> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Extreme IX BGP Communities and Configuration Guide

> This help topic describes how to use BGP communities and Route Server behavior to manage traffic propagation on Extreme IX.

export const Image = ({src, alt = '', caption, width, height, shadow}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Image -';
  if (typeof src !== 'string') {
    src = String(src);
  }
  if (!src || src === 'undefined') {
    console.error(`${errorPrefix} \`src\` is required — rendering an empty string instead`);
    return <></>;
  }
  const img = <img className={['mega-image-style', shadow ? 'shadow' : ''].join(' ')} src={src} alt={alt} width={width} height={height} style={{
    display: 'block'
  }} />;
  return caption ? <figure>
      {img}
      <figcaption style={{
    textAlign: 'center',
    width
  }}>{caption}</figcaption>
    </figure> : img;
};

Extreme IX Route Servers remove the need for individual bilateral BGP sessions between members. Use BGP communities to control how the Route Servers propagate your routes to other peers.

## Route Server behavior: AS-path hiding

Extreme IX Route Servers (RS) do not prepend or include their own Autonomous System Number (ASN) in the `AS_PATH` attribute. This removes the RS AS from the path, so participating members appear directly connected without requiring individual bilateral BGP sessions between each member network.

### Disable the first-AS check

Because the Route Server hides its ASN, some BGP router implementations discard incoming updates from eBGP peers by default if the peer's ASN does not appear first in the `AS_PATH`. Disable this check on your router when you peer with Extreme IX Route Servers:

* **Cisco** -- `no bgp enforce-first-as` or `bgp enforce-first-as disable`
* **Huawei** -- `undo check-first-as` under the BGP context
* **Fortinet** -- `set enforce-first-as disable`

## BGP community controls

All members peering with Extreme IX Route Servers can use communities to control incoming and outgoing route propagation.

* **Incoming traffic control** -- Managed on the member side. You control which prefixes received from the Route Server are accepted into your routing table.
* **Outgoing traffic control** -- Use BGP communities to control which peers receive your announced prefixes through the Route Server.

<Warning>
  Do not mix standard communities with large communities in the same policy. Choose one format for your configuration.
</Warning>

### Standard BGP communities

Communities originated from the Extreme IX RS:

* `0:peer AS` -- The prefix is announced from `peer AS`.

Standard communities accepted by the Extreme IX RS:

* `49378:0` -- Block your prefix to all peers.
* `49378:0 49378:ASPEER` -- Block your prefix to all peers except `ASPEER`.
* `49378:ASPEER` -- Block your prefix to `ASPEER`.

### Large BGP communities

Announcement control:

* `49378:0:0` -- Block your prefix to all peers.
* `49378:1:ASPEER` -- Announce a route to a specific `ASPEER`.
* `49378:0:ASPEER` -- Prevent announcement of a prefix to an `ASPEER`.

For the full list of AS mappings and technical requirements, see the [Extreme IX Technical Requirements page](http://extreme-ix.org/technical/technical-requirements/).

Large BGP communities also let you prepend your prefixes to a specific Route Server member while advertising to the rest of the peers without prepends:

* `49378:101:ASPEER` -- Prepend to `ASPEER` once.
* `49378:102:ASPEER` -- Prepend to `ASPEER` twice.
* `49378:103:ASPEER` -- Prepend to `ASPEER` three times.

For example, attaching `49378:103:ASN1` prepends your prefixes to `ASN1` three times, while advertising to the rest of the members without prepends.

## Operational notices

IPv6 Router Advertisements (RA) are ICMPv6 NDP messages required for LAN/SLAAC environments. They have no use case for point-to-point (PtP) links, inter-AS links, IP transit, PNI, and IXP LAN connectivity. Confirm that these default behaviors are disabled on your network devices. For information about how to disable IPv6 RA per vendor, and why this matters, see [this article](https://www.daryllswer.com/ipv6-router-advertisement-why-is-it-enabled-by-default-on-some-network-vendors/).

<Image src="/images/ix/extreme-ix/bgp-01-ipv6-ra-diagram.png" alt="Table listing the default IPv6 Router Advertisement behavior for Arista, Cisco, Cumulus Linux, Huawei, Juniper, and MikroTik." shadow={true} width={600} />

## Vendor configuration examples

The following examples show how to manage route propagation to and from specific BGP peers through the Route Server (RS) using BGP communities (ASN `49378`).

### Scenario 1: block specific BGP peers through the Route Server

Use these configurations to block receiving prefixes from specific target Autonomous Systems (`AS: xxx`, `AS: yyy`) and prevent sending your routes to them.

<Note>
  Deny received routes matching the targeted AS in the inbound filter, then accept the remaining routes. Attach the control community to every prefix pool you advertise toward the Route Server.
</Note>

<Image src="/images/ix/extreme-ix/bgp-02-mikrotik-1.png" alt="MikroTik RouterOS BGP peer configuration window showing the remote address and remote AS for an Extreme Route Server peer." shadow={true} width={700} />

<Image src="/images/ix/extreme-ix/bgp-03-mikrotik-2.png" alt="MikroTik RouterOS Route Filters list showing inbound discard and accept rules, and outbound accept rules with BGP communities attached per prefix." shadow={true} width={700} />

<Image src="/images/ix/extreme-ix/bgp-04-mikrotik-3.png" alt="MikroTik RouterOS Route Filter dialogs showing how to configure an inbound filter that discards routes matching a BGP community." shadow={true} width={700} />

<Image src="/images/ix/extreme-ix/bgp-05-mikrotik-4.png" alt="MikroTik RouterOS Route Filter dialogs showing how to configure an outbound filter that appends a BGP community to an advertised prefix." shadow={true} width={700} />

<CodeGroup>
  ```text Huawei theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  # BGP Peer Configuration
  peer <RS-IP> as-number <RS-ASN>
  #
  ipv4-family unicast
   peer <RS-IP> enable
   peer <RS-IP> route-policy MyPool-IN import
   peer <RS-IP> route-policy MyPool-OUT export
   peer <RS-IP> advertise-community
  #
  # Define Local Prefixes
  ip ip-prefix MyPool index 10 permit x.x.x.x 24
  ip ip-prefix MyPool index 15 permit x.x.x.x 24
  #
  # Outbound Route Policy (Do not advertise to AS xxx, yyy)
  route-policy MyPool-OUT permit node 10
   if-match ip-prefix MyPool
   apply community 49378:xxx 49378:yyy additive
  #
  # Inbound Route Policy (Block routes from AS xxx, yyy)
  route-policy MyPool-IN deny node 10
   if-match community-filter 11 12
  route-policy MyPool-IN permit node 20
  #
  # Community Filters
  ip community-filter 11 permit 0:xxx
  ip community-filter 12 permit 0:yyy
  ```

  ```text Cisco theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  ! BGP Peer Configuration
  neighbor <RS-IP> remote-as <RS-ASN>
  neighbor <RS-IP> route-map MyPool-IN in
  neighbor <RS-IP> route-map MyPool-OUT out
  neighbor <RS-IP> send-community
  !
  ! Define Local Prefixes
  ip prefix-list MyPool seq 10 permit x.x.x.x/22 le 24
  !
  ! Outbound Route Map
  route-map MyPool-OUT permit 10
   match ip address prefix-list MyPool
   set community 49378:xxx 49378:yyy additive
  !
  ! Inbound Route Map
  route-map MyPool-IN deny 10
   match community filter
  !
  route-map MyPool-IN permit 20
  !
  ! Community List Definition
  ip community-list standard filter permit 0:xxx
  ip community-list standard filter permit 0:yyy
  ```

  ```text Juniper theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  # BGP Protocol Setup
  set protocols bgp group to_EIX type external
  set protocols bgp group to_EIX import inbound-routes-EIX
  set protocols bgp group to_EIX export outbound-routes-EIX
  set protocols bgp group to_EIX neighbor 103.77.108.200 peer-as 49378

  # Prefix List Definition
  set policy-options prefix-list EIX-Download-PREFIX x.x.x.x/24

  # Outbound Policy Statement
  set policy-options policy-statement outbound-routes-EIX term OUT from prefix-list EIX-Download-PREFIX
  set policy-options policy-statement outbound-routes-EIX term OUT then community add COMMUNITY_out
  set policy-options policy-statement outbound-routes-EIX term OUT then accept
  set policy-options policy-statement outbound-routes-EIX term LAST then reject

  # Inbound Policy Statement
  set policy-options policy-statement inbound-routes-EIX term Block-COMMUNITY from community COMMUNITY_in
  set policy-options policy-statement inbound-routes-EIX term Block-COMMUNITY then reject
  set policy-options policy-statement inbound-routes-EIX term EIX-UPLOAD from protocol bgp
  set policy-options policy-statement inbound-routes-EIX term EIX-UPLOAD then local-preference xx
  set policy-options policy-statement inbound-routes-EIX term EIX-UPLOAD then accept

  # Community Definitions
  set policy-options community COMMUNITY_out members [ 49378:xxx 49378:yyy ]
  set policy-options community COMMUNITY_in members [ 0:xxx 0:yyy ]
  ```

  ```text MikroTik RouterOS v6 theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  /routing filter
  add action=discard chain=EIX-RS-IN bgp-communities=0:xxx
  add action=discard chain=EIX-RS-IN bgp-communities=0:yyy
  add action=accept chain=EIX-RS-IN

  add action=accept chain=EIX-RS-OUT prefix=<YOUR_PREFIX> set-bgp-communities=49378:xxx,49378:yyy
  ```

  ```text MikroTik RouterOS v7.x theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  /routing filter rule
  add chain=Extreme-RS-in disabled=no rule="if (bgp-communities equal 0:xxx) { reject }"
  add chain=Extreme-RS-in disabled=no rule="if (bgp-communities equal 0:yyy) { reject }"
  add chain=Extreme-RS-in disabled=no rule="accept"

  add chain=Extreme-RS-out disabled=no rule="if (dst==x.x.x.x/24) { set bgp-communities 49378:xxx,49378:yyy; accept }"
  add chain=Extreme-RS-out disabled=no rule="reject"
  ```
</CodeGroup>

<Note>
  For Route Server members using 32-bit ASNs, see the [Extreme IX Technical Requirements page](https://extreme-ix.org/resources/technical-requirements) for the mapped short community values, so you avoid using BGP extended communities.
</Note>

### Scenario 2: allow selective peers only, and block all others

Use these configurations to block route exchange with all members by default, and allow route exchange only with specific target networks -- for example, Google (`AS15169`) and Akamai (`AS20940`).

<CodeGroup>
  ```text MikroTik RouterOS v6 theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  /routing filter
  # Outbound: Block advertise to all (49378:0), permit only Akamai & Google
  add action=accept chain=EIX-RS-OUT prefix=<YOUR_PREFIX_1> set-bgp-communities=49378:0,49378:20940,49378:15169
  add action=accept chain=EIX-RS-OUT prefix=<YOUR_PREFIX_2> set-bgp-communities=49378:0,49378:20940,49378:15169
  add action=discard chain=EIX-RS-OUT

  # Inbound: Accept only Akamai & Google routes, discard all others
  add action=accept chain=EIX-RS-IN bgp-communities=0:20940
  add action=accept chain=EIX-RS-IN bgp-communities=0:15169
  add action=discard chain=EIX-RS-IN
  ```

  ```text MikroTik RouterOS v7.x theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  /routing filter rule
  # Inbound Filter
  add chain=Extreme-RS-in disabled=no rule="if (bgp-communities equal 0:20940) { accept }"
  add chain=Extreme-RS-in disabled=no rule="if (bgp-communities equal 0:15169) { accept }"
  add chain=Extreme-RS-in disabled=no rule="reject"

  # Outbound Filter
  add chain=Extreme-RS-out disabled=no rule="if (dst==x.x.x.x/24) { set bgp-communities 49378:0,49378:20940,49378:15169; accept }"
  add chain=Extreme-RS-out disabled=no rule="reject"
  ```
</CodeGroup>

The following example establishes dual Route Server sessions (primary and secondary) on Huawei, accepting prefixes exclusively from Akamai (`AS20940`) and blocking all others.

<CodeGroup>
  ```text Huawei Primary Route Server theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  peer 45.120.248.200 as-number 49378
  #
  ipv4-family unicast
   peer 45.120.248.200 enable
   peer 45.120.248.200 route-policy MyPool-IN import
   peer 45.120.248.200 route-policy MyPool-OUT export
   peer 45.120.248.200 advertise-community
  #
  ip ip-prefix MyPool index 10 permit x.x.x.x 24
  ip ip-prefix MyPool index 15 permit x.x.x.x 24
  #
  # Outbound: Block all peers (49378:0), permit Akamai (49378:20940)
  route-policy MyPool-OUT permit node 10
   if-match ip-prefix MyPool
   apply community 49378:0 49378:20940 additive
  #
  # Inbound: Accept Akamai (0:20940), deny all others
  route-policy MyPool-IN permit node 10
   if-match community-filter 11
  route-policy MyPool-IN deny node 20
  #
  ip community-filter 11 permit 0:20940
  ```

  ```text Huawei Secondary Route Server theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
  peer 45.120.248.240 as-number 49378
  #
  ipv4-family unicast
   peer 45.120.248.240 enable
   peer 45.120.248.240 route-policy MyPool-IN import
   peer 45.120.248.240 route-policy MyPool-OUT export
   peer 45.120.248.240 advertise-community
  #
  ip ip-prefix MyPool index 10 permit x.x.x.x 24
  ip ip-prefix MyPool index 15 permit x.x.x.x 24
  #
  route-policy MyPool-OUT permit node 10
   if-match ip-prefix MyPool
   apply community 49378:0 49378:20940 additive
  #
  route-policy MyPool-IN permit node 10
   if-match community-filter 11
  route-policy MyPool-IN deny node 20
  #
  ip community-filter 11 permit 0:20940
  ```
</CodeGroup>