BGP Communities

Communities in BGP is kind of like peer groups, but for routes. It allows for the grouping of routes that share same characteristics and that needs to be treated the same throughout the network. There are well-known BGP communities that may instruct a router treat the routes a certain way, but you can also make up your own community and do with it as you will.

These are the well-known communities and what they instruct a router to do:

• none: strip any community that may currently be applied to a route (leaving it with no community set)
• no-export: do not advertise the route to an eBGP peer
• no-advertise: do not advertise the route to any peer
• local-AS: keep the route contained within a confederation subAS
• internet: advertise route to all peers

Going through the list the community none is actually not a community, but more a means of stripping any current setting off an incoming or outgoing route - the route is not marked with community of none.

According to the RFC (RFC 1997), there is only three well-known communites: no_export, no_advertise and no_export_subconfed. The latter is the community, known in Cisco-speak, as the local-as. The internet community, however, is not a "real" community - it is used much like the any keyword in ip access-lists. This is what is stated in RFC 1997 regarding the internet community:

By default, all destinations belong to the general Internet community.

So, we are indeed left with only three actual well-known communities.

Below is the topology used to showcase a few uses of BGP communities.

BGP Communities Network Topology

To allow the use of communities, a router must first set the send-community parameter for the specific neighbor, it wishes to advertise communities to. Then, a router somewhere will have to actually set the community value for specific routes.

In the following example, I will have R6 and R7 add the no-export community string to 10.1.6.0 /24 and 10.1.66.0 /24 networks and the no-advertise to the 10.1.7.0 /24 and 10.1.77.0 /24 networks. Then we see how far the routes goes through the BGP network.

This is the configuration on routers R6 and R7 (the configuration is shown on R6 and it is only slightly different from that on R7).

R6#configure terminal
R6(config)#ip prefix-list PFX_R6_PREFIXES seq 5 permit 10.1.6.0/24
R6(config)#ip prefix-list PFX_R6_PREFIXES seq 10 permit 10.1.66.0/24
R6(config)#ip prefix-list PFX_R7_PREFIXES seq 5 permit 10.1.7.0/24
R6(config)#ip prefix-list PFX_R7_PREFIXES seq 10 permit 10.1.77.0/24
R6(config)#!
R6(config)#route-map RMAP_COMMUNITIES permit 10
R6(config-route-map)#match ip address prefix-list PFX_R6_PREFIXES
R6(config-route-map)#set community no-export
R6(config-route-map)#route-map RMAP_COMMUNITIES permit 20
R6(config-route-map)#match ip address prefix-list PFX_R7_PREFIXES
R6(config-route-map)#set community no-advertise
R6(config-route-map)#route-map RMAP_COMMUNITIES permit 99
R6(config-route-map)#exit
R6(config)#!
R6(config)#router bgp 67
R6(config-router)#neighbor 10.0.16.1 send-community
R6(config-router)#redistribute connected route-map RMAP_COMMUNITIES
R6(config-router)#end
R6#clear ip bgp * out

The things that differ between R6 and R7, is that R6 uses the route-map to apply the communities when doing redistribution of the connected routes into BGP - this means it will apply to any future BGP peers with the send-community enabled - whereas R7 applies the route-map to the specific neighbor of R1 in the outbound direction. This is done with the command command neighbor 10.0.17.1 route-map RMAP_COMMUNITIES out under the BGP router process.

Lets verify on R1, that the routes received have the proper community set. If done properly, the routes matched with the prefix-list PFX_R6_PREFIXES should be no-export and the PFX_R7_PREFIXES should be no-advertise.

R1#show ip bgp community no-export
BGP table version is 11, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.6.0/24      10.0.17.7                0             0 67 ?
 *>  10.1.66.0/24     10.0.17.7                0             0 67 ?
R1#show ip bgp community no-advertise
BGP table version is 11, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.7.0/24      10.0.17.7                0             0 67 ?
 *>  10.1.77.0/24     10.0.17.7                0             0 67 ?

It seems like some routes from R6 might be missing here. Let have a look at what we receive from R6.

R1#show ip bgp neighbors 10.0.16.6 routes
Total number of prefixes 0

Nothing. Lets look at what is advertised on from R6.

R6#show ip bgp neighbors 10.0.16.1 advertised-routes
Total number of prefixes 0

Again, nothing. Now is the time to check the config for any typos or missing portions. Well, it turns out that everything is configured with no typos or missing portions - and the router is doing exactly as instructed.

R6#show ip bgp community no-advertise
BGP table version is 9, local router ID is 6.6.6.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.7.0/24      0.0.0.0                  0         32768 ?
 *>  10.1.77.0/24     0.0.0.0                  0         32768 ?
R6#show ip bgp community no-export
BGP table version is 9, local router ID is 6.6.6.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.6.0/24      0.0.0.0                  0         32768 ?
 *>  10.1.66.0/24     0.0.0.0                  0         32768 ?

The problem here is that the community is set, when the routes are entered into the BGP table and this makes BGP honor the community by not advertising them to R1 - as instructed. Lets just change the config on R6 to match that of R7.

R6#configure terminal
R6(config)#router bgp 67
R6(config-router)#no redistribute connected route-map RMAP_COMMUNITIES
R6(config-router)#redistribute connected route-map RMAP_BGP_REDIST_CONN
R6(config-router)#neighbor 10.0.16.1 route-map RMAP_COMMUNITIES out
R6(config-router)#end
R6#clear ip bgp * out

Now lets have look at R1 again.

R1#show ip bgp community no-advertise
BGP table version is 17, local router ID is 1.1.1.1
<output omitted>
     Network          Next Hop            Metric LocPrf Weight Path
 *   10.1.7.0/24      10.0.16.6                0             0 67 ?
 *>                         10.0.17.7                0             0 67 ?
 *   10.1.77.0/24    10.0.16.6                0             0 67 ?
 *>                         10.0.17.7                0             0 67 ?
R1#show ip bgp community no-export
BGP table version is 17, local router ID is 1.1.1.1
<output omitted>
     Network          Next Hop            Metric LocPrf Weight Path
 *   10.1.6.0/24      10.0.16.6                0             0 67 ?
 *>                         10.0.17.7                0             0 67 ?
 *   10.1.66.0/24    10.0.16.6                0             0 67 ?
 *>                         10.0.17.7                0             0 67 ?

Now we see two entries for each prefix - which we should as there are two routers (R6 and R7) that advertise the networks.

This issue would also have been encountered if the network statement had been used instead of the redistribution of connected routes. The example I tested in my lab had the following configuration done on R6 instead of the redistribution configuration from earlier.

R6(config)#route-map RMAP_COMMUNITY_NO_ADVERTISE
R6(config-route-map)#set community no-ad
R6(config-route-map)#set community no-advertise
R6(config-route-map)#route-map RMAP_COMMUNITY_NO_EXPORT
R6(config-route-map)#set community no-export
R6(config-route-map)#exit
R6(config)#router bgp 67
R6(config-router)#network 10.1.6.0 mask 255.255.255.0 route-map RMAP_COMMUNITY_NO_EXPORT
R6(config-router)#network 10.1.66.0 mask 255.255.255.0 route-map RMAP_COMMUNITY_NO_EXPORT
R6(config-router)#network 10.1.7.0 mask 255.255.255.0 route-map RMAP_COMMUNITY_NO_ADVERTISE
R6(config-router)#network 10.1.77.0 mask 255.255.255.0 route-map RMAP_COMMUNITY_NO_ADVERTISE

Again, the result here would be the same as the redistribution - the community would be set before the routes enter into R6s BGP table and R6 would do as instructed and not advertise the routes to R1.

Now on the configuration on R1. We want the networks from AS 67 to be treated with the community that that is set by R6 and R7, so we will have to send the community along to our iBGP peers R2 and R3.
R1#configure terminal
R1(config)#router bgp 123
R1(config-router)#neighbor PGROUP_AS_123 send-community
This will have to be done on R2 and R3 as well to ensure the community is sent between all peers in AS 123.

Now we should see all four subnets in R1s BGP table, two subnets in the BGP tables of routers R2 and R3 and finally we should not see the subnets in the BGP tables of R4 and R5 at all.

R1#show ip bgp | begin Network
     Network          Next Hop            Metric LocPrf Weight Path
 *>i 10.1.4.0/24      10.0.24.4                0    100      0 4 i
 *>i 10.1.5.0/24      10.0.35.5                0    100      0 5 i
 *   10.1.6.0/24       10.0.16.6                0             0 67 ?
 *>                          10.0.17.7                0             0 67 ?
 *   10.1.7.0/24       10.0.16.6                0             0 67 ?
 *>                          10.0.17.7                0             0 67 ?
 *>i 10.1.44.0/24    10.0.24.4                0    100      0 4 i
 *>i 10.1.55.0/24    10.0.35.5                0    100      0 5 i
 *   10.1.66.0/24     10.0.16.6                0             0 67 ?
 *>                          10.0.17.7                0             0 67 ?
 *   10.1.77.0/24     10.0.16.6                0             0 67 ?
 *>                          10.0.17.7                0             0 67 ?

R2#show ip bgp | begin Network
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.4.0/24      10.0.24.4                0             0 4 i
 *>i 10.1.5.0/24      10.0.35.5                0    100      0 5 i
 *>i 10.1.6.0/24      10.0.17.7                0    100      0 67 ?
 *>  10.1.44.0/24    10.0.24.4                0             0 4 i
 *>i 10.1.55.0/24    10.0.35.5                0    100      0 5 i
 *>i 10.1.66.0/24    10.0.17.7                0    100      0 67 ?

R3#show ip bgp | begin Network
     Network          Next Hop            Metric LocPrf Weight Path
 *>i 10.1.4.0/24      10.0.24.4                0    100      0 4 i
 *>  10.1.5.0/24      10.0.35.5                0             0 5 i
 *>i 10.1.6.0/24      10.0.17.7                0    100      0 67 ?
 *>i 10.1.44.0/24    10.0.24.4                0    100      0 4 i
 *>  10.1.55.0/24    10.0.35.5                0             0 5 i
 *>i 10.1.66.0/24    10.0.17.7                0    100      0 67 ?

R4#show ip bgp | begin Network
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.4.0/24      0.0.0.0                  0         32768 i
 *>  10.1.5.0/24      10.0.24.2                              0 123 5 i
 *>  10.1.44.0/24    0.0.0.0                  0         32768 i
 *>  10.1.55.0/24    10.0.24.2                              0 123 5 i

R5#show ip bgp | begin Network
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.4.0/24      10.0.35.3                              0 123 4 i
 *>  10.1.5.0/24      0.0.0.0                  0         32768 i
 *>  10.1.44.0/24    10.0.35.3                              0 123 4 i
 *>  10.1.55.0/24    0.0.0.0                  0         32768 i

And, just as expected, the routes 10.1.6.0 /24 and 10.1.66.0 /24 are sent from R1 to R2 and R3, but the routes 10.1.7.0 /24 and 10.1.77.0 /24 are not advertised beyond R1. The routers R4 and R5 receive none of the routes originating from AS 67 from any of their peers.

Lets say we want to undo the no-export set by the administrators of AS 67. We can do this on R2 to remove the no-export community from routes received from R1 and that should allow R2 to advertise two subnets (10.1.6.0 /24 and 10.1.66.0 /24) to R4.

R2(config)#ip community-list expanded CML_NO_EXPORT permit no-export
R2(config)#route-map RMAP_CLEAR_NO_EXPORT
R2(config-route-map)#match community CML_NO_EXPORT
R2(config-route-map)#set community none
R2(config-route-map)#exit
R2(config)#router bgp 123
R2(config-router)#neighbor 1.1.1.1 route-map RMAP_CLEAR_NO_EXPORT in
R2(config-router)#end
R2#clear ip bgp 1.1.1.1 in

The configuration uses a route-map to match the community "no-export" and set it to none and this is applied inbound for the peer 1.1.1.1 (R1). The BGP table on R4 should tell us whether it works or not.

R4#show ip bgp | begin Network
     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.1.4.0/24       0.0.0.0                  0         32768 i
 *>  10.1.5.0/24       10.0.24.2                              0 123 5 i
 *>  10.1.6.0/24       10.0.24.2                              0 123 67 ? *>  10.1.44.0/24     0.0.0.0                  0         32768 i
 *>  10.1.55.0/24     10.0.24.2                              0 123 5 i
 *>  10.1.66.0/24     10.0.24.2                              0 123 67 ?

The routes are in the BGP table because R2 strips the no-export community from those routes allowing R2 to advertise the routes to R4.

Community lists are much like access-lists as they have standard and extended (expanded), where the expanded will allow for the use of regular expressions. For my own sake, I think I will have to do a post on using regular expressions at some point in the near future.