BGP Communities — Tags for Traffic Engineering + Well-Known Values

The one-sentence mental model

Communities are metadata glued to prefixes. You don’t have to install a new attribute type or extend BGP — you just tag a prefix with a value that has meaning to a downstream router’s policy. It’s how ISPs let customers signal “prepend AS 3 times” or “don’t advertise to peer X” without needing a per-customer route-map on the ISP side.

The two flavors

Standard community (RFC 1997)

• 32 bits, usually written as <AS>:<value> (e.g., 65001:100).
• Attached to any prefix in a route-map with set community.
• Preserved across AS boundaries unless a filter strips them.

Extended community (RFC 4360)

• 64 bits, more type space, carries structured data.
• Route Target (RT) — used in MPLS L3VPN to identify which VRF a prefix belongs in.
• Site-of-Origin (SoO) — prevents route loops in complex multi-homed VPN sites.
• Also used for encoding OSPF domain-id, link bandwidth, etc.

The four well-known standard communities

Setting communities

By default, communities are NOT sent to iBGP peers. You must enable it per neighbor:

router bgp 65001
  neighbor 203.0.113.1 send-community
  neighbor 10.10.10.2 send-community both     ! send std AND extended

Then set a community with a route-map:

ip community-list 10 permit no-export
!
route-map TAG-INTERNAL permit 10
  set community 65001:100 no-export
!
router bgp 65001
  neighbor 10.10.10.2 route-map TAG-INTERNAL out

Prefixes advertised to 10.10.10.2 will carry community 65001:100 + no-export.

Matching communities

Match communities with an inbound route-map to adjust attributes:

ip community-list 20 permit 65001:100
!
route-map TREAT-INTERNAL permit 10
  match community 20
  set local-preference 200
!
route-map TREAT-INTERNAL permit 20
  ! all others — normal treatment

Prefixes tagged with 65001:100 get elevated local-pref to 200.

Real-world ISP community patterns

Big transit providers publish community-based traffic-engineering menus. Typical patterns (each ISP has its own values, published in their community guide):

The blackhole community is critical for DDoS response. If your /32 is under attack, tag it <ISP>:666 and the ISP null-routes it upstream so the pipe stays clean.

Extended communities — Route Target for L3VPN

In MPLS L3VPN, VRFs on a PE router import and export routes based on Route Targets:

vrf definition CUSTOMER-A
  rd 65001:100
  address-family ipv4
    route-target export 65001:100
    route-target import 65001:100
!

Prefixes exported from CUSTOMER-A’s VRF carry RT:65001:100. Any PE that imports 65001:100 installs them into its matching VRF. That’s how one MP-BGP session distributes routes across all customer VRFs while keeping them isolated.

Common exam / real-world mistakes

1. Not enabling send-community on the neighbor. Default OFF. Set the community all you want — it’s stripped on advertise until this is on. Bit gotcha.
2. Forgetting send-community both when the design needs extended communities (e.g., L3VPN). Standard vs extended are enabled independently.
3. Matching by community with an ACL instead of a community-list. Communities need ip community-list, not regular ACLs.
4. Adding communities without additive keyword. set community X REPLACES existing communities. Use set community X additive to append.
5. Assuming all providers preserve communities. Some strip customer communities at ingress. Test.

Cheat strip

Standard community   32-bit tag "<AS>:<value>"
Extended community   64-bit, includes RT + SoO + more

Well-known:
  no-export          don't leave current AS
  no-advertise       don't send to ANY peer
  internet           explicit "send everywhere"

Enable send:
  neighbor X send-community          (standard only)
  neighbor X send-community both     (std + ext)

Set:
  set community X:Y [additive]        (additive appends, not replaces)

Match:
  ip community-list N permit X:Y
  route-map MAP → match community N

ISP patterns:
  <AS>:100  no-peer     |  <AS>:301-303  prepend Nx  |  <AS>:666  blackhole

L3VPN         RT export/import in VRF config