docs: allow SwissIX large action communities through the ferrix import filter

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/lab/prod/bird-ferrix.conf

@@ -19,13 +19,26 @@ filter ferrix_import
     if bgp_path.len > 17 then reject;
     if bgp_path.first != FERRIX_ASN then reject;
 
-    # Students type communities freely into a web form with no login. Do not
-    # let those reach upstreams, where they could trigger real actions
-    # (blackholing, selective prepends, ...). Keep only the two well-known
-    # ones BIRD itself honours, so NO_EXPORT / NO_ADVERTISE visibly work.
-    # To let students use more, add them to this list deliberately.
+    # Students type communities freely into a web form with no login, so
+    # only namespaces we have chosen to expose get through.
+    #
+    # Standard: just the two well-known ones BIRD itself honours, so
+    # NO_EXPORT / NO_ADVERTISE visibly work. Notably BLACKHOLE (65535:666),
+    # which SwissIX acts on, stays scrubbed.
     bgp_community.filter([ (65535, 65281), (65535, 65282) ]);
-    bgp_large_community.empty;
+
+    # Large: the SwissIX route-server action communities, all of which live
+    # under their route-server ASN 42476
+    # (https://www.swissix.ch/resources/action-bgp-communities/):
+    #   42476:0:<peer-as>    do not redistribute to peer   42476:0:0  to nobody
+    #   42476:1:<peer-as>    redistribute to peer          42476:1:0  to all
+    #   42476:101|102|103:<peer-as or 0>   prepend 1x / 2x / 3x
+    #   42476:901|902:<peer-as>            add NO_EXPORT / NO_ADVERTISE
+    # Everything else is dropped, including our own (210036, *, *) space so
+    # students cannot trigger anything this network acts on internally. Add
+    # further namespaces here deliberately.
+    bgp_large_community.filter([ (42476, *, *) ]);
+
     bgp_ext_community.empty;
 
     # Announce-only: there is nothing behind these prefixes. Do not forward
@@ -74,5 +87,10 @@ protocol bgp ferrix
 #     }
 #
 # Consequence: AS-path prepends set by students are made of the private ASN
-# and are stripped here too, so prepending has no effect beyond this router.
+# and are stripped here too, so prepending in ferrix has no effect beyond
+# this router. The SwissIX prepend communities (42476:101..103:*) do work:
+# the route server prepends AS210036 itself.
+#
+# The session towards the SwissIX route servers must also send large
+# communities unmodified; check that its export filter does not clear them.
 # ---------------------------------------------------------------------------