BGP VPNv4 / VPNv6 route-map extcommunity not working

[EasyNetDev]

Hi,

I have 2 routers with full BGP table and also are exchanging this tables between them. But I have other 2 routers, with less memory, and I want to filter out only a very small part of the VPN table.

I did like this:

router bgp AS_NUMBER
 neighbor 10.100.10.1 remote-as AS_NUMBER
 neighbor 10.100.10.1 description R10_VPNv4
 neighbor 10.100.10.1 update-source 10.100.1.1
 neighbor 10.100.10.1 capability extended-nexthop
 address-family ipv4 unicast
  no neighbor 10.100.10.1 activate
 exit-address-family
 address-family ipv4 vpn
  neighbor 10.100.10.1 activate
  neighbor 10.100.10.1 soft-reconfiguration inbound
  neighbor 10.100.10.1 route-map VPN-export-to-remote-sites out
 exit-address-family

bgp extcommunity-list standard VPN-export-to-remote-sites seq 5 permit rt AS_NUMBER:10600
ip prefix-list pl-DEFAULT-ROUTE description IPv4 Default Route
ip prefix-list pl-DEFAULT-ROUTE seq 5 permit 0.0.0.0/0
ipv6 prefix-list pl-DEFAULT-ROUTE description IPv6 Default Route
ipv6 prefix-list pl-DEFAULT-ROUTE seq 5 permit ::/0

And 2 versions of route-maps:

route-map VPN-export-to-remote-sites permit 1000
 match extcommunity VPN-export-to-remote-sites
exit
!
route-map VPN-export-to-remote-sites deny 10000
exit

And second version:

route-map VPN-export-to-remote-sites permit 1000
 match extcommunity VPN-export-to-remote-sites
exit
!
route-map VPN-export-to-remote-sites permit 1100
 match ip address prefix-list pl-DEFAULT-ROUTE
exit
!
route-map VPN-export-to-remote-sites deny 10000
exit

If I'm checking the route-map via bgp command:

R01# show bgp ipv4 vpn route-map VPN-export-to-remote-sites
BGP table version is 2776500, local router ID is 10.100.1.1, vrf id 0
Default local pref 100, local AS AS_NUMBER
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: AS_NUMBER:10002
*>i0.0.0.0/0        10.100.2.1               0    100      0 ?
    UN=10.100.2.1 EC{AS_NUMBER:10000 AS_NUMBER:10600} label=3 type=bgp, subtype=0
*>iA.B.C.2/32    10.100.2.1               0    100      0 ?
    UN=10.100.2.1 EC{AS_NUMBER:10000 AS_NUMBER:10600} label=3 type=bgp, subtype=0
*>iA.B.C.32/28   10.100.2.1               0    100      0 ?
    UN=10.100.2.1 EC{AS_NUMBER:10000 AS_NUMBER:10600} label=3 type=bgp, subtype=0
*>iA.B.C.D/32 10.100.2.1               0    100      0 ?
    UN=10.100.2.1 EC{AS_NUMBER:10000 AS_NUMBER:10600} label=3 type=bgp, subtype=0
*>iA.B.C.D/32
                    10.100.2.1               0    100      0 ?
    UN=10.100.2.1 EC{AS_NUMBER:10000 AS_NUMBER:10600} label=3 type=bgp, subtype=0

Displayed  5 routes and 1808187 total paths

So the route-map seems to work fine using extcommunity RT. But when I'm checking the export to 10.100.10.1, nothing is exported:

R01(config)# do show bgp ipv4 vpn neighbors 10.100.10.1 advertised-routes
R01(config)# do show bgp ipv4 vpn summary
BGP router identifier 10.100.1.1, local AS number AS_NUMBER vrf-id 0
BGP table version 0
RIB entries 33, using 6336 bytes of memory
Peers 2, using 1447 KiB of memory

Neighbor        V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
10.100.2.1      4      AS_NUMBER    939177    934920        0    0    0 3d00h56m       897332   892383 R02_VPNv4
10.100.10.1     4      AS_NUMBER      2966    128546        0    0    0 00:53:50            4        0 R10_VPNv4

Total number of neighbors 2

If I'm checking the route 0.0.0.0/0 over VPNv4:

BGP routing table entry for AS_NUMBER:10002:0.0.0.0/0, version 1
not allocated
Paths: (1 available, best #1)
  Not advertised to any peer
  Local
    10.100.2.1 from 10.100.2.1 (10.100.2.1)
      Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received)
      Extended Community: RT:AS_NUMBER:10000 RT:AS_NUMBER:10600
      Remote label: 3
      Last update: Wed Aug  3 17:03:55 2022

Is announced correctly with RT:AS_NUMBER:10600.

What I'm doing wrong?
Is VPNv4/v6 not supporting route-map export?

[ton31337]

Can you turn on debug bgp updates? And check the reason they are rejected.

[EasyNetDev]

Hi @ton31337,

Sure. I will do it today and I will post the output.

Kind regards

[EasyNetDev]

Hi @ton31337 ,

I've changed the previous setup but I created a similar route-map for default route between my 2 core routes.
The result:

Aug 18 17:56:58 R01 bgpd[512508]: [JQB4F-DXP0F] subgroup_announce_check: BGP_PATH_ANNC_NH_SELF, family=IPv4
Aug 18 17:56:58 R01 bgpd[512508]: [Q9J6Z-09HRR] 10.100.2.1 [Update:SEND] 0.0.0.0/0 is filtered by route-map 'rm-VPNv4-filter-test'
Aug 18 17:56:59 R01 bgpd[512508]: [WHJ94-YXNE1] u29:s4 send UPDATE RD AS_NUMBER:13001 0.0.0.0/0 IPv4 vpn -- unreachable
Aug 18 17:56:59 R01 bgpd[512508]: [TN0HX-6G1RR] u29:s4 send UPDATE w/ attr: nexthop 0.0.0.0, localpref 0, community AS_NUMBER:1000 AS_NUMBER:30000 AS_NUMBER:40000 AS_NUMBER:40004, extcommunity RT:AS_NUMBER:10000 RT:AS_NUMBER:10600 RT:AS_NUMBER:10000, originator 10.100.1.1, path 39737
Aug 18 17:56:59 R01 bgpd[512508]: [H06SA-0JAPR] u29:s4 send MP_REACH for afi/safi IPv4/vpn
Aug 18 17:56:59 R01 bgpd[512508]: [HVRWP-5R9NQ] u29:s4 send UPDATE RD AS_NUMBER:10001 0.0.0.0/0 label 84 IPv4 vpn
Aug 18 17:57:02 R01 bgpd[512508]: [JQB4F-DXP0F] subgroup_announce_check: BGP_PATH_ANNC_NH_SELF, family=IPv4
Aug 18 17:57:02 R01 bgpd[512508]: [JQB4F-DXP0F] subgroup_announce_check: BGP_PATH_ANNC_NH_SELF, family=IPv4
Aug 18 17:57:02 R01 bgpd[512508]: [TN0HX-6G1RR] u30:s4 send UPDATE w/ attr: nexthop 0.0.0.0, localpref 0, community AS_NUMBER:1000 AS_NUMBER:30000 AS_NUMBER:40000 AS_NUMBER:40004, extcommunity RT:AS_NUMBER:10000 RT:AS_NUMBER:10600 RT:AS_NUMBER:10000, originator 10.100.1.1, path 39737
Aug 18 17:57:02 R01 bgpd[512508]: [H06SA-0JAPR] u30:s4 send MP_REACH for afi/safi IPv4/vpn
Aug 18 17:57:02 R01 bgpd[512508]: [HVRWP-5R9NQ] u30:s4 send UPDATE RD AS_NUMBER:10001 0.0.0.0/0 label 84 IPv4 vpn
Aug 18 17:57:03 R01 bgpd[512508]: [TN0HX-6G1RR] u30:s4 send UPDATE w/ attr: nexthop 0.0.0.0, localpref 0, metric 0, community graceful-shutdown, extcommunity RT:AS_NUMBER:11010 RT:AS_NUMBER:13990 RT:AS_NUMBER:13000, originator 10.100.1.1, path
Aug 18 17:57:03 R01 bgpd[512508]: [H06SA-0JAPR] u30:s4 send MP_REACH for afi/safi IPv4/vpn
Aug 18 17:57:03 R01 bgpd[512508]: [HVRWP-5R9NQ] u30:s4 send UPDATE RD AS_NUMBER:13001 0.0.0.0/0 label 86 IPv4 vpn


Aug 18 18:05:33 R01 bgpd[512508]: [JQB4F-DXP0F] subgroup_announce_check: BGP_PATH_ANNC_NH_SELF, family=IPv4
Aug 18 18:05:33 R01 bgpd[512508]: [Q9J6Z-09HRR] 10.100.2.1 [Update:SEND] 0.0.0.0/0 is filtered by route-map 'rm-VPNv4-filter-test'
Aug 18 18:05:34 R01 bgpd[512508]: [WHJ94-YXNE1] u33:s4 send UPDATE RD AS_NUMBER:13001 0.0.0.0/0 IPv4 vpn -- unreachable
Aug 18 18:05:34 R01 bgpd[512508]: [TN0HX-6G1RR] u33:s4 send UPDATE w/ attr: nexthop 0.0.0.0, localpref 0, community AS_NUMBER:1000 AS_NUMBER:30000 AS_NUMBER:40000 AS_NUMBER:40004, extcommunity RT:AS_NUMBER:10000 RT:AS_NUMBER:10600 RT:AS_NUMBER:10000, originator 10.100.1.1, path 39737
Aug 18 18:05:34 R01 bgpd[512508]: [H06SA-0JAPR] u33:s4 send MP_REACH for afi/safi IPv4/vpn
Aug 18 18:05:34 R01 bgpd[512508]: [HVRWP-5R9NQ] u33:s4 send UPDATE RD AS_NUMBER:10001 0.0.0.0/0 label 84 IPv4 vpn
Aug 18 18:05:36 R01 bgpd[512508]: [JQB4F-DXP0F] subgroup_announce_check: BGP_PATH_ANNC_NH_SELF, family=IPv4
Aug 18 18:05:36 R01 bgpd[512508]: [JQB4F-DXP0F] subgroup_announce_check: BGP_PATH_ANNC_NH_SELF, family=IPv4
Aug 18 18:05:36 R01 bgpd[512508]: [TN0HX-6G1RR] u34:s4 send UPDATE w/ attr: nexthop 0.0.0.0, localpref 0, community AS_NUMBER:1000 AS_NUMBER:30000 AS_NUMBER:40000 AS_NUMBER:40004, extcommunity RT:AS_NUMBER:10000 RT:AS_NUMBER:10600 RT:AS_NUMBER:10000, originator 10.100.1.1, path 39737
Aug 18 18:05:36 R01 bgpd[512508]: [H06SA-0JAPR] u34:s4 send MP_REACH for afi/safi IPv4/vpn
Aug 18 18:05:36 R01 bgpd[512508]: [HVRWP-5R9NQ] u34:s4 send UPDATE RD AS_NUMBER:10001 0.0.0.0/0 label 84 IPv4 vpn
Aug 18 18:05:37 R01 bgpd[512508]: [TN0HX-6G1RR] u34:s4 send UPDATE w/ attr: nexthop 0.0.0.0, localpref 0, metric 0, community graceful-shutdown, extcommunity RT:AS_NUMBER:11010 RT:AS_NUMBER:13990 RT:AS_NUMBER:13000, originator 10.100.1.1, path
Aug 18 18:05:37 R01 bgpd[512508]: [H06SA-0JAPR] u34:s4 send MP_REACH for afi/safi IPv4/vpn
Aug 18 18:05:37 R01 bgpd[512508]: [HVRWP-5R9NQ] u34:s4 send UPDATE RD AS_NUMBER:13001 0.0.0.0/0 label 86 IPv4 vpn

And my route:

R01(config-router-af)# do sh bgp vrf internet ipv4 0.0.0.0/0
BGP routing table entry for 0.0.0.0/0, version 82983778
Paths: (2 available, best #1, vrf internet)
  Not advertised to any peer
  39737
    89.47.225.225 from 89.47.225.225 (89.44.235.4)
      Origin IGP, localpref 200, valid, external, best (Local Pref)
      Community: AS_NUMBER:1000 AS_NUMBER:30000 AS_NUMBER:40000 AS_NUMBER:40004
      Extended Community: RT:AS_NUMBER:10000 RT:AS_NUMBER:10600
      Last update: Thu Aug 18 17:56:34 2022
  Imported from AS_NUMBER:10002:0.0.0.0/0
  Local
    10.100.2.1 (metric 10) from 0.0.0.0 (10.100.1.5) vrf default(0) announce-nh-self
      Origin incomplete, metric 0, localpref 100, valid, sourced, local
      Extended Community: RT:AS_NUMBER:10000 RT:AS_NUMBER:10600
      Remote label: 80
      Last update: Tue Aug  9 15:13:57 2022
R01(config-router-af)#

The route-map end extcommunity:

route-map rm-VPNv4-filter-test permit 1000
 match extcommunity VPN-export-to-remote-sites
exit

bgp extcommunity-list standard VPN-export-to-remote-sites seq 5 permit rt AS_NUMBER:10600

And I tried with this combinations:

bgp extcommunity-list expanded VPN-export-to-remote-sites-ex permit RT:AS_NUMBER:10600

or

bgp extcommunity-list expanded VPN-export-to-remote-sites-ex permit AS_NUMBER:10600

And changed the route-map to:

route-map rm-VPNv4-filter-test permit 1000
 match extcommunity VPN-export-to-remote-sites-ex
exit

The BGP config is similar:

router bgp AS_NUMBER
 neighbor 10.100.2.1 remote-as AS_NUMBER
 neighbor 10.100.2.1 description R02_VPNv4
 neighbor 10.100.2.1 bfd
 neighbor 10.100.2.1 bfd check-control-plane-failure
 neighbor 10.100.2.1 update-source 10.100.1.1
 address-family ipv4 unicast
  no neighbor 10.100.2.1 activate
 exit-address-family
!
 address-family ipv4 vpn
  neighbor 10.100.2.1 activate
  neighbor 10.100.2.1 soft-reconfiguration inbound
  neighbor 10.100.2.1 route-map rm-VPNv4-filter-test out
 exit-address-family
 !
..
exit

For me looks like the route-map doesn't match extcommunity attribute. As you can see the route has the "extcommunity RT:AS_NUMBER:10000 RT:AS_NUMBER:10600 .." set.