Skip to main content
To ensure route security, prevent BGP hijacking, and protect against route leaks, strict route validation policies govern BGP sessions with Extreme IX.
Extreme IX only establishes BGP sessions and accepts route announcements that are RPKI valid and that pass IRR (Internet Routing Registry) filtering.

​
RPKI and Route Origin Authorization (ROA)

A Route Origin Authorization (ROA) is a cryptographically signed object that specifies which Autonomous System Number (ASN) is authorized to originate a specific IP address prefix or range.

​
Validate your RPKI status

Use these public tools to confirm that your prefixes are correctly signed and validated:
  • HE BGP Toolkit — Valid ROAs display a key icon next to the prefix listing on bgp.he.net.
  • RPKI Validator — Check your prefix status at the RIPE RPKI Validator; a valid prefix shows as Valid.

​
Create ROAs by RIR or NIR

​
Option A: IRINN (India)

To start and create ROA objects for resources under IRINN:
  1. Send an email to hostmaster@irinn.in from your registered account email.
  2. Include the following mandatory details:
    • ASN — The Autonomous System Number announcing the IP block.
    • IP Prefix — The address block (for example, 192.168.0.0/22).
    • Most Specific Announcement (MSA) — The maximum prefix length allowed (for example, /24).
For example,
For more information, see the IRINN Resource Certification page.

​
Option B: APNIC

  1. Log in to MyAPNIC, go to Resources > Resource Certification > RPKI, and click Activate RPKI Engine.
  2. Go to Resources > Route Management > Routes to view your registered prefixes and transit ASNs.
  3. Click Create Route and complete the required fields:
    • Prefix — The IP prefix block to authorize.
    • Origin AS — The ASN authorized to originate the prefix.
    • Most Specific Announcement (MSA) — The smallest allowable sub-route (for example, /24 for IPv4 or /48 for IPv6). APNIC marks any prefix announced shorter than this length as Invalid.
    • Whois Option (optional) — Automatically creates route/route6 objects alongside your ROA. When enabled, the difference between the prefix length and the MSA must be 8 bits or less (for example, a /32 IPv6 prefix allows an MSA up to /40).
  4. Review your configuration, select any sub-routes if applicable, and click Submit. APNIC automatically publishes your ROA to the global RPKI repository.
For more information, see APNIC’s guide on creating RPKI ROAs in MyAPNIC.

​
IRR filtering and AS-Set objects

All member networks must maintain accurate prefix and downstream customer records in the Internet Routing Registry (IRR) using RPSL syntax.

​
AS-Set configuration guidelines

  • Networks with downstream customers — Maintain an updated as-set object that contains your ASN and all downstream member ASNs.
  • Networks without downstream customers — You do not need to create an as-set object. Enter your ASN (for example, AS135814) in PeeringDB.
Example IRR as-set object:
Add your updated as-set object or ASN to your PeeringDB record. For step-by-step instructions, see PeeringDB Record.
For more information about IRR, see APNIC’s guide to using WHOIS: AS-SET and irr.net.
Last modified on September 2, 2026