b:1::c122:cbc1;
            neighbor 2001:7f8:15b:1::c122:cbc2;
            neighbor 2001:7f8:15b:1::c122:cbc3;
        }
    }
}

Arista EOS

EOS enforces enforce-first-as by default – it must be disabled. Note that the RPKI syntax changed several times across EOS releases; rpki cache only exists from 4.24 onwards.

router bgp <IHRE-ASN>
   router-id <IHRE-ROUTER-ID>
   no bgp default ipv4-unicast

   rpki cache rpki01
      host 193.34.203.196 port 3323
      preference 1
   !
   rpki cache rpki02
      host 193.34.203.197 port 3323
      preference 2
   !
   rpki origin-validation
      ebgp local
   !

   neighbor frankonIX-v4 peer group
   neighbor frankonIX-v4 remote-as 214591
   no neighbor frankonIX-v4 enforce-first-as
   neighbor frankonIX-v4 maximum-routes <MAXPFX-V4>
   neighbor frankonIX-v4 route-map frankonIX-in in
   neighbor frankonIX-v4 route-map frankonIX-out-v4 out

   neighbor frankonIX-v6 peer group
   neighbor frankonIX-v6 remote-as 214591
   no neighbor frankonIX-v6 enforce-first-as
   neighbor frankonIX-v6 maximum-routes <MAXPFX-V6>
   neighbor frankonIX-v6 route-map frankonIX-in in
   neighbor frankonIX-v6 route-map frankonIX-out-v6 out

   neighbor 193.34.203.193 peer group frankonIX-v4
   neighbor 193.34.203.194 peer group frankonIX-v4
   neighbor 193.34.203.195 peer group frankonIX-v4

   neighbor 2001:7f8:15b:1::c122:cbc1 peer group frankonIX-v6
   neighbor 2001:7f8:15b:1::c122:cbc2 peer group frankonIX-v6
   neighbor 2001:7f8:15b:1::c122:cbc3 peer group frankonIX-v6

   address-family ipv4
      neighbor frankonIX-v4 activate
   !
   address-family ipv6
      neighbor frankonIX-v6 activate
!
ip prefix-list MEINE-V4 seq 10 permit <IHR-PREFIX-V4>
ipv6 prefix-list MEINE-V6 seq 10 permit <IHR-PREFIX-V6>
!
route-map frankonIX-in deny 10
   match origin-as validity invalid
!
route-map frankonIX-in permit 20
!
route-map frankonIX-out-v4 permit 10
   match ip address prefix-list MEINE-V4
!
route-map frankonIX-out-v6 permit 10
   match ipv6 address prefix-list MEINE-V6
!

Cisco IOS-XR

IOS-XR can disable enforce-first-as per neighbour – done here via the neighbour group.

router bgp <IHRE-ASN>
 bgp router-id <IHRE-ROUTER-ID>

 rpki server 193.34.203.196
  transport tcp port 3323
  refresh-time 600
 !
 rpki server 193.34.203.197
  transport tcp port 3323
  refresh-time 600
 !

 address-family ipv4 unicast
  bgp origin-as validation enable
 !
 address-family ipv6 unicast
  bgp origin-as validation enable
 !

 neighbor-group frankonIX-v4
  remote-as 214591
  enforce-first-as disable
  address-family ipv4 unicast
   maximum-prefix <MAXPFX-V4> 90
   route-policy frankonIX-in in
   route-policy frankonIX-out-v4 out
  !
 !
 neighbor-group frankonIX-v6
  remote-as 214591
  enforce-first-as disable
  address-family ipv6 unicast
   maximum-prefix <MAXPFX-V6> 90
   route-policy frankonIX-in in
   route-policy frankonIX-out-v6 out
  !
 !

 neighbor 193.34.203.193
  use neighbor-group frankonIX-v4
 !
 neighbor 193.34.203.194
  use neighbor-group frankonIX-v4
 !
 neighbor 193.34.203.195
  use neighbor-group frankonIX-v4
 !
 neighbor 2001:7f8:15b:1::c122:cbc1
  use neighbor-group frankonIX-v6
 !
 neighbor 2001:7f8:15b:1::c122:cbc2
  use neighbor-group frankonIX-v6
 !
 neighbor 2001:7f8:15b:1::c122:cbc3
  use neighbor-group frankonIX-v6
 !
!
prefix-set meine-v4
  <IHR-PREFIX-V4>
end-set
!
prefix-set meine-v6
  <IHR-PREFIX-V6>
end-set
!
route-policy frankonIX-in
  if validation-state is invalid then
    drop
  endif
  pass
end-policy
!
route-policy frankonIX-out-v4
  if destination in meine-v4 then
    pass
  else
    drop
  endif
end-policy
!
route-policy frankonIX-out-v6
  if destination in meine-v6 then
    pass
  else
    drop
  endif
end-policy
!

Cisco IOS / IOS-XE

no bgp enforce-first-as is mandatory. Careful: on this platform the command applies globally, not per neighbour – your other eBGP sessions lose the check as well.

router bgp <IHRE-ASN>
 bgp router-id <IHRE-ROUTER-ID>
 no bgp enforce-first-as
 bgp log-neighbor-changes
 no bgp default ipv4-unicast

 bgp rpki server tcp 193.34.203.196 port 3323 refresh 600
 bgp rpki server tcp 193.34.203.197 port 3323 refresh 600

 neighbor FRANKONIX-V4 peer-group
 neighbor FRANKONIX-V4 remote-as 214591
 neighbor FRANKONIX-V6 peer-group
 neighbor FRANKONIX-V6 remote-as 214591

 neighbor 193.34.203.193 peer-group FRANKONIX-V4
 neighbor 193.34.203.194 peer-group FRANKONIX-V4
 neighbor 193.34.203.195 peer-group FRANKONIX-V4
 neighbor 2001:7F8:15B:1::C122:CBC1 peer-group FRANKONIX-V6
 neighbor 2001:7F8:15B:1::C122:CBC2 peer-group FRANKONIX-V6
 neighbor 2001:7F8:15B:1::C122:CBC3 peer-group FRANKONIX-V6

 address-family ipv4
  neighbor FRANKONIX-V4 activate
  neighbor FRANKONIX-V4 maximum-prefix <MAXPFX-V4> 90
  neighbor FRANKONIX-V4 route-map FRANKONIX-IN in
  neighbor FRANKONIX-V4 route-map FRANKONIX-OUT-V4 out
 exit-address-family

 address-family ipv6
  neighbor FRANKONIX-V6 activate
  neighbor FRANKONIX-V6 maximum-prefix <MAXPFX-V6> 90
  neighbor FRANKONIX-V6 route-map FRANKONIX-IN in
  neighbor FRANKONIX-V6 route-map FRANKONIX-OUT-V6 out
 exit-address-family
!
ip prefix-list MEINE-V4 seq 10 permit <IHR-PREFIX-V4>
ipv6 prefix-list MEINE-V6 seq 10 permit <IHR-PREFIX-V6>
!
route-map FRANKONIX-IN deny 10
 match rpki invalid
!
route-map FRANKONIX-IN permit 20
!
route-map FRANKONIX-OUT-V4 permit 10
 match ip address prefix-list MEINE-V4
!
route-map FRANKONIX-OUT-V6 permit 10
 match ipv6 address prefix-list MEINE-V6
!

BIRD 2

enforce first as is off by default in BIRD – nothing to do.

log syslog all;
router id <IHRE-ROUTER-ID>;

define MYAS = <IHRE-ASN>;

roa4 table r4;
roa6 table r6;

protocol rpki rpki01 {
    roa4 { table r4; };
    roa6 { table r6; };
    remote "193.34.203.196" port 3323;
    retry keep 90;
    refresh keep 600;
    expire keep 7200;
}

protocol rpki rpki02 {
    roa4 { table r4; };
    roa6 { table r6; };
    remote "193.34.203.197" port 3323;
    retry keep 90;
    refresh keep 600;
    expire keep 7200;
}

# RPKI-invalide Routen verwerfen.
# Hinweis: "-> bool" setzt BIRD >= 2.14 voraus.
# Auf aelteren Versionen die Angabe weglassen.
function rpki_ok() -> bool
{
    if ( net.type = NET_IP4 && roa_check(r4, net, bgp_path.last) = ROA_INVALID ) then
        return false;
    if ( net.type = NET_IP6 && roa_check(r6, net, bgp_path.last) = ROA_INVALID ) then
        return false;
    return true;
}

filter frankonIX_in
{
    if !rpki_ok() then reject;
    accept;
}

filter frankonIX_out_v4
{
    if ( net = <IHR-PREFIX-V4> ) then accept;
    reject;
}

filter frankonIX_out_v6
{
    if ( net = <IHR-PREFIX-V6> ) then accept;
    reject;
}

template bgp frankonIX_v4 {
    local <IHRE-IPV4> as MYAS;
    ipv4 {
        import filter frankonIX_in;
        export filter frankonIX_out_v4;
        import limit <MAXPFX-V4> action restart;
    };
}

template bgp frankonIX_v6 {
    local <IHRE-IPV6> as MYAS;
    ipv6 {
        import filter frankonIX_in;
        export filter frankonIX_out_v6;
        import limit <MAXPFX-V6> action restart;
    };
}

protocol bgp rs01_v4 from frankonIX_v4 { neighbor 193.34.203.193 as 214591; }
protocol bgp rs02_v4 from frankonIX_v4 { neighbor 193.34.203.194 as 214591; }
protocol bgp rs03_v4 from frankonIX_v4 { neighbor 193.34.203.195 as 214591; }

protocol bgp rs01_v6 from frankonIX_v6 { neighbor 2001:7f8:15b:1::c122:cbc1 as 214591; }
protocol bgp rs02_v6 from frankonIX_v6 { neighbor 2001:7f8:15b:1::c122:cbc2 as 214591; }
protocol bgp rs03_v6 from frankonIX_v6 { neighbor 2001:7f8:15b:1::c122:cbc3 as 214591; }

FRRouting

As of FRR 10.0 enforce-first-as is enabled by default and must be disabled for the route servers.

rpki
 rpki cache 193.34.203.196 3323 preference 1
 rpki cache 193.34.203.197 3323 preference 2
exit

router bgp <IHRE-ASN>
 bgp router-id <IHRE-ROUTER-ID>
 no bgp ebgp-requires-policy
 no bgp default ipv4-unicast

 neighbor frankonIX-v4 peer-group
 neighbor frankonIX-v4 remote-as 214591
 no neighbor frankonIX-v4 enforce-first-as

 neighbor frankonIX-v6 peer-group
 neighbor frankonIX-v6 remote-as 214591
 no neighbor frankonIX-v6 enforce-first-as

 neighbor 193.34.203.193 peer-group frankonIX-v4
 neighbor 193.34.203.194 peer-group frankonIX-v4
 neighbor 193.34.203.195 peer-group frankonIX-v4
 neighbor 2001:7f8:15b:1::c122:cbc1 peer-group frankonIX-v6
 neighbor 2001:7f8:15b:1::c122:cbc2 peer-group frankonIX-v6
 neighbor 2001:7f8:15b:1::c122:cbc3 peer-group frankonIX-v6

 address-family ipv4 unicast
  neighbor frankonIX-v4 activate
  neighbor frankonIX-v4 maximum-prefix <MAXPFX-V4>
  neighbor frankonIX-v4 route-map frankonIX-in in
  neighbor frankonIX-v4 route-map frankonIX-out-v4 out
 exit-address-family

 address-family ipv6 unicast
  neighbor frankonIX-v6 activate
  neighbor frankonIX-v6 maximum-prefix <MAXPFX-V6>
  neighbor frankonIX-v6 route-map frankonIX-in in
  neighbor frankonIX-v6 route-map frankonIX-out-v6 out
 exit-address-family
exit

ip prefix-list MEINE-V4 seq 10 permit <IHR-PREFIX-V4>
ipv6 prefix-list MEINE-V6 seq 10 permit <IHR-PREFIX-V6>

route-map frankonIX-in deny 10
 match rpki invalid
exit
route-map frankonIX-in permit 20
exit

route-map frankonIX-out-v4 permit 10
 match ip address prefix-list MEINE-V4
exit

route-map frankonIX-out-v6 permit 10
 match ipv6 address prefix-list MEINE-V6
exit

VyOS

VyOS uses FRR underneath, and FRR ≥ 10 enables the check by default; newer VyOS builds disable it again for neighbours without an explicit setting. Please verify after committing: vtysh -c "show run" | grep enforce-first-as. If an active line shows up and the session will not come up, get in touch with us.

set protocols rpki cache 193.34.203.196 port '3323'
set protocols rpki cache 193.34.203.196 preference '1'
set protocols rpki cache 193.34.203.197 port '3323'
set protocols rpki cache 193.34.203.197 preference '2'

set protocols bgp system-as '<IHRE-ASN>'
set protocols bgp parameters router-id '<IHRE-ROUTER-ID>'

set protocols bgp peer-group frankonIX-v4 remote-as '214591'
set protocols bgp peer-group frankonIX-v4 address-family ipv4-unicast maximum-prefix '<MAXPFX-V4>'
set protocols bgp peer-group frankonIX-v4 address-family ipv4-unicast route-map import 'frankonIX-in'
set protocols bgp peer-group frankonIX-v4 address-family ipv4-unicast route-map export 'frankonIX-out-v4'

set protocols bgp peer-group frankonIX-v6 remote-as '214591'
set protocols bgp peer-group frankonIX-v6 address-family ipv6-unicast maximum-prefix '<MAXPFX-V6>'
set protocols bgp peer-group frankonIX-v6 address-family ipv6-unicast route-map import 'frankonIX-in'
set protocols bgp peer-group frankonIX-v6 address-family ipv6-unicast route-map export 'frankonIX-out-v6'

set protocols bgp neighbor 193.34.203.193 peer-group 'frankonIX-v4'
set protocols bgp neighbor 193.34.203.194 peer-group 'frankonIX-v4'
set protocols bgp neighbor 193.34.203.195 peer-group 'frankonIX-v4'
set protocols bgp neighbor 2001:7f8:15b:1::c122:cbc1 peer-group 'frankonIX-v6'
set protocols bgp neighbor 2001:7f8:15b:1::c122:cbc2 peer-group 'frankonIX-v6'
set protocols bgp neighbor 2001:7f8:15b:1::c122:cbc3 peer-group 'frankonIX-v6'

set policy prefix-list MEINE-V4 rule 10 action 'permit'
set policy prefix-list MEINE-V4 rule 10 prefix '<IHR-PREFIX-V4>'
set policy prefix-list6 MEINE-V6 rule 10 action 'permit'
set policy prefix-list6 MEINE-V6 rule 10 prefix '<IHR-PREFIX-V6>'

set policy route-map frankonIX-in rule 10 action 'deny'
set policy route-map frankonIX-in rule 10 match rpki 'invalid'
set policy route-map frankonIX-in rule 20 action 'permit'

set policy route-map frankonIX-out-v4 rule 10 action 'permit'
set policy route-map frankonIX-out-v4 rule 10 match ip address prefix-list 'MEINE-V4'

set policy route-map frankonIX-out-v6 rule 10 action 'permit'
set policy route-map frankonIX-out-v6 rule 10 match ipv6 address prefix-list 'MEINE-V6'

OpenBGPD

OpenBGPD has no enforce first-as. The equivalent option is enforce neighbor-as, which defaults to yes for EBGP – it needs to be no.

AS <IHRE-ASN>
router-id <IHRE-ROUTER-ID>

rtr 193.34.203.196 {
    descr "frankonIX rpki01"
    port 3323
}

rtr 193.34.203.197 {
    descr "frankonIX rpki02"
    port 3323
}

prefix-set meine-v4 {
    <IHR-PREFIX-V4>
}

prefix-set meine-v6 {
    <IHR-PREFIX-V6>
}

group "frankonIX-v4" {
    remote-as 214591
    enforce neighbor-as no
    max-prefix <MAXPFX-V4> restart 15
    local-address <IHRE-IPV4>

    neighbor 193.34.203.193 { descr "RS01 IPv4" }
    neighbor 193.34.203.194 { descr "RS02 IPv4" }
    neighbor 193.34.203.195 { descr "RS03 IPv4" }
}

group "frankonIX-v6" {
    remote-as 214591
    enforce neighbor-as no
    max-prefix <MAXPFX-V6> restart 15
    local-address <IHRE-IPV6>

    neighbor 2001:7f8:15b:1::c122:cbc1 { descr "RS01 IPv6" }
    neighbor 2001:7f8:15b:1::c122:cbc2 { descr "RS02 IPv6" }
    neighbor 2001:7f8:15b:1::c122:cbc3 { descr "RS03 IPv6" }
}

# OpenBGPD wertet von oben nach unten aus; es gewinnt die LETZTE
# zutreffende Regel - ausser bei "quick", das sofort abbricht.

allow from any
deny quick from ebgp ovs invalid

deny to group "frankonIX-v4"
allow to group "frankonIX-v4" prefix-set meine-v4

deny to group "frankonIX-v6"
allow to group "frankonIX-v6" prefix-set meine-v6

What to check once it is up

  1. Six sessions established – three IPv4, three IPv6. Fewer than that is a configuration problem, not something we did on purpose.
  2. RTR sessions established to both validators, and the ROA table populated. An empty table with an established session means the initial sync is still running – that takes a few minutes after start-up.
  3. Your prefixes arrive. Check in the looking glass whether they show up on all three route servers, and whether a 214591:1101:* community is attached.

Common problems

SymptomCause
Session stays in Active / Connect Wrong peering IP, or the VLAN is not tagged on your port
Session comes up but we send you no routes enforce-first-as is active – see your platform above
Nobody receives your routes Check the 1101:* community in the looking glass. Usually :9 or :10 – the prefix is missing from your AS-SET
Only some of your prefixes get through Prefix limit reached, or prefixes longer than /24 resp. /48
RTR session will not come up Did you configure port 3323 rather than 323?
Routes only appear hours after an IRR change The IRRDB refresh runs every six hours

Questions? Support & Contact