HPE

Mahadevapura, Bengaluru, KA 560048 India ssangli@juniper.net

Individual Contributor

pyxislx@gmail.com

Routing Area IDR Working Group RFC Request for Comments I-D Internet-Draft BGP, Extended Community This document describes the "extended community" BGP-4 attribute. This attribute provides a mechanism for labeling information carried in BGP-4. These labels can be used to control the distribution of this information, or for other applications. This document obsoletes RFC 4360. This document also updates RFC 5701 by incorporating the operations section.

Introduction The Extended Community Attribute provides a mechanism for labeling information carried in BGP-4 . It provides two important enhancements over the existing BGP Community Attribute :

• An extended range, ensuring that communities can be assigned for a plethora of uses, without fear of overlap.
• The addition of a Type field provides structure for the community space.

The addition of structure allows the usage of policy based on the application for which the community value will be used. For example, one can filter out all communities of a particular type, or allow only certain values for a particular type of community. It also allows one to specify whether a particular community is transitive or non-transitive across an Autonomous System (AS) boundary. Without structure, this can only be accomplished by explicitly enumerating all community values that will be denied or allowed and passed to BGP speakers in neighboring ASes based on the transitive property. This document obsoletes . of this document also applies to and effectively updates it.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The Extended Communities Attribute is a transitive optional BGP attribute, with the Type Code 16. The attribute consists of a set of "extended communities". All routes with the Extended Communities attribute belong to the communities listed in the attribute.

Each Extended Community is encoded as an 8-octet quantity inside the BGP Extended Community Attribute, as follows:

Type Field:

Two classes of Type Field are introduced: Regular Type and Extended Type. The size of the Type Field for Regular Types is 1 octet, and the size of the Type Field for Extended Types is 2 octets. The value of the high-order octet of the Type Field determines if an extended community is a Regular Type or an Extended Type. The class of a type (Regular or Extended) is not encoded in the structure of the type itself. The class of a type is specified in the document that defines the type and the IANA registry.

The high-order octet of the Type Field is as shown below:

I - IANA authority bit

Value 0:

IANA-assignable type using the "First Come First Serve" policy

Value 1:

Part of this Type Field space is for IANA assignable types using either the Standard Action or the Early IANA Allocation policy. The rest of this Type Field space is for Experimental use.

T - Transitive bit

Value 0:

The community is transitive across ASes

Value 1:

The community is non-transitive across ASes

Remaining 6 bits:

Together with the I and T bit, indicate the Type of the extended community.

Value Field:

The encoding of the Value Field is dependent on the "type" of the community as specified by the Type Field.

Two extended communities are declared equal only when all 8 octets of the community are equal. The two members in the tuple <Type, Value> should be enumerated to specify any community value. The remaining octets of the community are interpreted based on the value of the Type field.

This section introduces a few extended types and defines the format of the Value Field for those types. The types introduced here provide "templates", where each template is identified by the high- order octet of the extended community Type field, and the low-order octet (sub-type) is used to indicate a particular type of extended community.

This is an extended type with Type Field composed of 2 octets and Value Field composed of 6 octets.

The value of the high-order octet of this extended type is either 0x00 or 0x40. The low-order octet of this extended type is used to indicate sub-types.

The Value Field consists of two sub-fields:

Global Administrator sub-field: 2 octets

This sub-field contains an Autonomous System number assigned by IANA. For a non-mappable four-octet Autonomous System number , the BGP speaker SHOULD fill AS_TRANS in this field. This sub-field MAY contain an arbitrary value chosen by the operator, provided it is allowed by the specific extended community.

Local Administrator sub-field: 4 octets

The organization identified by Autonomous System number in the Global Administrator sub-field can encode any information in this sub-field. The format and meaning of the value encoded in this sub-field should be defined by the sub-type of the community.

This is an extended type with Type Field composed of 2 octets and Value Field composed of 6 octets.

The value of the high-order octet of this extended type is either 0x01 or 0x41. The low-order octet of this extended type is used to indicate sub-types.

The Value field consists of two sub-fields:

Global Administrator sub-field: 4 octets

This sub-field contains an IPv4 unicast address assigned by one of the Internet registries.

Local Administrator sub-field: 2 octets

The organization that has been assigned the IPv4 address in the Global Administrator sub-field can encode any information in this sub-field. The format and meaning of the value encoded in this sub-field should be defined by the sub-type of the community.

This is an extended type with Type Field composed of 2 octets and Value Field composed of 6 octets.

The value of the high-order octet of this extended type is either 0x03 or 0x43. The low-order octet of this extended type is used to indicate sub-types. This is a generic community of extended type. The value of the sub-type that should define the Value Field is to be assigned by IANA.

A 4-Octet AS-Specific type of extended community is defined in and otherwise not covered in this document.

The Route Target Community identifies one or more routers that may receive a set of routes (that carry this Community) carried by BGP. This is transitive across the Autonomous System boundary. The Route Target Community is of an extended type. The value of the high-order octet of the Type field for the Route Target Community can be 0x00 (as defined in ), 0x01 (as defined in ), or 0x02 (as defined in ). The value of the low-order octet of the Type field for this community is 0x02. When the value of the high-order octet of the Type field is 0x00 or 0x02, the Local Administrator sub-field contains a number from a numbering space that is administered by the organization to which the Autonomous System number carried in the Global Administrator sub- field has been assigned by an appropriate authority. When the value of the high-order octet of the Type field is 0x01, the Local Administrator sub-field contains a number from a numbering space that is administered by the organization to which the IPv4 address carried in the Global Administrator sub-field has been assigned by an appropriate authority. One possible use of the Route Target Community is specified in .

The Route Origin Community identifies one or more routers that inject a set of routes (that carry this Community) into BGP. This is transitive across the Autonomous System boundary. The Route Origin Community is of an extended type. The value of the high-order octet of the Type field for the Route Origin Community can be 0x00 (as defined in ), 0x01 (as defined in ), or 0x02 (as defined in ). The value of the low-order octet of the Type field for this community is 0x03. When the value of the high-order octet of the Type field is 0x00 or 0x02, the Local Administrator sub-field contains a number from a numbering space that is administered by the organization to which the Autonomous System number carried in the Global Administrator sub- field has been assigned by an appropriate authority. When the value of the high-order octet of the Type field is 0x01, the Local Administrator sub-field contains a number from a numbering space that is administered by the organization to which the IPv4 address carried in the Global Administrator sub-field has been assigned by an appropriate authority. One possible use of the Route Origin Community is specified in .

This section also applies to . A BGP speaker may use the Extended Communities attribute to control which routing information it accepts or distributes to its peers. The Extended Community attribute MUST NOT be used to modify the BGP best path selection algorithm in a way that leads to forwarding loops. A BGP speaker receiving a route that doesn't have the Extended Communities attribute MAY append this attribute to the route when propagating it to its peers. A BGP speaker receiving a route with the Extended Communities attribute MAY modify this attribute according to the local policy. By default if a range of routes is to be aggregated and the resultant aggregate's path attributes do not carry the ATOMIC_AGGREGATE attribute, then the resulting aggregate should have an Extended Communities path attribute that contains the set union of all the Extended Communities from all of the aggregated routes. The default behavior could be overridden via local configuration, in which case handling the Extended Communities attribute in the presence of route aggregation becomes a matter of the local policy of the BGP speaker that performs the aggregation. A route may carry both the BGP Communities attribute, as defined in , and the Extended BGP Communities attribute. In this case, the BGP Communities attribute is handled as specified in , and the Extended BGP Communities attribute is handled as specified in this document. Non-transitive extended communities MUST NOT be sent (originated or propagated) across an Autonomous System boundary unless explicitly configured to do so. Non-transitive extended communities SHOULD NOT be removed when advertising the route within the same BGP AS Confederation (as defined in ). By default, when a BGP speaker receives routes with non-transitive extended communities across Autonomous System or Confederation Member-AS boundaries, it SHOULD NOT remove these extended communities. The behavior MAY be configurable. The BGP speaker SHOULD also allow local policies to perform operations on these extended communities, such as matching, deleting, and modifying. For IPv6 address-specific use-cases, one may consider using IPv6-Address-Specific BGP Extended Communities .

, defines the error handling procedure for the Extended Community attribute.

This document obsoletes , but it does not change the IANA Considerations of that updated and created the "Border Gateway Protocol (BGP) Extended Communities" registry group along with the registries therein corresponding to the specifications in this document. Therefore, IANA should continue to manage those registries as per . However, IANA is requested to replace all references to with this document in the "BGP Path Attributes" registry, the "BGP Extended Communities" registry group, and the "IPFIX Entities" registry group. IANA is requested to list this document as an additional reference for the following entries in the "BGP Transitive Extended Community Types" registry : BGP Transitive Extended Community Types

TYPE VALUE	NAME	REFERENCE
0x00	Transitive Two-Octet AS-Specific Extended Community (Sub-Types are defined in the "Transitive Two-Octet AS-Specific Extended Community Sub-Types" registry )	[this document]
0x01	Transitive IPv4-Address-Specific Extended Community (Sub-Types are defined in the "Transitive IPv4-Address-Specific Extended Community Sub-Types" registry )	[this document]
0x03	Transitive Opaque Extended Community (Sub-Types are defined in the "Transitive Opaque Extended Community Sub-Types" registry )	[this document]

IANA is requested to list this document as an additional reference for the following entries in the "BGP Non-Transitive Extended Community Types" registry : BGP Non-Transitive Extended Community Types

TYPE VALUE	NAME	REFERENCE
0x40	Non-Transitive Two-Octet AS-Specific Extended Community (Sub-Types are defined in the "Non-Transitive Two-Octet AS-Specific Extended Community Sub-Types" registry )	[this document]
0x41	Non-Transitive IPv4-Address-Specific Extended Community (Sub-Types are defined in the "Non-Transitive IPv4-Address-Specific Extended Community Sub-Types" registry )	[this document]
0x43	Non-Transitive Opaque Extended Community (Sub-Types are defined in the "Non-Transitive Opaque Extended Community Sub-Types" registry )	[this document]

IANA is requested to list this document as an additional reference for the following entries in the "Transitive Four-Octet AS-Specific Extended Community Sub-Types" registry : Transitive Four-Octet AS-Specific Extended Community Sub-Types

SUB-TYPE VALUE	NAME	REFERENCE
0x02	Route Target	[this document]
0x03	Route Origin	[this document]

Furthermore, IANA is requested to add the note below to the following registries under the "BGP Extended Communities" registry group:

• BGP Transitive Extended Community Types
• BGP Non-Transitive Extended Community Types
• Transitive Two-Octet AS-Specific Extended Community Sub-Types
• Non-Transitive Two-Octet AS-Specific Extended Community Sub-Types
• Transitive Four-Octet AS-Specific Extended Community Sub-Types
• Non-Transitive Four-Octet AS-Specific Extended Community Sub-Types
• Transitive IPv4-Address-Specific Extended Community Sub-Types
• Non-Transitive IPv4-Address-Specific Extended Community Sub-Types
• Transitive Opaque Extended Community Sub-Types
• Non-Transitive Opaque Extended Community Sub-Types
• Transitive IPv6-Address-Specific Extended Community Types
• Non-Transitive IPv6-Address-Specific Extended Community Types

"When an Extended Community requests allocation for a code point of both transitive and non-transitive variants for the same type/sub-type, it is recommended that the same value be assigned to them."

The BGP Extended Communities provide a general mechanism for labeling BGP routes and thus share security considerations similar to BGP Communities and BGP Large Communities . Since any intermediate BGP speaker along the route propagation path may have added, deleted, or altered the BGP Extended Communities attribute, deployments relying on such an attribute carried in the BGP Update message must trust every other BGP speaker in the path. However, specifying the mechanism to provide such trust is beyond the scope of this document. The BGP Extended Communities attribute itself does not protect the integrity of each extended community value. The operator should be aware that any BGP speaker along the path can alter the attribute without notice. Protecting the integrity of the handling of BGP Extended Communities attribute in a manner consistent with the intent of expressed BGP routing policies falls within the broader scope of securing BGP and is therefore not addressed here. Additionally, extended communities are used in several specialized ways to implement or augment other BGP signaling mechanisms. For example, the route-target extended community, defined in this document, is used to signal Layer 3 VPN membership. In some scenarios, these mechanisms are used to construct internal infrastructure. Therefore, these extended communities carry information private to a specific administrative domain. Leaking such extended communities into other administrative domains poses significant security risks. To prevent information leakage or privacy breaches across different administrative domains, proper filtering of the extended communities should always be exercised:

• Operators should filter transitive and non-transitive extended communities at the boundary of different administrative domains on both transmission and reception using appropriate routing policies, since this prevents extended communities outside the administrative domain from interacting inappropriately with the operator's network.
• Implementations should provide policy mechanisms to filter extended communities based on type, and possibly sub-type, to permit filtering the entire class of extended communities. Implementations may also provide the flexibility to match or inverse-match a set of extended communities for building permit/deny lists.
• Implementations that understand the internal format of a defined extended community should provide per-community match capability. Implementations that don't understand the internal format may match against the value field opaquely.
• Implementations should provide mechanisms to strip all extended communities at the boundary of administrative domains.
• Implementations may strip all extended communities by default while providing knobs to modify the default behavior.

Dan Tappan and Yakov Rekhter were the authors of and, therefore, are contributing authors of this document.

We wish to thank John Hawkinson, Jeffrey Haas, Bruno Rijsman, Bill Fenner, and Alex Zinin for their suggestions and feedback on the original . We thank Yakov Rekhter and Alfred Hoenes for pointing out several errors in . We also wish to thank Bruno Decraene, Laurent Vanbever, and Pierre Francois for pointing out inconsistencies regarding the procedures for originating non-transitive extended communities in . We also thank Jeffrey Haas, Robert Raszuk, Bruno Decraene, Linda Dunbar, Yingzhen Qu, Jie Dong, Lizhen Qiang, Erik Auerswald, Aijun Wang, John Scudder, and Job Snijders for their suggestions and feedback on this document.

IANA IANA IANA IANA IANA IANA IANA IANA IANA IANA IANA IANA IANA IANA IANA

The encodings and definitions of the extended communities are unchanged in this document. Besides addressing known errata in , this document updates the following:

• now includes references to the case for the 4-Octet Autonomous System number.
• clarifies the operations of non-transitive extended communities across Autonomous System or Confederation Member-AS boundaries.
• is added to describe the error handling procedures.
• is updated to reflect the current IANA registry status. The update splits the "BGP Extended Communities Type" registry into transitive and non-transitive registries. This section also contains similar updates for the Sub-Types defined.
• is updated to reflect the current security practice.