What are BGP communities, and what do the well-known communities do?
Show the answer
Say this first
A community is a 32-bit tag, written ASN:value such as 64500:120, attached to routes so policy elsewhere can
match on it. Standard communities are optional transitive (RFC 1997). The well-known ones: NO_EXPORT (do not
advertise outside this AS or confederation), NO_ADVERTISE (do not advertise to any peer), NO_EXPORT_SUBCONFED,
which Cisco calls local-AS (do not advertise outside this sub-AS), and Cisco's internet keyword, which means
advertise normally. Cisco only sends communities if you add neighbor x send-community.
Go deeper
Well-known values
| Name | Value | Effect |
|---|---|---|
| NO_EXPORT | 65535:65281 | Stay inside the AS (a confederation counts as one AS) |
| NO_ADVERTISE | 65535:65282 | Do not advertise to any BGP peer |
| NO_EXPORT_SUBCONFED (local-AS) | 65535:65283 | Stay inside the sub-AS |
| BLACKHOLE | 65535:666 | Ask the neighbor to drop traffic to this prefix (RFC 7999) |
| GRACEFUL_SHUTDOWN | 65535:0 | Lower preference before maintenance (RFC 8326) |
How providers use them
Providers publish their own sets, for example 64496:70 to set local preference 70 (backup), a value to prepend toward certain peers, or 64496:666 to blackhole a prefix under attack. The customer tags, the provider's import policy acts. Customer side:
ip bgp-community new-format
!
route-map TO-ISP1 permit 10
match ip address prefix-list OUR-PREFIXES
set community 64496:70
!
router bgp 64500
neighbor 192.0.2.1 send-community
neighbor 192.0.2.1 route-map TO-ISP1 outProvider side:
ip community-list standard CUST-BACKUP permit 64496:70
!
route-map FROM-CUST-64500 permit 10
match community CUST-BACKUP
set local-preference 70Other community types
- Extended (8 bytes, RFC 4360): route targets and site of origin in MPLS VPNs.
send-community extendedorsend-community both. - Large (12 bytes, RFC 8092):
ASN:value:value, made because a 4-byte ASN does not fit in a standard community.
ip bgp-community new-format makes IOS display communities as ASN:value instead of one 32-bit number.
They will ask next
What is the difference between set community and set community additive?
set community 64496:70replaces every community on the route.set community 64496:70 additiveadds it to the ones already there. Forgettingadditivesilently wipes tags other teams depend on.When would you attach NO_EXPORT?
When you announce more specific routes to one provider for traffic engineering and want them to stay inside that provider, while the aggregate goes to the whole internet.
Traps
- Forgetting
send-communityon IOS and wondering why the provider ignores your tags. - Mixing up NO_EXPORT (stays in the AS) and NO_ADVERTISE (goes to no peer at all).