Setting NO-EXPORT BGP Community

A reader of my blog experienced problems setting no-export BGP community. Here’s a quick how-to guide (if you’re new to BGP, you might want to read BGP Communities and BGP and route maps posts first).

The no-export BGP community is defined in RFC 1997: “All routes received carrying a [BGP] communities attribute containing this value MUST NOT be advertised outside a BGP confederation boundary” (i.e. outside our own AS, or across regular EBGP sessions).

If you want to use the no-export community to ensure some of your prefixes are never announced to routers outside of your AS, then the router originating the prefix should set the community with a network route-map or redistribute route-map BGP router configuration command. This design is commonly used in large ISP networks that propagate provider aggregatable customer prefixes in BGP.

If you want to use the no-export community to prevent the upstream AS (your ISP) from propagating a BGP prefix to the rest of the Internet (example: advertising two /25s for traffic engineering purposes), then you MUST NOT set the community with the network or redistribute command – the default filters applied to every EBGP session would never allow such a prefix to be propagated to EBGP peers.

In this case you MUST attach the no-export community to the BGP prefixes you’re advertising with a neighbor route-map command (or neighbor default-originate route-map command – see the comment by Jose Jara) because the route map attached to a BGP neighbor gets executed (and the no-export community attached to BGP prefixes) after the default filters have already been applied.

1 comment:

  1. Ivan,

    I think there is one exception and that would be if we advertise the default-route via neighbor default-originate. In that case, if we set the community no-export in the route-map that we are going to apply outbound towards the neighbor, this will have no effect in the default route because it does not pass by Adj-Rib-Out ( http://blog.ioshints.info/2007/11/bgp-default-route.html ).

    The solution would be to set the community in the route-map applied after the default-originate command: neighbor default-originate route-map NO-EXPORT.

    By the way, there is no need to do a soft/hard reset after applying this route-map as it does not pass through BGP output filters.

    Jose.

    ReplyDelete

You don't have to log in to post a comment, but please do provide your real name/URL. Anonymous comments might get deleted.

Ivan Pepelnjak, CCIE#1354, is the chief technology advisor for NIL Data Communications. He has been designing and implementing large-scale data communications networks as well as teaching and writing books about advanced technologies since 1990. See his full profile, contact him or follow @ioshints on Twitter.