Routing Policies for BGP Communities
Understanding BGP Communities, Extended Communities, and Large Communities as Routing Policy Match Conditions
A BGP community is a group of destinations that share a common property. Community information is included as a path attribute in BGP update messages. This information identifies community members and enables you to perform actions on a group without having to elaborate upon each member. You can use community and extended communities attributes to trigger routing decisions, such as acceptance, rejection, preference, or redistribution.
You can assign community tags to non-BGP routes through configuration (for static, aggregate, or generated routes) or an import routing policy. These tags can then be matched when BGP exports the routes.
A community value is a 32-bit field that is divided into two
main sections. The first 16 bits of the value encode the AS number
of the network that originated the community, while the last 16 bits
carry a unique number assigned by the AS. This system attempts to
guarantee a globally unique set of community values for each AS in
the Internet. Junos OS uses a notation of as-number:community-value, where each value is
a decimal number. The AS values of 0 and 65,535 are reserved, as are
all of the community values within those AS numbers. Each community,
or set of communities, is given a name within the [edit policy-options] configuration hierarchy. The name of the community uniquely identifies
it to the routing device and serves as the method by which routes
are categorized. For example, a route with a community value of 64510:1111
might belong to the community named AS64510-routes. The
community name is also used within a routing policy as a match criterion
or as an action. The command syntax for creating a community is: policy-options community name members [community-ids]. The community-ids are either
a single community value or multiple community values. When more than
one value is assigned to a community name, the routing device interprets
this as a logical AND of the community values. In other words, a route
must have all of the configured values before being assigned the community
name.
The regular community attribute is four octets. Networking enhancements, such as VPNs, have functionality requirements that can be satisfied by an attribute such as a community. However, the 4-octet community value does not provide enough expansion and flexibility to accommodate VPN requirements. This leads to the creation of extended communities. An extended community is an 8-octet value that is also divided into two main sections. The first 2 octets of the community encode a type field while the last 6 octets carry a unique set of data in a format defined by the type field. Extended communities provide a larger range for grouping or categorizing communities.
The BGP extended communities attribute format has three fields: type:administrator:assigned-number. The routing device expects you
to use the words target or origin to represent
the type field. The administrator field uses a decimal number for
the AS or an IPv4 address, while the assigned number field expects
a decimal number no larger than the size of the field (65,535 for
2 octets or 4,294,967,295 for 4 octets).
When specifying community IDs for standard and extended community
attributes, you can use UNIX-style regular expressions. The only exception
is for VPN import policies (vrf-import), which do not support
regular expressions for the extended communities attribute.
Regular BGP communities attributes are a variable length attribute
consisting of a set of one or more 4-byte values that was split into
16 bit values. The most significant word is interpreted as an AS number
and least significant word is a locally defined value assigned by
the operator of the AS. Since the adoption of 4-byte ASNs, the 4-byte
BGP regular community and 6-byte BGP extended community can no longer
support BGP community attributes. Operators often encode AS number
in the local portion of the BGP community that means that sometimes
the format of the community is ASN:ASN. With the 4-byte ASN , you
need 8-bytes to encode it. Although BGP extended community permits
a 4-byte AS to be encoded as the global administrator field, the local
administrator field has only 2-byte of available space. Thus, 6-byte
extended community attribute is also unsuitable. To overcome this,
Junos OS allows you to configure optional transitive path attribute
- a 12-byte BGP large community that provides the most significant
4-byte value to encode autonomous system number as the global administrator
and the remaining two 4-byte assigned numbers to encode the local
values as defined in RFC 8092. You can configure BGP large community
at the [edit policy-options community community-name members] and [edit routing-options static route ip-address community] hierarchy levels. The BGP
large community attributes format has four fields: large:global administrator:assigned
number:assigned number.
The BGP IPv6 unicast address specific extended community are encoded as a set of 20-bytes value. The 20-byte value gets interpreted in the following format:
-
Most significant 2-bytes encodes the Type and Sub-Type value (high value (most significant byte) and Low value (second most significant byte)).
-
Next 16-bytes encodes the IPv6 unicast address. It is the global administrator in the IETF RFC.
-
Last 2-bytes encodes the operator defined local values. It is local administrator in the IETF RFC.
The IPv6 unicast address specific BGP extended community attributes are represented by a
keyword ipv6-target, ipv6-origin, or
ipv6-extended followed by IPv6 and local administrator separated by
<, >, and :.
The length of the BGP large communities attribute value should be a non-zero multiple of 12.
See Also
Example: Configuring a Routing Policy to Redistribute BGP Routes with a Specific Community Tag into IS-IS
This example defines a policy that takes BGP
routes from the Edu community and places them into IS-IS
with a metric of 63.
Requirements
No special configuration beyond device initialization is required before configuring this example.
Overview
Figure 1 shows the topology used in this example.
In this example, Device A, Device B, Device C, and Device D are in autonomous system (AS) 1 and are running IS-IS. All of the AS 1 devices, except Device D, are running internal BGP (IBGP).
Device E is in AS 2 and has an external BGP (EBGP) peering session with Device C. Device E has two static routes, 10.2.0.0/16 and 10.3.0.0/16. These routes are tagged with the Edu 2:5 community attribute and are advertised by way of EBGP to Device C.
Device C accepts the BGP routes that are tagged with the Edu 2:5 community attribute, redistributes the routes into IS-IS, and applies an IS-IS metric of 63 to these routes.
CLI Quick Configuration shows the configuration for all of the devices in Figure 1. The section #d206e62__d206e383 describes the steps on Device C and Device E.
Configuration
Procedure
CLI Quick Configuration
To quickly configure
this example, copy the following commands, paste them into a text
file, remove any line breaks, change any details necessary to match
your network configuration, and then copy and paste the commands into
the CLI at the [edit] hierarchy level.
Device A
set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.5/30 set interfaces fe-1/2/0 unit 0 family iso set interfaces lo0 unit 0 family inet address 192.168.0.1/32 set interfaces lo0 unit 0 family iso address 49.0002.0192.0168.0001.00 set protocols bgp group int type internal set protocols bgp group int local-address 192.168.0.1 set protocols bgp group int neighbor 192.168.0.2 set protocols bgp group int neighbor 192.168.0.3 set protocols isis interface fe-1/2/0.0 level 1 disable set protocols isis interface lo0.0 set routing-options router-id 192.168.0.1 set routing-options autonomous-system 1
Device B
set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.6/30 set interfaces fe-1/2/0 unit 0 family iso set interfaces fe-1/2/1 unit 0 family inet address 10.0.0.9/30 set interfaces fe-1/2/1 unit 0 family iso set interfaces lo0 unit 0 family inet address 192.168.0.2/32 set interfaces lo0 unit 0 family iso address 49.0002.0192.0168.0002.00 set protocols bgp group int type internal set protocols bgp group int local-address 192.168.0.2 set protocols bgp group int neighbor 192.168.0.1 set protocols bgp group int neighbor 192.168.0.3 set protocols isis interface fe-1/2/0.0 level 1 disable set protocols isis interface fe-1/2/1.0 level 1 disable set protocols isis interface lo0.0 set routing-options router-id 192.168.0.2 set routing-options autonomous-system 1
Device C
set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.10/30 set interfaces fe-1/2/0 unit 0 family iso set interfaces fe-1/2/1 unit 0 family inet address 10.0.0.13/30 set interfaces fe-1/2/1 unit 0 family iso set interfaces fe-1/2/2 unit 0 family inet address 10.0.0.25/30 set interfaces fe-1/2/2 unit 0 family iso set interfaces lo0 unit 0 family inet address 192.168.0.3/32 set interfaces lo0 unit 0 family iso address 49.0002.0192.0168.0003.00 set protocols bgp group int type internal set protocols bgp group int local-address 192.168.0.3 set protocols bgp group int neighbor 192.168.0.1 set protocols bgp group int neighbor 192.168.0.2 set protocols bgp group external-peers type external set protocols bgp group external-peers export send-isis-and-direct set protocols bgp group external-peers peer-as 2 set protocols bgp group external-peers neighbor 10.0.0.26 set protocols isis export Edu-to-isis set protocols isis interface fe-1/2/0.0 level 1 disable set protocols isis interface fe-1/2/1.0 level 1 disable set protocols isis interface fe-1/2/2.0 level 1 disable set protocols isis interface fe-1/2/2.0 level 2 passive set protocols isis interface lo0.0 set policy-options policy-statement Edu-to-isis term 1 from protocol bgp set policy-options policy-statement Edu-to-isis term 1 from community Edu set policy-options policy-statement Edu-to-isis term 1 then metric 63 set policy-options policy-statement Edu-to-isis term 1 then accept set policy-options policy-statement send-isis-and-direct term 1 from protocol isis set policy-options policy-statement send-isis-and-direct term 1 from protocol direct set policy-options policy-statement send-isis-and-direct term 1 from route-filter 10.0.0.0/16 orlonger set policy-options policy-statement send-isis-and-direct term 1 from route-filter 192.168.0.0/16 orlonger set policy-options policy-statement send-isis-and-direct term 1 then accept set policy-options community Edu members 2:5 set routing-options router-id 192.168.0.3 set routing-options autonomous-system 1
Device D
set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.14/30 set interfaces fe-1/2/0 unit 0 family iso set interfaces lo0 unit 0 family inet address 192.168.0.4/32 set interfaces lo0 unit 0 family iso address 49.0002.0192.0168.0004.00 set protocols isis interface fe-1/2/0.0 level 1 disable set protocols isis interface lo0.0 set routing-options router-id 192.168.0.4 set routing-options autonomous-system 1
Device E
set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.26/30 set interfaces lo0 unit 7 family inet address 192.168.0.5/32 primary set interfaces lo0 unit 7 family inet address 10.2.0.1/32 set interfaces lo0 unit 7 family inet address 10.3.0.1/32 set protocols bgp group external-peers type external set protocols bgp group external-peers export statics set protocols bgp group external-peers peer-as 1 set protocols bgp group external-peers neighbor 10.0.0.25 set policy-options policy-statement statics from protocol static set policy-options policy-statement statics then community add Edu set policy-options policy-statement statics then accept set policy-options community Edu members 2:5 set routing-options static route 10.2.0.0/16 reject set routing-options static route 10.2.0.0/16 install set routing-options static route 10.3.0.0/16 reject set routing-options static route 10.3.0.0/16 install set routing-options router-id 192.168.0.5 set routing-options autonomous-system 2
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure Device E:
Configure the interfaces.
[edit interfaces] user@E# set fe-1/2/0 unit 0 family inet address 10.0.0.26/30 user@E# set lo0 unit 7 family inet address 192.168.0.5/32 primary user@E# set lo0 unit 7 family inet address 10.2.0.1/32 user@E# set lo0 unit 7 family inet address 10.3.0.1/32
Configure the
staticspolicy, which adds theEducommunity attribute to the static routes.[edit policy-options] user@E# set policy-statement statics from protocol static user@E# set policy-statement statics then community add Edu user@E# set policy-statement statics then accept user@E# set community Edu members 2:5
Configure EBGP and apply the
staticspolicy.[edit protocols bgp group external-peers] user@E# set type external user@E# set export statics user@E# set peer-as 1 user@E# set protocols bgp group external-peers neighbor 10.0.0.25
Configure the static routes.
[edit routing-options static] user@E# set route 10.2.0.0/16 reject user@E# set route 10.2.0.0/16 install user@E# set route 10.3.0.0/16 reject user@E# set route 10.3.0.0/16 install
Configure the router ID and the AS number.
[edit routing-options] user@E# set router-id 192.168.0.5 user@E# set autonomous-system 2
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure Device C:
Configure the interfaces.
[edit interfaces] user@C# set fe-1/2/0 unit 0 family inet address 10.0.0.10/30 user@C# set fe-1/2/0 unit 0 family iso user@C# set fe-1/2/1 unit 0 family inet address 10.0.0.13/30 user@C# set fe-1/2/1 unit 0 family iso user@C# set fe-1/2/2 unit 0 family inet address 10.0.0.25/30 user@C# set fe-1/2/2 unit 0 family iso user@C# set lo0 unit 0 family inet address 192.168.0.3/32 user@C# set lo0 unit 0 family iso address 49.0002.0192.0168.0003.00
Configure IBGP.
[edit protocols bgp group int] user@C# set type internal user@C# set local-address 192.168.0.3 user@C# set neighbor 192.168.0.1 user@C# set neighbor 192.168.0.2
Configure the Edu-to-isis policy, which redistributes the Edu-tagged BGP routes learned from Device E and applies a metric of 63.
[edit policy-options] user@C# set policy-statement Edu-to-isis term 1 from protocol bgp user@C# set policy-statement Edu-to-isis term 1 from community Edu user@C# set policy-statement Edu-to-isis term 1 then metric 63 user@C# set policy-statement Edu-to-isis term 1 then accept user@C# set community Edu members 2:5
Enable IS-IS on the interfaces, and apply the Edu-to-isis policy.
[edit protocols isis] user@C# set export Edu-to-isis user@C# set interface fe-1/2/0.0 level 1 disable user@C# set interface fe-1/2/1.0 level 1 disable user@C# set interface fe-1/2/2.0 level 1 disable user@C# set interface fe-1/2/2.0 level 2 passive user@C# set interface lo0.0
Configure the send-isis-and-direct policy, which redistributes routes to Device E, through EBGP.
Without this policy, Device E would not have connectivity to the networks in AS 1.
[edit policy-options policy-statement send-isis-and-direct term 1] user@C# set from protocol isis user@C# set from protocol direct user@C# set from route-filter 10.0.0.0/16 orlonger user@C# set from route-filter 192.168.0.0/16 orlonger user@C# set then accept
Configure EBGP and apply the send-isis-and-direct policy.
[edit protocols bgp group external-peers] user@C# set type external user@C# set export send-isis-and-direct user@C# set peer-as 2 user@C# set neighbor 10.0.0.26
Configure the router ID and the autonomous system (AS) number.
[edit routing-options] user@C# set router-id 192.168.0.3 user@C# set autonomous-system 1
Results
From configuration mode, confirm your configuration
by entering the show interfaces, show protocols, show policy-options, and show routing-options commands. If the output does not display the intended configuration,
repeat the instructions in this example to correct the configuration.
Device E
user@E# show interfaces
fe-1/2/0 {
unit 0 {
family inet {
address 10.0.0.26/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 192.168.0.5/32 {
primary;
}
address 10.2.0.1/32;
address 10.3.0.1/32;
}
}
}
user@E# show protocols
bgp {
group external-peers {
type external;
export statics;
peer-as 1;
neighbor 10.0.0.25;
}
}
user@E# show policy-options
policy-statement statics {
from protocol static;
then {
community add Edu;
accept;
}
}
community Edu members 2:5;
user@E# show routing-options
static {
route 10.2.0.0/16 {
reject;
install;
}
route 10.3.0.0/16 {
reject;
install;
}
}
router-id 192.168.0.5;
autonomous-system 2;
Device C
user@C# show interfaces
fe-1/2/0 {
unit 0 {
family inet {
address 10.0.0.10/30;
}
family iso;
}
}
fe-1/2/1 {
unit 0 {
family inet {
address 10.0.0.13/30;
}
family iso;
}
}
fe-1/2/2 {
unit 0 {
family inet {
address 10.0.0.25/30;
}
family iso;
}
}
lo0 {
unit 0 {
family inet {
address 192.168.0.3/32;
}
family iso {
address 49.0002.0192.0168.0003.00;
}
}
}
user@C# show protocols
bgp {
group int {
type internal;
local-address 192.168.0.3;
neighbor 192.168.0.1;
neighbor 192.168.0.2;
}
group external-peers {
type external;
export send-isis-and-direct;
peer-as 2;
neighbor 10.0.0.26;
}
}
isis {
export Edu-to-isis;
interface fe-1/2/0.0 {
level 1 disable;
}
interface fe-1/2/1.0 {
level 1 disable;
}
interface fe-1/2/2.0 {
level 1 disable;
level 2 passive;
}
interface lo0.0;
}
user@C# show policy-options
policy-statement Edu-to-isis {
term 1 {
from {
protocol bgp;
community Edu;
}
then {
metric 63;
accept;
}
}
}
policy-statement send-isis-and-direct {
term 1 {
from {
protocol [ isis direct ];
route-filter 10.0.0.0/16 orlonger;
route-filter 192.168.0.0/16 orlonger;
}
then accept;
}
}
community Edu members 2:5;
user@C# show routing-options
router-id 192.168.0.3;
autonomous-system 1;
If you are done configuring the device, enter commit from configuration mode.
Verification
Confirm that the configuration is working properly.
Verifying the IS-IS Neighbor
Purpose
Verify that the BGP routes from Device E are communicated on the IS-IS network in AS 1.
Action
From operational mode, enter the show route protocol
isis command.
user@D> show route protocol isis
inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
10.0.0.4/30 *[IS-IS/18] 22:30:53, metric 30
> to 10.0.0.13 via fe-1/2/0.0
10.0.0.8/30 *[IS-IS/18] 22:30:53, metric 20
> to 10.0.0.13 via fe-1/2/0.0
10.0.0.24/30 *[IS-IS/18] 03:31:21, metric 20
> to 10.0.0.13 via fe-1/2/0.0
10.2.0.0/16 *[IS-IS/165] 02:36:31, metric 73
> to 10.0.0.13 via fe-1/2/0.0
10.3.0.0/16 *[IS-IS/165] 02:36:31, metric 73
> to 10.0.0.13 via fe-1/2/0.0
192.168.0.1/32 *[IS-IS/18] 03:40:28, metric 30
> to 10.0.0.13 via fe-1/2/0.0
192.168.0.2/32 *[IS-IS/18] 22:30:53, metric 20
> to 10.0.0.13 via fe-1/2/0.0
192.168.0.3/32 *[IS-IS/18] 22:30:53, metric 10
> to 10.0.0.13 via fe-1/2/0.0
iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)Meaning
As expected, the 10.2.0.0/16 and 10.3.0.0/16 routes are in Device D’s routing table as IS-IS external routes with a metric of 73. If Device C had not added 63 to the metric, Device D would have a metric of 10 for these routes.
Example: Configuring a Routing Policy That Removes BGP Communities
This example shows how to create a policy that accepts BGP routes, but removes BGP communities from the routes.
Requirements
No special configuration beyond device initialization is required before you configure this example.
Overview
This example shows two routing devices with an external BGP (EBGP) connection between them. Device R2 uses the BGP session to send two static routes to Device R1. On Device R1, an import policy specifies that all BGP communities must be removed from the routes.
By default, when communities are configured on EBGP peers, they
are sent and accepted. To suppress the acceptance of communities received
from a neighbor, you can remove all communities or a specified set
of communities. When the result of a policy is an empty set of communities,
the community attribute is not included. To remove all communities,
first define a wildcard set of communities (here, the community is
named wild):
[edit policy-options] community wild members "* : *";
Then, in the routing policy statement, specify the community
delete action:
[edit policy-options] policy-statement policy-name { term term-name { then community delete wild; } }
To suppress a particular community from any autonomous system
(AS), define the community as community wild members "*:community-value".
Configuration
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
and then copy and paste the commands into the CLI at the [edit] hierarchy level.
Device R1
set interfaces fe-1/1/0 unit 0 description to-R2 set interfaces fe-1/1/0 unit 0 family inet address 10.0.0.1/30 set interfaces lo0 unit 0 family inet address 192.168.0.1/32 set protocols bgp group external-peers type external set protocols bgp group external-peers peer-as 2 set protocols bgp group external-peers neighbor 10.0.0.2 import remove-communities set policy-options policy-statement remove-communities term 1 from protocol bgp set policy-options policy-statement remove-communities term 1 then community delete wild set policy-options policy-statement remove-communities term 1 then accept set policy-options policy-statement remove-communities term 2 then reject set policy-options community wild members *:* set routing-options router-id 192.168.0.1 set routing-options autonomous-system 1
Device R2
set interfaces fe-1/1/0 unit 0 description to-R1 set interfaces fe-1/1/0 unit 0 family inet address 10.0.0.2/30 set interfaces lo0 unit 0 family inet address 192.168.0.2/32 set protocols bgp group external-peers type external set protocols bgp group external-peers export statics set protocols bgp group external-peers peer-as 1 set protocols bgp group external-peers neighbor 10.0.0.1 set policy-options policy-statement statics from protocol static set policy-options policy-statement statics then community add 1 set policy-options policy-statement statics then accept set policy-options community 1 members 2:1 set policy-options community 1 members 2:2 set policy-options community 1 members 2:3 set policy-options community 1 members 2:4 set policy-options community 1 members 2:5 set policy-options community 1 members 2:6 set policy-options community 1 members 2:7 set policy-options community 1 members 2:8 set policy-options community 1 members 2:9 set policy-options community 1 members 2:10 set routing-options static route 10.2.0.0/16 reject set routing-options static route 10.2.0.0/16 install set routing-options static route 10.3.0.0/16 reject set routing-options static route 10.3.0.0/16 install set routing-options router-id 192.168.0.3 set routing-options autonomous-system 2
Procedure
Step-by-Step Procedure
The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
To configure Device R1:
Configure the interfaces.
[edit interfaces] user@R1# set fe-1/1/0 unit 0 description to-R2 user@R1# set fe-1/1/0 unit 0 family inet address 10.0.0.1/30 user@R1# set lo0 unit 0 family inet address 192.168.0.1/32
Configure BGP.
Apply the import policy to the BGP peering session with Device R2.
[edit protocols bgp group external-peers] user@R1# set type external user@R1# set peer-as 2 user@R1# set neighbor 10.0.0.2 import remove-communities
Configure the routing policy that deletes communities.
[edit policy-options policy-statement remove-communities] user@R1# set term 1 from protocol bgp user@R1# set term 1 then community delete wild user@R1# set term 1 then accept user@R1# set term 2 then reject
Configure the autonomous system (AS) number and the router ID.
[edit routing-options ] user@R1# set router-id 192.168.0.1 user@R1# set autonomous-system 1
Step-by-Step Procedure
The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
To configure Device R2:
Configure the interfaces.
[edit interfaces] user@R2# set fe-1/1/0 unit 0 description to-R1 user@R2# set fe-1/1/0 unit 0 family inet address 10.0.0.2/30 user@R2# set lo0 unit 0 family inet address 192.168.0.2/32
Configure the router ID and the autonomous system (AS) number.
[edit routing-options] user@R2# set router-id 192.168.0.3 user@R2# set autonomous-system 2
Configure BGP.
[edit protocols bgp group external-peers] user@R2# set type external user@R2# set peer-as 1 user@R2# set neighbor 10.0.0.1
Configure multiple communities, or configure a single community with multiple members.
[edit policy-options community 1] user@R2# set members 2:1 user@R2# set members 2:2 user@R2# set members 2:3 user@R2# set members 2:4 user@R2# set members 2:5 user@R2# set members 2:6 user@R2# set members 2:7 user@R2# set members 2:8 user@R2# set members 2:9 user@R2# set members 2:10
Configure the static routes.
[edit routing-options static] user@R2# set route 10.2.0.0/16 reject user@R2# set route 10.2.0.0/16 install user@R2# set route 10.3.0.0/16 reject user@R2# set route 10.3.0.0/16 install
Configure a routing policy that advertises static routes into BGP and adds the BGP community to the routes.
[edit policy-options policy-statement statics] user@R2# set from protocol static user@R2# set then community add 1 user@R2# set then accept
Apply the export policy.
[edit protocols bgp group external-peers] user@R2# set export statics
Results
From configuration mode, confirm your configuration
by entering the show interfaces, show protocols, show policy-options, and show routing-options commands. If the output does not display the intended configuration,
repeat the instructions in this example to correct the configuration.
Device R1
user@R1# show interfaces
fe-1/1/0 {
unit 0{
description to-R2;
family inet {
address 10.0.0.1/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 192.168.0.1/32;
}
}
}
user@R1# show protocols
bgp {
group external-peers {
type external;
peer-as 2;
neighbor 10.0.0.2 {
import remove-communities;
}
}
}
user@R1# show policy-options
policy-statement remove-communities {
term 1 {
from protocol bgp;
then {
community delete wild;
accept;
}
}
term 2 {
then reject;
}
}
community wild members *:*;
user@R1# show routing-options router-id 192.168.0.1; autonomous-system 1;
Device R2
user@R2# show interfaces
fe-1/1/0 {
unit 0 {
description to-R1;
family inet {
address 10.0.0.2/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 192.168.0.2/32;
}
}
}
user@R2# show protocols
bgp {
group external-peers {
type external;
export statics;
peer-as 1;
neighbor 10.0.0.1;
}
}
user@R2# show policy-options
policy-statement statics {
from protocol static;
then {
community add 1;
accept;
}
}
community 1 members [ 2:1 2:2 2:3 2:4 2:5 2:6 2:7 2:8 2:9 2:10 ];
user@R2# show routing-options
static {
route 10.2.0.0/16 {
reject;
install;
}
route 10.3.0.0/16 {
reject;
install;
}
}
router-id 192.168.0.3;
autonomous-system 2;
If you are done configuring the devices, enter commit from configuration mode.
Verification
Confirm that the configuration is working properly.
Verifying the BGP Routes
Purpose
Make sure that the routing table on Device R1 does not contain BGP communities.
Action
On Device R1, run the
show route protocols bgp extensivecommand.user@R1> show route protocols bgp extensive inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden) 10.2.0.0/16 (1 entry, 1 announced) TSI: KRT in-kernel 10.2.0.0/16 -> {10.0.0.2} *BGP Preference: 170/-101 Next hop type: Router, Next hop index: 671 Address: 0x9458270 Next-hop reference count: 4 Source: 10.0.0.2 Next hop: 10.0.0.2 via lt-1/1/0.5, selected Session Id: 0x100001 State: <Active Ext> Local AS: 1 Peer AS: 2 Age: 20:39:01 Validation State: unverified Task: BGP_2.10.0.0.2+179 Announcement bits (1): 0-KRT AS path: 2 I Accepted Localpref: 100 Router ID: 192.168.0.3 10.3.0.0/16 (1 entry, 1 announced) TSI: KRT in-kernel 10.3.0.0/16 -> {10.0.0.2} *BGP Preference: 170/-101 Next hop type: Router, Next hop index: 671 Address: 0x9458270 Next-hop reference count: 4 Source: 10.0.0.2 Next hop: 10.0.0.2 via lt-1/1/0.5, selected Session Id: 0x100001 State: <Active Ext> Local AS: 1 Peer AS: 2 Age: 20:39:01 Validation State: unverified Task: BGP_2.10.0.0.2+179 Announcement bits (1): 0-KRT AS path: 2 I Accepted Localpref: 100 Router ID: 192.168.0.3On Device R1, deactivate the
community removeconfiguration in the import policy.[edit policy-options policy-statement remove-communities term 1] user@R1# deactivate then community delete wild user@R1# commit
On Device R1, run the
show route protocols bgp extensivecommand to view the advertised communities.user@R1> show route protocols bgp extensive inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden) 10.2.0.0/16 (1 entry, 1 announced) TSI: KRT in-kernel 10.2.0.0/16 -> {10.0.0.2} *BGP Preference: 170/-101 Next hop type: Router, Next hop index: 671 Address: 0x9458270 Next-hop reference count: 4 Source: 10.0.0.2 Next hop: 10.0.0.2 via lt-1/1/0.5, selected Session Id: 0x100001 State: <Active Ext> Local AS: 1 Peer AS: 2 Age: 20:40:53 Validation State: unverified Task: BGP_2.10.0.0.2+179 Announcement bits (1): 0-KRT AS path: 2 I Communities: 2:1 2:2 2:3 2:4 2:5 2:6 2:7 2:8 2:9 2:10 Accepted Localpref: 100 Router ID: 192.168.0.3 10.3.0.0/16 (1 entry, 1 announced) TSI: KRT in-kernel 10.3.0.0/16 -> {10.0.0.2} *BGP Preference: 170/-101 Next hop type: Router, Next hop index: 671 Address: 0x9458270 Next-hop reference count: 4 Source: 10.0.0.2 Next hop: 10.0.0.2 via lt-1/1/0.5, selected Session Id: 0x100001 State: <Active Ext> Local AS: 1 Peer AS: 2 Age: 20:40:53 Validation State: unverified Task: BGP_2.10.0.0.2+179 Announcement bits (1): 0-KRT AS path: 2 I Communities: 2:1 2:2 2:3 2:4 2:5 2:6 2:7 2:8 2:9 2:10 Accepted Localpref: 100 Router ID: 192.168.0.3
Meaning
The output shows that in Device R1’s routing
table, the communities are suppressed in the BGP routes sent from
Device R2. When the community remove setting in Device
R1’s import policy is deactivated, the communities are no longer
suppressed.
Example: Configuring a Routing Policy Based on the Number of BGP Communities
This example shows how to create a policy that accepts BGP routes based on the number of BGP communities.
Requirements
No special configuration beyond device initialization is required before you configure this example.
Overview
This example shows two routing devices with an external BGP (EBGP) connection between them. Device R2 uses the BGP session to send two static routes to Device R1. On Device R1, an import policy specifies that the BGP-received routes can contain up to five communities to be considered a match. For example, if a route contains three communities, it is considered a match and is accepted. If a route contains six or more communities, it is considered a nonmatch and is rejected.
It is important to remember that the default policy for EBGP
is to accept all routes. To ensure that the nonmatching routes are
rejected, you must include a then reject action at the
end of the policy definition.
Topology
Figure 3 shows the sample network.
Configuration
CLI Quick Configuration
To quickly
configure this example, copy the following commands, paste them into
a text file, remove any line breaks, change any details necessary
to match your network configuration, and then copy and paste the commands
into the CLI at the [edit] hierarchy level.
Device R1
set interfaces fe-1/1/0 unit 0 description to-R2 set interfaces fe-1/1/0 unit 0 family inet address 10.0.0.1/30 set interfaces lo0 unit 0 family inet address 192.168.0.1/32 set protocols bgp group external-peers type external set protocols bgp group external-peers peer-as 2 set protocols bgp group external-peers neighbor 10.0.0.2 import import-communities set policy-options policy-statement import-communities term 1 from protocol bgp set policy-options policy-statement import-communities term 1 from community-count 5 orlower set policy-options policy-statement import-communities term 1 then accept set policy-options policy-statement import-communities term 2 then reject set routing-options router-id 192.168.0.1 set routing-options autonomous-system 1
Device R2
set interfaces fe-1/1/0 unit 0 description to-R1 set interfaces fe-1/1/0 unit 0 family inet address 10.0.0.2/30 set interfaces lo0 unit 0 family inet address 192.168.0.2/32 set protocols bgp group external-peers type external set protocols bgp group external-peers export statics set protocols bgp group external-peers peer-as 1 set protocols bgp group external-peers neighbor 10.0.0.1 set policy-options policy-statement statics from protocol static set policy-options policy-statement statics then community add 1 set policy-options policy-statement statics then accept set policy-options community 1 members 2:1 set policy-options community 1 members 2:2 set policy-options community 1 members 2:3 set policy-options community 1 members 2:4 set policy-options community 1 members 2:5 set policy-options community 1 members 2:6 set policy-options community 1 members 2:7 set policy-options community 1 members 2:8 set policy-options community 1 members 2:9 set policy-options community 1 members 2:10 set routing-options static route 10.2.0.0/16 reject set routing-options static route 10.2.0.0/16 install set routing-options static route 10.3.0.0/16 reject set routing-options static route 10.3.0.0/16 install set routing-options router-id 192.168.0.3 set routing-options autonomous-system 2
Procedure
Step-by-Step Procedure
The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
To configure Device R1:
Configure the interfaces.
[edit interfaces] user@R1# set fe-1/1/0 unit 0 description to-R2 user@R1# set fe-1/1/0 unit 0 family inet address 10.0.0.1/30 user@R1# set lo0 unit 0 family inet address 192.168.0.1/32
Configure BGP.
Apply the import policy to the BGP peering session with Device R2.
[edit protocols bgp group external-peers] user@R1# set type external user@R1# set peer-as 2 user@R1# set neighbor 10.0.0.2 import import-communities
Configure the routing policy that sends direct routes.
[edit policy-options policy-statement import-communities] user@R1# set term 1 from protocol bgp user@R1# set term 1 from community-count 5 orlower user@R1# set term 1 then accept user@R1# set term 2 then reject
Configure the autonomous system (AS) number and the router ID.
[edit routing-options ] user@R1# set router-id 192.168.0.1 user@R1# set autonomous-system 1
Step-by-Step Procedure
The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
To configure Device R2:
Configure the interfaces.
[edit interfaces] user@R2# set fe-1/1/0 unit 0 description to-R1 user@R2# set fe-1/1/0 unit 0 family inet address 10.0.0.2/30 user@R2# set lo0 unit 0 family inet address 192.168.0.2/32
Configure the router ID and the autonomous system (AS) number.
[edit routing-options] user@R2# set router-id 192.168.0.3 user@R2# set autonomous-system 2
Configure BGP.
[edit protocols bgp group external-peers] user@R2# set type external user@R2# set peer-as 1 user@R2# set neighbor 10.0.0.1
Configure multiple communities, or configure a single community with multiple members.
[edit policy-options community 1] user@R2# set members 2:1 user@R2# set members 2:2 user@R2# set members 2:3 user@R2# set members 2:4 user@R2# set members 2:5 user@R2# set members 2:6 user@R2# set members 2:7 user@R2# set members 2:8 user@R2# set members 2:9 user@R2# set members 2:10
Configure the static routes.
[edit routing-options static] user@R2# set route 10.2.0.0/16 reject user@R2# set route 10.2.0.0/16 install user@R2# set route 10.3.0.0/16 reject user@R2# set route 10.3.0.0/16 install
Configure a routing policy that advertises static routes into BGP and adds the BGP community to the routes.
[edit policy-options policy-statement statics] user@R2# set from protocol static user@R2# set then community add 1 user@R2# set then accept
Apply the export policy.
[edit protocols bgp group external-peers] user@R2# set export statics
Results
From configuration mode, confirm your configuration
by entering the show interfaces, show protocols, show policy-options, and show routing-options commands. If the output does not display the intended configuration,
repeat the instructions in this example to correct the configuration.
Device R1
user@R1# show interfaces
fe-1/1/0 {
unit 0{
description to-R2;
family inet {
address 10.0.0.1/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 192.168.0.1/32;
}
}
}
}
user@R1# show protocols
bgp {
group external-peers {
type external;
peer-as 2;
neighbor 10.0.0.2 {
import import-communities;
}
}
}
user@R1# show policy-options
policy-statement import-communities {
term 1 {
from {
protocol bgp;
community-count 5 orlower;
}
then accept;
}
term 2 {
then reject;
}
}
user@R1# show routing-options router-id 192.168.0.1; autonomous-system 1;
Device R2
user@R2# show interfaces
fe-1/1/0 {
unit 0 {
description to-R1;
family inet {
address 10.0.0.2/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 192.168.0.2/32;
}
}
}
user@R2# show protocols
bgp {
group external-peers {
type external;
export statics;
peer-as 1;
neighbor 10.0.0.1;
}
}
user@R2# show policy-options
policy-statement statics {
from protocol static;
then {
community add 1;
accept;
}
}
community 1 members [ 2:1 2:2 2:3 2:4 2:5 2:6 2:7 2:8 2:9 2:10 ];
user@R2# show routing-options
static {
route 10.2.0.0/16 {
reject;
install;
}
route 10.3.0.0/16 {
reject;
install;
}
}
router-id 192.168.0.3;
autonomous-system 2;
If you are done configuring the devices, enter commit from configuration mode.
Verification
Confirm that the configuration is working properly.
Verifying the BGP Routes
Purpose
Make sure that the routing table on Device R1 contains the expected BGP routes.
Action
On Device R1, run the
show route protocols bgpcommand.user@R1> show route protocols bgp inet.0: 5 destinations, 5 routes (3 active, 0 holddown, 2 hidden)
On Device R1, change the
community-countconfiguration in the import policy.[edit policy-options policy-statement import-communities term 1] user@R1# set from community-count 5 orhigher user@R1# commit
On Device R1, run the
show route protocols bgpcommand.user@R1> show route protocols bgp inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 10.2.0.0/16 *[BGP/170] 18:29:53, localpref 100 AS path: 2 I, validation-state: unverified > to 10.0.0.2 via fe-1/1/0.0 10.3.0.0/16 *[BGP/170] 18:29:53, localpref 100 AS path: 2 I, validation-state: unverified > to 10.0.0.2 via fe-1/1/0.0On Device R1, run the
show route protocols bgp extensivecommand to view the advertised communities.user@R1> show route protocols bgp extensive inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden) 10.2.0.0/16 (1 entry, 1 announced) TSI: KRT in-kernel 10.2.0.0/16 -> {10.0.0.2} *BGP Preference: 170/-101 Next hop type: Router, Next hop index: 671 Address: 0x9458270 Next-hop reference count: 4 Source: 10.0.0.2 Next hop: 10.0.0.2 via fe-1/1/0.0, selected Session Id: 0x100001 State: <Active Ext> Local AS: 1 Peer AS: 2 Age: 18:56:10 Validation State: unverified Task: BGP_2.10.0.0.2+179 Announcement bits (1): 0-KRT AS path: 2 I Communities: 2:1 2:2 2:3 2:4 2:5 2:6 2:7 2:8 2:9 2:10 Accepted Localpref: 100 Router ID: 192.168.0.3 10.3.0.0/16 (1 entry, 1 announced) TSI: KRT in-kernel 10.3.0.0/16 -> {10.0.0.2} *BGP Preference: 170/-101 Next hop type: Router, Next hop index: 671 Address: 0x9458270 Next-hop reference count: 4 Source: 10.0.0.2 Next hop: 10.0.0.2 via fe-1/1/0.0, selected Session Id: 0x100001 State: <Active Ext> Local AS: 1 Peer AS: 2 Age: 18:56:10 Validation State: unverified Task: BGP_2.10.0.0.2+179 Announcement bits (1): 0-KRT AS path: 2 I Communities: 2:1 2:2 2:3 2:4 2:5 2:6 2:7 2:8 2:9 2:10 Accepted Localpref: 100 Router ID: 192.168.0.3
Meaning
The output shows that in Device R1’s routing
table, the BGP routes sent from Device R2 are hidden. When the community-count setting in Device R1’s import policy
is modified, the BGP routes are no longer hidden.