BGP Community No Export

Lab and baseline

R1 in AS 65010 originates the host route. R2 and R4 share AS 65024; R3 is external in AS 65030. R2 sets next-hop-self toward R4 so its internal path is usable, and sends communities so R4 retains any scope tag.

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65010
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65024
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  network 198.51.100.1 mask 255.255.255.255
 exit-address-family
end

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.9 255.255.255.252
 no shutdown
exit
router bgp 65024
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65010
 neighbor 192.0.2.6 remote-as 65030
 neighbor 192.0.2.10 remote-as 65024
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  neighbor 192.0.2.6 activate
  neighbor 192.0.2.10 activate
  neighbor 192.0.2.10 next-hop-self
  neighbor 192.0.2.10 send-community
 exit-address-family
end

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
router bgp 65030
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 65024
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
 exit-address-family
end

hostname R4
ip cef
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.10 255.255.255.252
 no shutdown
exit
router bgp 65024
 bgp router-id 10.255.0.4
 no bgp default ipv4-unicast
 neighbor 192.0.2.9 remote-as 65024
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.9 activate
 exit-address-family
end

R2# show ip bgp 198.51.100.1/32
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.1            0             0 65010 i

R3# show ip bgp 198.51.100.1/32
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.5                          0 65024 65010 i

R4# show ip bgp 198.51.100.1/32
     Network          Next Hop        Metric LocPrf Weight Path
*>i  198.51.100.1/32  192.0.2.9            0    100      0 65010 i

All three receiving routers have a usable baseline route. Each scope experiment starts from this untagged baseline.

Set the community

R1 adds the well-known tag as it exports the test prefix to R2. Other prefixes pass unchanged. R2 receives the tag and enforces its scope on subsequent advertisements.

R1

ip prefix-list TARGET seq 5 permit 198.51.100.1/32
route-map TAG-TARGET permit 10
 match ip address prefix-list TARGET
 set community no-export additive
exit
route-map TAG-TARGET permit 20
exit

router bgp 65010
 address-family ipv4 unicast
  neighbor 192.0.2.2 route-map TAG-TARGET out
  neighbor 192.0.2.2 send-community
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft out

Check the boundary

R2# show ip bgp 198.51.100.1/32
BGP routing table entry for 198.51.100.1/32
Paths: (1 available, best #1, table default)
  65010
    192.0.2.1 from 192.0.2.1
      Origin IGP, metric 0, localpref 100, valid, external, best
      Community: no-export

R3# show ip bgp 198.51.100.1/32
% Network not in table

R4# show ip bgp 198.51.100.1/32
BGP routing table entry for 198.51.100.1/32
Paths: (1 available, best #1, table default)
  65010
    192.0.2.9 from 192.0.2.9
      Origin IGP, metric 0, localpref 100, valid, internal, best
      Community: no-export

R2# show ip route 198.51.100.1
Routing entry for 198.51.100.1/32
  Known via "bgp 65024", distance 20, metric 0
  * 192.0.2.1, via GigabitEthernet1

R3 loses the route across the external boundary. R4 retains it over iBGP, including the No Export tag. Sending the tag internally matters: an untagged copy at another border could be exported without this restriction.

The missing table entry is a route-distribution result, not evidence that a neighbor session failed.

Compare the scope

In a confederation, No Export allows distribution between member ASes but blocks export outside the confederation. The next lesson contrasts Local AS, which also blocks the member boundary. These tags constrain route announcements, not packets in an access list.

Restore advertisements

router bgp 65010
 address-family ipv4 unicast
  no neighbor 192.0.2.2 route-map TAG-TARGET out
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft out

R3# show ip bgp 198.51.100.1/32
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.5                          0 65024 65010 i

R4# show ip bgp 198.51.100.1/32
     Network          Next Hop        Metric LocPrf Weight Path
*>i  198.51.100.1/32  192.0.2.9            0    100      0 65010 i

After convergence, the untagged route reaches both neighbors again. A soft outbound refresh avoids tearing down R1’s session.