> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# RPKI and IRR Filtering on Extreme IX

> This help topic describes the RPKI and IRR route validation policies that apply to BGP sessions on Extreme IX.

export const Image = ({src, alt = '', caption, width, height, shadow}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Image -';
  if (typeof src !== 'string') {
    src = String(src);
  }
  if (!src || src === 'undefined') {
    console.error(`${errorPrefix} \`src\` is required — rendering an empty string instead`);
    return <></>;
  }
  const img = <img className={['mega-image-style', shadow ? 'shadow' : ''].join(' ')} src={src} alt={alt} width={width} height={height} style={{
    display: 'block'
  }} />;
  return caption ? <figure>
      {img}
      <figcaption style={{
    textAlign: 'center',
    width
  }}>{caption}</figcaption>
    </figure> : img;
};

To ensure route security, prevent BGP hijacking, and protect against route leaks, strict route validation policies govern BGP sessions with Extreme IX.

<Warning>
  Extreme IX only establishes BGP sessions and accepts route announcements that are RPKI valid and that pass IRR (Internet Routing Registry) filtering.
</Warning>

## RPKI and Route Origin Authorization (ROA)

A Route Origin Authorization (ROA) is a cryptographically signed object that specifies which Autonomous System Number (ASN) is authorized to originate a specific IP address prefix or range.

### Validate your RPKI status

Use these public tools to confirm that your prefixes are correctly signed and validated:

* **HE BGP Toolkit** -- Valid ROAs display a key icon next to the prefix listing on [bgp.he.net](https://bgp.he.net/).

  <Image src="/images/ix/extreme-ix/rpki-01-he-bgp-toolkit.png" alt="Hurricane Electric BGP Toolkit page for a prefix, showing a key icon and a green check mark next to the announcement to indicate a valid ROA." shadow={true} width={600} />

* **RPKI Validator** -- Check your prefix status at the [RIPE RPKI Validator](https://rpki-validator.ripe.net/ui/); a valid prefix shows as Valid.

  <Image src="/images/ix/extreme-ix/rpki-02-rpki-validator.png" alt="RPKI validation tool showing a Valid result for a prefix and origin ASN." shadow={true} width={600} />

### Create ROAs by RIR or NIR

#### Option A: IRINN (India)

To start and create ROA objects for resources under IRINN:

1. Send an email to `hostmaster@irinn.in` from your registered account email.
2. Include the following mandatory details:
   * **ASN** -- The Autonomous System Number announcing the IP block.
   * **IP Prefix** -- The address block (for example, `192.168.0.0/22`).
   * **Most Specific Announcement (MSA)** -- The maximum prefix length allowed (for example, `/24`).

For example,

```text theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
ASN: AS24029
IP Prefix: 192.168.0.0/22
MSA: /24
```

For more information, see the [IRINN Resource Certification page](https://irinn.in/resource-certification).

#### Option B: APNIC

1. Log in to MyAPNIC, go to **Resources > Resource Certification > RPKI**, and click **Activate RPKI Engine**.

   <Image src="/images/ix/extreme-ix/rpki-03-apnic-activate.png" alt="MyAPNIC Resources page with the Resource Certification RPKI option highlighted." shadow={true} width={600} />

2. Go to **Resources > Route Management > Routes** to view your registered prefixes and transit ASNs.

   <Image src="/images/ix/extreme-ix/rpki-04-apnic-route-management.png" alt="MyAPNIC Routes page listing registered prefixes with their ROA and Whois status, and the Create Route button." shadow={true} width={600} />

3. Click **Create Route** and complete the required fields:

   * **Prefix** -- The IP prefix block to authorize.
   * **Origin AS** -- The ASN authorized to originate the prefix.
   * **Most Specific Announcement (MSA)** -- The smallest allowable sub-route (for example, `/24` for IPv4 or `/48` for IPv6). APNIC marks any prefix announced shorter than this length as Invalid.
   * **Whois Option** (optional) -- Automatically creates `route`/`route6` objects alongside your ROA. When enabled, the difference between the prefix length and the MSA must be 8 bits or less (for example, a `/32` IPv6 prefix allows an MSA up to `/40`).

   <Image src="/images/ix/extreme-ix/rpki-06-apnic-create-route-2.png" alt="APNIC Create Route dialog showing the Prefix, Origin AS, MSA, and ROA fields." shadow={true} width={600} />

   <Image src="/images/ix/extreme-ix/rpki-05-apnic-create-route.png" alt="APNIC route confirmation screen showing an IPv6 prefix with ROA enabled and Whois disabled." shadow={true} width={600} />

   <Image src="/images/ix/extreme-ix/rpki-08-apnic-create-route-4.png" alt="APNIC Create Route dialog with the Whois option enabled and highlighted." shadow={true} width={600} />

   <Image src="/images/ix/extreme-ix/rpki-07-apnic-create-route-3.png" alt="APNIC route confirmation screen showing sub-route selection for an IPv4 prefix with Whois enabled." shadow={true} width={600} />

4. Review your configuration, select any sub-routes if applicable, and click **Submit**. APNIC automatically publishes your ROA to the global RPKI repository.

<Tip>
  For more information, see APNIC's guide on [creating RPKI ROAs in MyAPNIC](https://blog.apnic.net/2019/09/11/how-to-creating-rpki-roas-in-myapnic/).
</Tip>

## IRR filtering and AS-Set objects

All member networks must maintain accurate prefix and downstream customer records in the Internet Routing Registry (IRR) using RPSL syntax.

### AS-Set configuration guidelines

* **Networks with downstream customers** -- Maintain an updated `as-set` object that contains your ASN and all downstream member ASNs.
* **Networks without downstream customers** -- You do not need to create an `as-set` object. Enter your ASN (for example, `AS135814`) in PeeringDB.

Example IRR `as-set` object:

```text theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
as-set:          AS135814:AS-CUSTOMERS
descr:           Provides Transit to the following ASes
members:         AS135814, AS20940, AS63293
admin-c:         EIMT1-AP
tech-c:          EIMT1-AP
mnt-by:          MAINT-IN-EXTREME
last-modified:   2018-06-01T19:12:02Z
source:          APNIC
```

<Note>
  Add your updated `as-set` object or ASN to your PeeringDB record. For step-by-step instructions, see [PeeringDB Record](/ix/extreme-ix/peeringdb-record).
</Note>

<Image src="/images/ix/extreme-ix/rpki-09-irr-peeringdb-diagram.png" alt="Diagram showing the relationship between an IRR AS-SET object and a PeeringDB network record." shadow={true} width={600} />

For more information about IRR, see [APNIC's guide to using WHOIS: AS-SET](https://www.apnic.net/manage-ip/using-whois/guide/as-set/) and [irr.net](https://irr.net/).