Peer1IX
Internet Exchange
Services

Interconnection

Internet ExchangeMicro PoPsEdge Data Centers

Network Services

Data Center to Data CenterVirtual Connectivity HubData Center to CloudCloud to CloudPeer1ix Cloud RouterPeer1ix Virtual EdgeNAT GatewayPeer1ix PortVirtual Cross Connect

Security Services

DDoS ProtectionPeer1ix FWaaSIPsec Tunnel

Cloud Interconnect

Cloudflare Network Interconnect
Locations
Network toolsAll-in-One Network ReportBGP Looking GlassRPKI ValidatorBGP Security & Hijack CheckIP WHOISAS WHOISBGP Route ExplorerASN InsightsBGP Hijacks & Route LeaksInternet Outage TrackerCountry Internet InsightsTop Domains RankingDNS LookupSubnet CalculatorWhat Is My IP
BlogAboutContact Get connected

Port Security on the Peering LAN: Rules Every Member Should Know

· 1 min read · Peer1IX Team

Port Security on the Peering LAN: Rules Every Member Should Know

A shared peering LAN only works if every member keeps it clean. The rules that protect the fabric — and why they exist.

Why rules exist

On the exchange LAN, every member shares the same broadcast domain. One misconfigured router can affect everyone. Peering LAN rules keep the fabric stable.

One MAC address per port

The fabric learns a single MAC per member port. Multiple MACs usually mean a switch or bridge is leaking into the exchange.

Allowed traffic types

Only IPv4, IPv6 and ARP are permitted. Other ethertypes are dropped.

Silence unnecessary protocols

Disable CDP, LLDP, STP, DHCP, router advertisements, OSPF, IS-IS and similar protocols on the interface facing the exchange.

Stick to assigned addresses

Use only the IPv4 and IPv6 addresses assigned to you on the peering LAN.

Disable proxy ARP

A router answering ARP for other addresses can attract traffic it should not receive.

Read the full peering policy before connecting.

peering LANport securitybest practices