NIX.CZ, z.s.p.o.

Implementation of MANRS Actions

• Action 1: Filtering of Route Announcements NIX.CZ provides the option to peer on BGP route servers. We do encourage all peering partners to use route server, however private peering policy is also available. By the end of September 2019, new route servers will be running with the following configuration that includes RPKI validation.Filtering steps 1. Drop small prefixes – longer than /24 for ipv4 and longer than /48 for ipv6. 2. Drop all well-known martians and bogons. 3. Ensure that there is at least 1 ASN and less than 64 ASNs in the AS path. 4. Ensure that the peer AS is the same as the first AS in the AS path. 5. Drop any prefix where the next-hop IP address is not the same as the peer IP address 6. Drop any prefix with a transit network ASN in the AS path. 7. Ensure that origin AS is in set of ASNs from the client’s IRRDB AS-SET. 8. If the prefix is evaluated as RPKI valid, accept 9. If the prefix is evaluated as RPKI invalid, drop 10. If the prefix is evaluated as RPKI unknown, revert to standard IRRDB prefix filtering.
• Action 2-1: Offer assistance to its members to maintain accurate routing information in an appropriate repository (IRR and/or RPKI) Our FENIX project is strict community of networks implementing best security practice available today and encouraging all networks to join.
• Action 3: Protect the peering platform Please refer to our policy https://www.nix.cz/cs/file/PEERING_POLICY
• Action 4: Facilitate global operational communication and coordination between network operators We do offer FENIX association membership and we do support mailling lists and WWW page for members with all set of tools.
• Action 5: Provide monitoring and debugging tools to the members We do offer Looking glass, NetFlow and data flow statistics for members. We have a plan to implement monitoring tools available in real time for members.