| Internet-Draft | BGP Signaled Prefix-List | August 2024 |
| Nayman | Expires 11 February 2025 | [Page] |
This document defines a new BGP extended community attribute, termed the "Prefix-List Community," which allows the dynamic assignment of prefixes to named prefix-lists via BGP signaling. The proposed extension enhances the configuration and operational flexibility of prefix-lists in routing policies by associating them with community attributes directly within BGP routes.¶
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 2 February 2025.¶
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
In modern networks, routing policies, access control lists or filters often utilize prefix-lists to simplify configuration by allowing a set of IP prefixes to be referenced by a single name or identifier. Prefix-lists can include multiple IPv4 or IPv6 addresses, which are then applied consistently across various routing policies.¶
The general structure for defining a prefix-list is as follows:¶
prefix-list <name> <prefix>
¶
In this context, <name> represents a user-defined identifier for the prefix-list, and <prefix> specifies the exact IP prefix.¶
To configure a prefix-list for one or more IP prefixes, the following configuration can be used:¶
prefix-list PREFIX-1 192.168.1.0/24
prefix-list PREFIX-1 192.168.2.0/24
¶
To match no routes, a prefix-list might be configured as:¶
prefix-list PREFIX-NULL 0.0.0.0/32
¶
To match all routes, the configuration might be:¶
prefix-list PREFIX-ANY 0.0.0.0/0
¶
This document proposes a new BGP signaled mechanism to dynamically assign prefixes to prefix-lists using a new BGP extended community attribute, referred to as the "Prefix-List Community."¶
In modern networks, managing prefix-lists manually can be cumbersome and error-prone. The proposed BGP signaled mechanism aims to automate this process, enhancing operational efficiency and reducing configuration errors.¶
The Prefix-List Community attribute is a Non-Transitive Extended Community that enables routers to dynamically assign received prefixes to preconfigured prefix-lists. The attribute can be utilized in both IPv4 and IPv6 address families.¶
The Prefix-List Community attribute is encoded as a Type-Length-Value (TLV) structure, where the Type field indicates the community type, the Length field specifies the length of the value, and the Value field contains the prefix-list identifier.¶
When a router receives a BGP route with the Prefix-List Community attribute, it will automatically assign the route to the corresponding preconfigured prefix-list. For example:¶
- A router receives the routes "192.168.1.0/24", "192.168.2.0/24", and "192.168.3.0/24" with the community attribute "prefix:100:100".¶
- Another route, "172.16.0.0/12", is received with the community attribute "prefix:200:200".¶
The routes will be automatically assigned to the corresponding preconfigured prefix-lists as follows:¶
prefix-list PREFIX-1 prefix:100:100
prefix-list PREFIX-2 prefix:200:200
¶
The Prefix-List Community attribute can be signaled in BGP updates within the following Address Family Identifier (AFI) and Subsequent Address Family Identifier (SAFI) combinations:¶
- AFI=1, SAFI=1, IPv4 unicast: Used for standard IPv4 unicast routing¶
- AFI=1, SAFI=128, L3VPN IPv4 unicast: Used for L3VPN IPv4 unicast routing¶
- AFI=2, SAFI=1, IPv6 unicast: Used for standard IPv6 unicast routing¶
- AFI=2, SAFI=128, L3VPN IPv6 unicast: Used for L3VPN IPv6 unicast routing¶
- AFI=1, SAFI=4, labeled IPv4: Used for labeled IPv4 routing¶
- AFI=2, SAFI=4, labeled IPv6 (6PE): Used for labeled IPv6 routing¶
The operational behavior of a router with the Prefix-List Community attribute is as follows:¶
- Route Processing: A route received with only the Prefix-List Community attribute will be installed if there is a valid next-hop resolution. If the next-hop is invalid or cannot be resolved, the route may be placed into a hidden table but will still be used for prefix-list assignment.¶
- Interaction with Other Communities: If a route is received with both the Prefix-List Community attribute and other community attributes, the router will process it as per standard BGP processing rules defined in [RFC4271].¶
The Prefix-List Community attribute is a Non-Transitive Extended Community and should be treated with the same security considerations as other BGP extended communities. Care should be taken to ensure that only authorized routers and networks utilize this attribute to prevent unauthorized or malicious routing changes.¶
To prevent unauthorized use of the Prefix-List Community attribute, it is recommended to implement a filter or access control lists (ACLs) and BGP authentication mechanisms by implementing session protection through TTL security [RFC5082], TCP Authentication Option (TCP-AO) or Message Digest Algorithm 5 (MD5) and control-plane filtering. [RFC7574].¶
This document requests the allocation of a new BGP Extended Community Type for the Prefix-List Community attribute from the IANA "BGP Extended Communities" registry.¶
AFI: Address Family Identifier¶
BGP: Border Gateway Protocol¶
IP: Internet Protocol¶
IPv4: Internet Protocol version 4¶
IPv6: Internet Protocol version 6¶
NLRI: Network Layer Reachability Information¶
VPN: Virtual Private Network¶
SAFI: Subsequent Address Family Identifier¶
The author would like to thank the IETF community for their valuable feedback and suggestions.¶