SecureAnyCloud
Deployment guide

IXP Manager

Overview

This guide covers the deployment and configuration of IXP Manager 7.3.1 on Ubuntu 24.04 on Azure using SecureAnyCloud Azure Marketplace images. IXP Manager is the open source platform that operates an Internet Exchange Point, developed by INEX and in production at over 250 exchanges worldwide.

It manages members and their peering ports, IXP LAN and VLAN addressing, patch panels and colocated equipment. It generates route server, route collector and switch configuration, builds IRRDB-based prefix and AS path filters, publishes peering matrices and peer-to-peer traffic statistics, exports the IX-F member list, and gives every member a self service portal for their own ports, sessions and graphs.

The image installs the pinned upstream release tag v7.3.1 from the official IXP Manager repository, following the procedure in the project's own Ubuntu 24.04 installer. The full stack is wired together at build time and the database schema is migrated and seeded, so the first page you reach is a working sign-in rather than an installer.

No baked login credential. Nothing usable ships in the image. On first boot ixp-manager-firstboot.service generates a fresh Laravel application key, a fresh MySQL password and a fresh superuser password, all unique to your VM, and writes them to /root/ixp-manager-credentials.txt (mode 0600, root only). The build-time secrets are overwritten with random values that are generated, used once, and discarded, so no image and no person holds a working credential for your machine.

Two-factor authentication is compulsory. IXP Manager enforces 2FA on superuser accounts. Your first sign-in requires you to enrol an authenticator app before anything else renders. No 2FA enrolment ships in the image, so the second factor is genuinely yours alone (see Step 5).

Only the web tier is reachable. MySQL is bound to 127.0.0.1 and memcached to the loopback only, so the database and cache are never exposed off box. Apache refuses to serve the .env file that holds your secrets.

A sample IXP identity you replace. So the application is immediately functional, the image ships a clearly marked sample identity (shortname EXAMPLE, ASN 65535, which is a reserved ASN and deliberately not a real exchange's). Step 8 walks you through replacing it with your own.

What you get:

  • IXP Manager 7.3.1 (pinned upstream release tag), a Laravel 12 application.
  • Apache 2.4, PHP 8.4, MySQL 8.0 and memcached, configured and enabled.
  • A database schema migrated and seeded with the upstream reference data (router vendors, IRRDB sources, contact groups).
  • Per-VM secret generation on first boot for the application key, database password and superuser password.
  • Compulsory two-factor authentication on the superuser account, with no enrolment baked into the image.
  • The upstream task scheduler cron entry, installed and running.
  • Unattended security upgrades, left enabled.

Prerequisites

Before you deploy, make sure you have:

  • An active Azure subscription, an SSH public key, and a virtual network and subnet in the target region.
  • A subscription to the IXP Manager listing on Azure Marketplace.
  • Network Security Group rules allowing TCP 22 for administration and TCP 80 for the web portal, both restricted to your own management network.
  • An authenticator app (any TOTP app, such as Google Authenticator, 1Password or Aegis) to complete the compulsory 2FA enrolment at first sign-in.
  • Recommended virtual machine size: Standard_B2ms (2 vCPU, 8 GB RAM) for a production exchange. Larger exchanges collecting sflow and generating many route server configurations should use Standard_D2s_v5 or larger.
1

Deploy from the Azure Portal

Search for IXP Manager in Marketplace, select the SecureAnyCloud publisher, and click Create. Configure the Network Security Group to allow TCP 22 and TCP 80 from your management network only.

Do not expose the portal to the whole internet until you have completed Step 9 and put TLS in front of it.

2

Deploy from the Azure CLI

Accept the Marketplace terms once, then create the virtual machine:

RG="ixp-prod"; LOCATION="eastus"; VM_NAME="ixp-manager" IMAGE_URN="sac1647283583153:ixp-manager-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ixp-manager-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
3

First boot

On the first boot, the VM generates every secret it needs. ixp-manager-firstboot.service runs once, before Apache starts serving, and does the following:

  • Rotates the MySQL password and rewrites .env in lock step.
  • Resolves the VM's reachable address from Azure IMDS and sets APP_URL.
  • Generates a fresh Laravel APP_KEY and rebuilds the configuration cache.
  • Rotates the superuser password.
  • Writes everything to /root/ixp-manager-credentials.txt and drops a sentinel so it never runs again.

Wait about thirty seconds after the VM reports running, then confirm the whole stack is up.

4

Confirm the stack is running

Check that every service is active:

systemctl is-active apache2.service mysql.service memcached.service ixp-manager-firstboot.service

All four report active. ixp-manager-firstboot.service is a oneshot unit with RemainAfterExit=yes, so active means it completed successfully.

Confirm the component versions and that the sign-in page is being served:

php -v | head -1 sudo mysql -N -B -e 'SELECT VERSION();'
sudo php /srv/ixpmanager/artisan --version curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/login

Read your per-VM credentials. This file is mode 0600 and readable only by root:

sudo cat /root/ixp-manager-credentials.txt

IXP Manager signs in by username, not by email address. The username is admin. The password is the ixpmanager.admin.pass value above, and it is unique to your VM.

5

First sign in and compulsory 2FA enrolment

Browse to http://<vm-ip>/ and sign in with the username and password from Step 4.

Because IXP Manager enforces two-factor authentication for superusers, the first thing you see after signing in is the 2FA enrolment page, and nothing else renders until you complete it. Scan the QR code with your authenticator app, enter the six-digit code it shows plus your password, and click Enable 2FA.

No 2FA enrolment is baked into the image, so the secret behind that QR code is generated on your VM and known only to you. Store your authenticator recovery method safely, because with 2FA enforced, losing it means losing portal access.

Once you are enrolled, you land on the IXP Manager dashboard.

The aggregate traffic graphs are marked DUMMY. These are IXP Manager's built-in sample graphs. Real graphs appear once you point the statistics backend at your own switches, which is outside the scope of a single VM image.

6

Review the seeded reference data

The build migrates the schema and seeds the upstream reference data, so the application is populated and usable straight away. Count the seeded rows:

sudo mysql -t ixpmanager -e "SELECT 'infrastructure' AS entity, COUNT(*) AS rows_ FROM infrastructure UNION ALL SELECT 'members (cust)', COUNT(*) FROM cust UNION ALL SELECT 'router vendors', COUNT(*) FROM vendor UNION ALL SELECT 'IRRDB sources', COUNT(*) FROM irrdbconfig UNION ALL SELECT 'contact groups', COUNT(*) FROM contact_group UNION ALL SELECT 'users', COUNT(*) FROM user;" ss -tln | grep -E ':(80|3306|11211)\s'

Note that MySQL and memcached listen on the loopback only. Only Apache on port 80 is reachable from off the VM.

The sample member is visible in the portal under Members:

7

Explore the exchange management features

The Infrastructures page defines the physical and logical exchange fabrics your members connect to:

VLANs carry the IXP peering LANs, each with its IPv4 and IPv6 addressing that IXP Manager allocates to member ports:

The peering matrix is the view members use to see who peers with whom across the exchange:

8

Replace the sample IXP identity with your own

The image ships a sample identity so the portal works immediately. Replace it with your exchange's real details in .env. First, view the current values:

sudo grep -E '^IDENTITY_|^APP_NAME' /srv/ixpmanager/.env

Edit the values (site name, legal name, city, country, support and billing contacts, and corporate URL). Then rebuild the configuration cache and reload Apache so the change takes effect:

sudo php /srv/ixpmanager/artisan config:cache
sudo systemctl reload apache2

The exchange entity itself, its ASN and its infrastructures are managed in the portal under IXP Admin Actions, not in .env. Update the seeded EXAMPLE infrastructure and the sample member to match your exchange, or delete them once you have created your own.

9

Put TLS in front of the portal

The image serves plain HTTP on port 80 so it works the moment it boots. IXP Manager handles member data and superuser sessions, so put TLS in front of it before you expose it beyond your management network.

Point a DNS name at the VM, then obtain a certificate and let the client update the Apache virtual host:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d ixp.your-domain.example

Then set APP_URL in /srv/ixpmanager/.env to the https:// name, run sudo php /srv/ixpmanager/artisan config:cache, and reload Apache. Restrict the Network Security Group so that ports 80 and 443 are reachable only from the networks that need the portal.

10

The task scheduler

IXP Manager runs its periodic work through the Laravel scheduler, which the image installs as a system cron entry:

cat /etc/cron.d/ixpmanager

This entry runs artisan schedule:run every minute as www-data, which is what upstream requires. Leave it in place.

11

Administration and upgrades

Run any IXP Manager or Laravel command through artisan:

sudo php /srv/ixpmanager/artisan list --raw | grep '^ixp-manager:'

The application lives in /srv/ixpmanager, its configuration in /srv/ixpmanager/.env, and its logs in /srv/ixpmanager/storage/logs. Back up both the ixpmanager database and the .env file, because the APP_KEY in .env is required to read anything the application has encrypted.

Operating system and Apache, PHP and MySQL packages continue to receive security updates through unattended upgrades. IXP Manager itself is pinned to the release this image shipped; follow the upstream release notes when you choose to move to a newer version.

12

Security recommendations

  • Keep 2FA enrolled on every superuser account. IXP Manager enforces it, so do not disable the enforcement setting.
  • Restrict the Network Security Group so TCP 22 and TCP 80/443 are reachable only from your management networks, and put TLS in front of the portal before wider exposure (Step 9).
  • Treat /root/ixp-manager-credentials.txt as a one-time handover. Record the values in your password manager, then remove the file.
  • Change the superuser password from the generated one after first sign-in, under My Account, and create named accounts for each operator rather than sharing admin.
  • Leave MySQL and memcached bound to the loopback. Nothing outside the VM needs to reach them.
  • Back up the ixpmanager database and /srv/ixpmanager/.env together, and store the backups encrypted.
13

Support and licensing

IXP Manager is free and open source software, published by INEX under the GNU General Public License version 2.0. The licence text ships with the application at /srv/ixpmanager/LICENSE. Upstream project documentation is at docs.ixpmanager.org.

This image is built and maintained by SecureAnyCloud. Support for the image, including deployment questions and security updates, is available 24/7 through the support channel listed on the Azure Marketplace offer page.

Deploy on Azure

Launch IXP Manager 7.3.1 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure