Networking AWS

IXP Manager on AWS User Guide

| Product: IXP Manager

Overview

IXP Manager is the open source platform that operates an Internet Exchange Point. Developed by INEX and in production at over 250 exchanges worldwide, it is the system exchange operators use to run the day to day business of peering: onboarding members, allocating ports and addresses, generating device configuration from a single source of truth, and publishing the statistics members care about.

It manages members and their peering ports, the IXP LAN and its VLAN addressing, switches, patch panels and colocated equipment. From that one database it generates route server, route collector and switch configuration, builds IRRDB based prefix and AS path filters from RIPE, RADB and the other registries, publishes peering matrices and peer to peer traffic statistics, exports the IX-F member list that peering databases consume, and gives every member a self service portal.

The cloudimg image delivers IXP Manager 7.3.1 on a full stack that is already wired together: Apache 2.4 with PHP 8.4, MySQL 8.0 as the database and memcached as the cache. The schema is migrated and seeded with the upstream reference data at build time and a placeholder exchange identity is in place, so the first page you reach is a working sign in rather than an installer. Backed by 24/7 cloudimg support.

What is included:

  • IXP Manager 7.3.1 (GPL-2.0, inex/IXP-Manager) at /srv/ixpmanager, installed from the pinned upstream release tarball
  • Apache 2.4 with mod_rewrite and mod_headers, serving the Laravel front controller from /srv/ixpmanager/public
  • PHP 8.4 from the upstream supported ondrej/php PPA (IXP Manager v7 requires PHP ^8.4), with OPcache and the intl, bcmath, snmp, rrd, ds, yaml, memcached, gd and zip extensions
  • MySQL 8.0 and memcached, both bound to the loopback interface only
  • composer, rrdtool, bgpq3 and the SNMP tooling IXP Manager uses for graphing and switch polling
  • The upstream scheduler cron entry, so artisan schedule:run runs from first boot
  • The upstream reference data already seeded: IRRDB sources, switch vendors and contact groups
  • Two dedicated EBS data volumes: the MySQL datadir at /var/lib/mysql and the application tier at /srv/ixpmanager, each independently resizable and mounted by filesystem UUID
  • Per instance Laravel application key, database password, MySQL maintenance password and administrator password, all generated on first boot into a root only file - no shared or default credential ships in the image
  • 24/7 cloudimg support

Connecting to your instance

Connect over SSH on port 22 using the private key for the key pair you selected at launch. The login user depends on the operating system variant you launched:

OS variant SSH login user
Ubuntu 24.04 ubuntu 
ssh -i /path/to/your-key.pem ubuntu@<instance-public-ip>

Prerequisites

  • An AWS account subscribed to the IXP Manager listing on AWS Marketplace
  • An EC2 key pair in the region you are launching into
  • A security group allowing inbound TCP 22 from your administrative address range, and inbound TCP 80 (and 443 once you terminate TLS) from the networks that need to reach the portal
  • m5.large or larger is recommended. IXP Manager is a PHP application with a MySQL database and a graph renderer, so it benefits from real memory rather than burstable credit

Launching the instance

From the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration, pick your region and the Ubuntu 24.04 delivery option, and then Continue to Launch. Select your instance type, key pair, subnet and security group, and launch.

To launch the same AMI from the EC2 CLI instead, substitute your own AMI id, key pair, security group and subnet:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name your-key-pair \
  --security-group-ids sg-your-security-group \
  --subnet-id subnet-your-subnet \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=ixp-manager}]'

First boot

On its first boot the instance runs ixp-manager-firstboot.service, a one shot systemd unit that:

  1. Generates a fresh MySQL application password and rewrites /srv/ixpmanager/.env in lock step with the ALTER USER, then proves the new credential authenticates with a real query
  2. Generates a fresh MySQL maintenance password for the debian-sys-maint account and rewrites /etc/mysql/debian.cnf, so no baked maintenance credential is shared between instances
  3. Resolves the instance address from EC2 IMDSv2 and writes it to APP_URL
  4. Generates a fresh Laravel APP_KEY and rebuilds the configuration cache
  5. Generates a fresh administrator password, stores it as a bcrypt hash, and writes every credential to /root/ixp-manager-credentials.txt with mode 0600

First boot normally completes within a minute of the instance reaching the running state. Confirm the stack is up and check the shipped version:

systemctl is-active apache2.service mysql.service memcached.service
php -v | head -1
grep APPLICATION_VERSION /srv/ixpmanager/version.php

active
active
active
PHP 8.4.23 (cli) (built: Jul  2 2026 18:44:08) (NTS)
define( 'APPLICATION_VERSION', '7.3.1' );

The portal answers on port 80:

curl -s -o /dev/null -w 'IXP Manager sign-in page: HTTP %{http_code}\n' http://127.0.0.1/login

IXP Manager sign-in page: HTTP 200

Retrieving your credentials

Every credential is unique to your instance and is written to a root only file. The sign in URL and the administrator username are:

sudo grep -E '^ixpmanager\.(url|admin\.user)=' /root/ixp-manager-credentials.txt

ixpmanager.url=http://52.207.238.179/
ixpmanager.admin.user=admin

The password is in the same file. Read it on your own instance when you need it, and do not copy it anywhere it can be logged:

sudo grep '^ixpmanager.admin.pass=' /root/ixp-manager-credentials.txt | cut -d= -f2-

IXP Manager signs in by USERNAME, not by email address. The account above is a superuser.

Signing in

Browse to http://<instance-public-ip>/ and sign in with the username and password from the credentials file.

IXP Manager sign in page

The compulsory two factor enrolment

IXP Manager makes two factor authentication compulsory for superuser accounts, so your very first sign in lands on Security / Two Factor Authentication rather than the dashboard. This is deliberate and it is a feature, not a fault: no 2FA enrolment is baked into the image, so the second factor you enrol is generated on your own instance and belongs to you alone.

Scan the barcode with any Google Authenticator compatible app (the HOTP and TOTP algorithms of RFC 4226 and RFC 6238 are both supported), then enter the six digit code together with your account password to enable it. Store the recovery detail somewhere safe: with 2FA compulsory, losing the authenticator means losing administrator access to the portal.

Once enrolled you land on the dashboard, which shows member counts and the aggregate exchange traffic graphs.

IXP Manager dashboard

What ships already configured

The image ships a placeholder exchange so every screen is populated while you replace it with your own. The members list carries one internal infrastructure member on AS65535:

IXP Manager members list

Opening it shows the full member record: peering policy, IRRDB filtering state, NOC contact details and prefix limits.

IXP Manager member overview

The upstream reference data is already seeded, so IRRDB filter generation and switch modelling work without any further setup:

IXP Manager IRRDB sources

An infrastructure groups the switches that form a peering LAN:

IXP Manager infrastructures

You can confirm the seeded data from the shell:

sudo mysql -N -B -e "SELECT 'irrdb sources', COUNT(*) FROM ixpmanager.irrdbconfig UNION ALL SELECT 'switch vendors', COUNT(*) FROM ixpmanager.vendor UNION ALL SELECT 'infrastructures', COUNT(*) FROM ixpmanager.infrastructure UNION ALL SELECT 'members', COUNT(*) FROM ixpmanager.cust;"

irrdb sources   13
switch vendors  18
infrastructures 1
members 1

Replacing the placeholder identity with your own exchange

The shipped identity is a placeholder: shortname EXAMPLE, legal name Example Internet Exchange Point, ASN 65535 (a reserved 16 bit ASN, deliberately not a real exchange's). Replace it before you put the portal in front of members.

The branding, contact and support details live in the IDENTITY_ block of the environment file:

sudo grep -E '^IDENTITY_(LEGALNAME|CITY|COUNTRY|SUPPORT_EMAIL)=' /srv/ixpmanager/.env

IDENTITY_LEGALNAME="Example Internet Exchange Point"
IDENTITY_CITY="Example City"
IDENTITY_COUNTRY=IE
IDENTITY_SUPPORT_EMAIL="support@example.com"

Edit them, then rebuild the configuration cache and reload Apache:

sudo nano /srv/ixpmanager/.env
sudo php /srv/ixpmanager/artisan config:cache
sudo systemctl reload apache2

The exchange record itself - shortname, ASN, IX-F ID and PeeringDB ID - is edited in the web interface under Infrastructures, and your real switches, VLANs, IP address ranges and members are added under the corresponding IXP Admin Actions entries in the left hand menu. Upstream documentation for each of those areas is at docs.ixpmanager.org.

Storage layout

The database tier and the application tier each sit on their own EBS volume, mounted by filesystem UUID, so either can be resized or snapshotted independently of the operating system disk:

for mp in /var/lib/mysql /srv/ixpmanager; do printf '%-16s ' "$mp"; findmnt -no SOURCE,FSTYPE,SIZE,USED "$mp"; done

/var/lib/mysql   /dev/nvme1n1 ext4   19.5G 204.6M
/srv/ixpmanager  /dev/nvme2n1 ext4   19.5G 123.8M

To grow either tier, modify the EBS volume in the EC2 console, then run sudo resize2fs <device> on the instance. The nofail mount option means the instance still boots if a volume is ever detached.

Security notes

MySQL and memcached listen on the loopback interface only, so neither the database nor the cache is reachable from off the instance:

ss -tlnH | awk '{print $4}' | grep -E ':(3306|11211)$' | sort

127.0.0.1:11211
127.0.0.1:3306
[::1]:11211

The environment file holds your application key and database password, and Apache is configured to refuse to serve it:

CODE=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/.env)
if [ "$CODE" = "200" ]; then echo "UNEXPECTED: the environment file is served over HTTP"; exit 1; else echo "refused (HTTP $CODE) - correct"; fi

refused (HTTP 403) - correct

Further recommendations:

  • Restrict inbound SSH to your administrative address range rather than 0.0.0.0/0
  • Put TLS in front of the portal before members use it (see below) - the sign in form posts a password
  • Enable EBS encryption for data at rest
  • Keep the compulsory 2FA enrolment; do not disable it
  • Take regular snapshots of the MySQL data volume, or mysqldump the ixpmanager schema to object storage

Enabling HTTPS

The image is TLS ready but ships no certificate, because the certificate has to match your own hostname. Two supported approaches:

AWS Certificate Manager with a load balancer. Put an Application Load Balancer in front of the instance, attach an ACM certificate for your exchange's hostname, and forward to the instance on port 80. This keeps certificate renewal inside AWS.

Let's Encrypt directly on the instance. Point a DNS record at the instance, open port 443 in the security group, then:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d ixp.your-domain.example

Either way, update APP_URL in /srv/ixpmanager/.env to the https:// form afterwards and run sudo php /srv/ixpmanager/artisan config:cache, so links the application generates use the correct scheme.

Scheduled tasks

IXP Manager's scheduled work - IRRDB updates, statistics aggregation, IX-F export refresh - runs through the Laravel scheduler, installed as a cron entry:

cat /etc/cron.d/ixpmanager

# IXP Manager scheduled tasks - cloudimg AWS Marketplace AMI
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
* * * * * www-data /usr/bin/php /srv/ixpmanager/artisan schedule:run >/dev/null 2>&1

Database maintenance

The debian-sys-maint maintenance account is re-minted per instance at first boot and its credential is written to /etc/mysql/debian.cnf, so routine MySQL maintenance works out of the box:

sudo mysql --defaults-file=/etc/mysql/debian.cnf -N -B -e "SELECT CONCAT('MySQL ', VERSION(), ' reachable via the per-instance maintenance credential');"

MySQL 8.0.46-0ubuntu0.24.04.3 reachable via the per-instance maintenance credential

Command line administration

Every IXP Manager maintenance command is an artisan command run from /srv/ixpmanager:

sudo php /srv/ixpmanager/artisan list
sudo php /srv/ixpmanager/artisan config:cache
sudo php /srv/ixpmanager/artisan cache:clear

Application logs are under /srv/ixpmanager/storage/logs, and the Apache access and error logs for the portal are /var/log/apache2/ixpmanager-access.log and /var/log/apache2/ixpmanager-error.log.

Upgrading

IXP Manager releases are published on the upstream releases page. Read the upstream upgrade notes for the target release before upgrading, take a snapshot of the MySQL data volume first, and follow the upstream procedure. cloudimg also publishes refreshed images as new upstream releases land, and 24/7 support can assist with in place upgrades.

Licensing

IXP Manager is free and open source software published by INEX under the GNU General Public License version 2.0. There is no licence fee and no key to enter. The cloudimg charge covers packaging, security patching, image maintenance and support.

Support

24/7 support is included with this image. Email support@cloudimg.co.uk for help with deployment, replacing the placeholder identity, route server and IRRDB filter configuration, TLS termination, performance tuning or MySQL administration. Upstream project documentation is at docs.ixpmanager.org.