BGP Extended Community

What an extended community is

An extended community (RFC 4360) is the extended form of the “tag” attached to a route. Where the standard COMMUNITY is just a list of 4-byte values, an extended community is 8 bytes and begins with a type. The type decides the structure and meaning of the remaining bytes, and a bit inside the type decides whether it crosses an AS boundary.

Item	COMMUNITY	Extended community
Type code	8	16
Class	Optional transitive	Optional transitive
Length of one	4 bytes	8 bytes
Structure	Value only (by convention AS:value)	Type + value. The type fixes the structure
Crossing an AS	Always crosses (stopped with well-known `NO_EXPORT` and friends)	Decided by the transitive bit of the type
Typical use	Policy coordination chosen by the operator	Route Target, Site of Origin, Cost, Link Bandwidth, Color for MPLS L3VPN

The best-known use is the Route Target that controls route exchange between VRFs in MPLS L3VPN (RFC 4364), but the attribute itself has nothing to do with VPNs and can be attached to plain IPv4 unicast routes. This article examines the contents and the behaviour without using a VPN.

Format

The value of the attribute (Type code 16) is as many 8-byte extended communities as needed. One of them holds three things.

Field	Length	Content
Type high	1 byte	From the top bit: I (IANA allocation class), T (0 = transitive, 1 = non-transitive), and 6 bits that select the structure of the value
Type low (Sub-Type)	1 byte	The use within that structure (Route Target = 0x02, Route Origin = 0x03, and so on)
Value	6 bytes	Split according to the structure

There are four structures for the value.

Type high	Structure	Global Administrator	Local Administrator	Source
0x00 / 0x40	Two-octet AS specific	AS number (2 bytes)	4 bytes	RFC 4360 3.1
0x01 / 0x41	IPv4 address specific	IPv4 address (4 bytes)	2 bytes	RFC 4360 3.2
0x02 / 0x42	Four-octet AS specific	AS number (4 bytes)	2 bytes	RFC 5668
0x03 / 0x43	Opaque	(6 bytes defined per Sub-Type)		RFC 4360 3.3

The left of each “/” is transitive (T bit 0), the right non-transitive (T bit 1). The Global Administrator identifies the organization that assigned the value (by AS number or IPv4 address), and the Local Administrator is a number that organization chooses freely. On IOS XR the three are written as 65001:100 (two-octet AS), 10.0.0.1:200 (IPv4) and 1.2:300 (four-octet AS, 1.2 = 65538). An AS that has a two-octet AS number should use the two-octet AS specific form (RFC 5668 3).

The main types

Sub-Type values live in the IANA registry (organized by RFC 7153). These are the ones this article uses.

Name	Type high : Sub-Type	Transitive	Use
Route Target (RT)	0x00 / 0x01 / 0x02 : 0x02	Yes	“Which routers may receive this route” (RFC 4360 4). Decides VRF import / export in MPLS L3VPN
Route Origin (Site of Origin, SoO)	0x00 / 0x01 / 0x02 : 0x03	Yes	“Which router (site) injected this route” (RFC 4360 5). Used to avoid sending a route back to its own site
Color	0x03 : 0x0B	Yes	Colours a route (for example to select a Segment Routing policy)
Link Bandwidth	0x40 : 0x04	No	Bandwidth of an eBGP link. Used to weight multipath
Cost Community	0x43 : 0x01 (also registered as 0x03 : 0x01)	No	Cisco specific (registered at IANA as an Internet-Draft). Adds a cost to best-path selection. Inside iBGP and a confederation only

Behaviour (RFC 4360 6)

Rule	Detail
A non-transitive one should be removed at an AS boundary (SHOULD)	Link Bandwidth and Cost do not reach the neighbouring AS. They are not removed at a confederation boundary
The receiver may attach or rewrite the attribute (MAY)	Policy can handle it freely
COMMUNITY and this attribute can coexist	Type 8 and Type 16 appear in the same UPDATE and follow RFC 1997 and RFC 4360 respectively
Aggregation	Without `ATOMIC_AGGREGATE`, the aggregate carries the union of the components’ extended communities (default)
Best-path selection	MUST NOT be used in a way that creates forwarding loops

IOS XR does not send extended communities to an eBGP peer by default. The neighbour’s address-family needs send-extended-community-ebgp (separate from send-community-ebgp for the standard COMMUNITY). They are sent to iBGP by default.

Configuration on IOS XR

Attaching extended communities (R1)
extcommunity-set rt RT-R1
  65001:100
end-set
extcommunity-set soo SOO-SITE1
  65001:1
end-set
route-policy TO-R2
  set extcommunity rt RT-R1
  set extcommunity soo SOO-SITE1 additive
  pass
end-policy
!
router bgp 65001
 neighbor 10.1.2.2
  address-family ipv4 unicast
   send-extended-community-ebgp
   route-policy TO-R2 out

Matching on an extended community (R2)
extcommunity-set rt RT-R1
  65001:100
end-set
route-policy PASS-ALL
  if extcommunity rt matches-any RT-R1 then
    set local-preference 200
  endif
  pass
end-policy

Item	Detail
`extcommunity-set rt` / `soo` / `opaque` / `bandwidth` / `cost`	Defines a set of values per type
`set extcommunity <type> <set name>`	Attaches it. The second and later ones need `additive` (below)
`extcommunity rt matches-any <set name>`	Match condition. `matches-every` and `soo` work the same way
`delete extcommunity rt in <set name>`	Removes it
`show bgp <prefix>`	The `Extended community:` line shows them as `RT:65001:100`

Without additive, set extcommunity replaces the whole extended communities attribute, not just that type. Listing several types without it means each line erases the previous one. Always add additive from the second line onward.

Verification on real devices

Verified with four XRd 26.1.1 routers.

BGP extended community verification topology

R1 (AS 65001) and R2 (AS 65002) run eBGP, R2 and R3 run iBGP (Loopback0 to Loopback0, next-hop-self, OSPF), R3 and R4 (AS 65003) run eBGP
Each router advertises 192.168.N.0/24 on Loopback1 with a network statement. R1 attaches extended communities to 192.168.1.0/24 and we follow how R2, R3 and R4 see them
Outbound policies have a different name per neighbour (all just pass); every neighbour has soft-reconfiguration inbound always and every eBGP neighbour has send-community-ebgp. send-extended-community-ebgp is present on R3 - R4 from the start, and added to R1 → R2 in STEP 2

STEP summary

STEP	Change	What was checked	Result	Main evidence
0	No extended community	Initial state	No `Extended community:` line, and no Type 16 in the UPDATE	R2 `show bgp 192.168.1.0/24`, pcap
1	R1 attaches `RT:65001:100` (no `send-extended-community-ebgp`)	Is it sent over eBGP	It is not. Nothing reaches R2 and the UPDATE has no Type 16	R2 `show bgp 192.168.1.0/24`, pcap
2	`send-extended-community-ebgp` on R1	Encoding and reach	Arrives as Type 0x00 / Sub-Type 0x02 and reaches R3 (iBGP) and R4 (another AS)	pcap No.1, R4 `show bgp 192.168.1.0/24`
3	Attach RT in three structures, SoO, Color, Link Bandwidth, Cost and COMMUNITY	Encoding of each structure	All four structures sit in one attribute. The two non-transitive ones are dropped at the first eBGP hop	pcap No.49, R2 and R4 `show bgp 192.168.1.0/24`
4	R2 attaches Link Bandwidth and Cost inbound	Reach of non-transitive ones	They survive inside AS 65002 (iBGP) and are dropped at the AS boundary (R3 → R4)	pcap (7 on R2-R3, 5 on R3-R4)
5	R2 sets `LOCAL_PREF 200` when the RT matches, inbound	Matching in policy	`192.168.1.0/24` becomes 200 on R2 and R3	R2 and R3 `show bgp`
6	R3 drops outbound when the SoO matches	Suppressing an advertisement with SoO	`192.168.1.0/24` disappears from R4 and a WITHDRAW is sent	R4 `show bgp`, pcap No.1
7	Restore the STEP 5 and 6 policies (final state)	Recovery	The route and its extended communities return to R4	R4 `show bgp 192.168.1.0/24`

STEP 0: no extended community

192.168.1.0/24 as received by R2. There is no Extended community: line.

R2 show bgp 192.168.1.0/24 (STEP 0)
RP/0/RP0/CPU0:R2#show bgp 192.168.1.0/24
Thu Sep 10 04:05:33.616 UTC
<snip>
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  65001, (received & used)
    10.1.2.1 from 10.1.2.1 (10.0.0.1)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 17
      Origin-AS validity: (disabled)

The UPDATEs between R1 and R2 carry no attribute Type 16 either.

R1-R2 packet capture (STEP 0, tshark list)
32.336113     10.1.2.1 → 10.1.2.2     BGP 137 UPDATE Message, UPDATE Message
32.338147     10.1.2.2 → 10.1.2.1     BGP 190 UPDATE Message, UPDATE Message, UPDATE Message
62.334336     10.1.2.2 → 10.1.2.1     BGP 130 UPDATE Message, KEEPALIVE Message

STEP 1: attaching it is not enough for eBGP

R1 attaches RT:65001:100 in its outbound policy.

R1
extcommunity-set rt RT-R1
  65001:100
end-set
route-policy TO-R2
  set extcommunity rt RT-R1
  pass
end-policy

R1 show rpl route-policy TO-R2 (STEP 1)
RP/0/RP0/CPU0:R1#show rpl route-policy TO-R2
Thu Sep 10 04:08:57.030 UTC
route-policy TO-R2
  set extcommunity rt RT-R1
  pass
end-policy
!

The policy is in place, but 192.168.1.0/24 on R2 is unchanged from STEP 0.

R2 show bgp 192.168.1.0/24 (STEP 1)
RP/0/RP0/CPU0:R2#show bgp 192.168.1.0/24
Thu Sep 10 04:09:16.789 UTC
<snip>
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  65001, (received & used)
    10.1.2.1 from 10.1.2.1 (10.0.0.1)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 17
      Origin-AS validity: (disabled)

There is no Type 16 in the UPDATE either, because IOS XR does not send extended communities to an eBGP peer by default.

R1-R2 packet capture (STEP 1, tshark list)
    3  10.407532     10.1.2.1 → 10.1.2.2     BGP 133 UPDATE Message, KEEPALIVE Message

STEP 2: `send-extended-community-ebgp` delivers it

One line is added to R1’s neighbour configuration.

R1
router bgp 65001
 neighbor 10.1.2.2
  address-family ipv4 unicast
   send-extended-community-ebgp

The UPDATE R1 sent (No.1 in the R1-R2 capture). The attribute flags are 0xc0 (Optional / Transitive), Type high is 0x00 (two-octet AS specific, transitive), the Sub-Type is 0x02 (Route Target), the Global Administrator holds 65001 and the Local Administrator 100.

No.1 UPDATE (R1 → R2) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 71
    Type: UPDATE Message (2)
<snip>
        Path Attribute - EXTENDED_COMMUNITIES
            Flags: 0xc0, Optional, Transitive, Complete
            Type Code: EXTENDED_COMMUNITIES (16)
            Length: 8
            Carried extended communities: (1 community)
                Route Target: 65001:100 [Transitive 2-Octet AS-Specific]
                    Type: Transitive 2-Octet AS-Specific (0x00)
                    Subtype (AS2): Route Target (0x02)
                    2-Octet AS: 65001
                    4-Octet AN: 100

Download the pcap of the packet in the tshark output above (No.1 UPDATE)

RT:65001:100 is now on R2.

R2 show bgp 192.168.1.0/24 (STEP 2)
RP/0/RP0/CPU0:R2#show bgp 192.168.1.0/24
Thu Sep 10 04:12:54.340 UTC
<snip>
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  65001, (received & used)
    10.1.2.1 from 10.1.2.1 (10.0.0.1)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 19
      Extended community: RT:65001:100 
      Origin-AS validity: (disabled)

A Route Target is transitive, so the same value reaches R4 in AS 65003 through R3 (iBGP).

R4 show bgp 192.168.1.0/24 (STEP 2)
RP/0/RP0/CPU0:R4#show bgp 192.168.1.0/24
Thu Sep 10 04:13:40.681 UTC
<snip>
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65001, (received & used)
    10.3.4.3 from 10.3.4.3 (10.0.0.3)
      Origin IGP, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 13
      Extended community: RT:65001:100 
      Origin-AS validity: (disabled)

STEP 3: the four structures, transitive and non-transitive

R1 attaches RT in three structures together with SoO, Color, Link Bandwidth, Cost and the standard COMMUNITY. The second and later lines need additive.

R1
extcommunity-set rt RT-R1
  65001:100,
  10.0.0.1:200,
  1.2:300
end-set
extcommunity-set soo SOO-SITE1
  65001:1
end-set
extcommunity-set opaque COLOR-R1
  42
end-set
extcommunity-set bandwidth BW-R1
  65001:1000
end-set
extcommunity-set cost COST-R1
  igp:1:100
end-set
route-policy TO-R2
  set extcommunity rt RT-R1
  set extcommunity soo SOO-SITE1 additive
  set extcommunity color COLOR-R1 additive
  set extcommunity bandwidth BW-R1 additive
  set extcommunity cost COST-R1 additive
  set community (65001:1)
  pass
end-policy

R1 show rpl route-policy TO-R2 (STEP 3)
RP/0/RP0/CPU0:R1#show rpl route-policy TO-R2
Thu Sep 10 04:30:23.622 UTC
route-policy TO-R2
  set extcommunity rt RT-R1
  set extcommunity soo SOO-SITE1 additive
  set extcommunity color COLOR-R1 additive
  set extcommunity bandwidth BW-R1 additive
  set extcommunity cost COST-R1 additive
  set community (65001:1)
  pass
end-policy
!

The UPDATE R1 sent (No.49). One attribute carries five extended communities, and the Type high values 0x00 (two-octet AS specific), 0x01 (IPv4 address specific), 0x02 (four-octet AS specific) and 0x03 (opaque) cover all four structures. 1.2:300 is expanded as 65538 (1×65536+2) in the four-octet AS specific form.

No.49 UPDATE (R1 → R2) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 110
    Type: UPDATE Message (2)
<snip>
        Path Attribute - EXTENDED_COMMUNITIES
            Flags: 0xc0, Optional, Transitive, Complete
            Type Code: EXTENDED_COMMUNITIES (16)
            Length: 40
            Carried extended communities: (5 communities)
                Route Target: 65001:100 [Transitive 2-Octet AS-Specific]
                    Type: Transitive 2-Octet AS-Specific (0x00)
                    Subtype (AS2): Route Target (0x02)
                    2-Octet AS: 65001
                    4-Octet AN: 100
                Route Origin: 65001:1 [Transitive 2-Octet AS-Specific]
                    Type: Transitive 2-Octet AS-Specific (0x00)
                    Subtype (AS2): Route Origin (0x03)
                    2-Octet AS: 65001
                    4-Octet AN: 1
                Route Target: 10.0.0.1:200 [Transitive IPv4-Address-Specific]
                    Type: Transitive IPv4-Address-Specific (0x01)
                    Subtype (IPv4): Route Target (0x02)
                    IPv4 address: 10.0.0.1
                    2-Octet AN: 200
                Route Target: 1.2(65538):300 [Transitive 4-Octet AS-Specific]
                    Type: Transitive 4-Octet AS-Specific (0x02)
                    Subtype (AS4): Route Target (0x02)
                    4-Octet AS: 65538
                    2-Octet AN: 300
                Color: 0x0000 0x0000 0x002a [Transitive Opaque]
                    Type: Transitive Opaque (0x03)
                    Subtype (Opaque): Color (0x0b)

Download the pcap of the packet in the tshark output above (No.49 UPDATE)

R2 received those five, with the standard COMMUNITY on a separate line. The Link Bandwidth and Cost that were configured are not there. Both are non-transitive, and R1 - R2 is an AS boundary (eBGP), so R1 removed them on the way out.

R2 show bgp 192.168.1.0/24 (STEP 3)
RP/0/RP0/CPU0:R2#show bgp 192.168.1.0/24
Thu Sep 10 04:30:42.437 UTC
<snip>
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.0.0.3        
  65001, (received & used)
    10.1.2.1 from 10.1.2.1 (10.0.0.1)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 24
      Community: 65001:1
      Extended community: SoO:65001:1 Color:42 RT:65001:100 RT:10.0.0.1:200 RT:65538:300 
      Origin-AS validity: (disabled)

R4 sees the same five.

R4 show bgp 192.168.1.0/24 (STEP 3)
RP/0/RP0/CPU0:R4#show bgp 192.168.1.0/24
Thu Sep 10 04:31:29.436 UTC
<snip>
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65001, (received & used)
    10.3.4.3 from 10.3.4.3 (10.0.0.3)
      Origin IGP, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 18
      Community: 65001:1
      Extended community: SoO:65001:1 Color:42 RT:65001:100 RT:10.0.0.1:200 RT:65538:300 
      Origin-AS validity: (disabled)

STEP 4: non-transitive ones survive inside an AS

To see a non-transitive one surviving inside an AS, R2 — the entry point of AS 65002 — attaches Link Bandwidth and Cost in its inbound policy.

R2
extcommunity-set bandwidth BW-R2
  65002:2000
end-set
extcommunity-set cost COST-R2
  igp:1:100
end-set
route-policy PASS-ALL
  set extcommunity bandwidth BW-R2 additive
  set extcommunity cost COST-R2 additive
  pass
end-policy

R2 show rpl route-policy PASS-ALL (STEP 4)
RP/0/RP0/CPU0:R2#show rpl route-policy PASS-ALL
Thu Sep 10 04:37:22.409 UTC
route-policy PASS-ALL
  set extcommunity bandwidth BW-R2 additive
  set extcommunity cost COST-R2 additive
  pass
end-policy
!

R3, inside the same AS, receives seven of them including LB:65002:16 and COST:129:1:100.

R3 show bgp 192.168.1.0/24 (STEP 4)
RP/0/RP0/CPU0:R3#show bgp 192.168.1.0/24
Thu Sep 10 04:37:40.290 UTC
<snip>
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.3.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.3.4.4        
  65001, (received & used)
    10.0.0.2 (metric 2) from 10.0.0.2 (10.0.0.2)
      Origin IGP, metric 0, localpref 100, valid, internal, best, group-best
      Received Path ID 0, Local Path ID 1, version 33
      Community: 65001:1
      Extended community: SoO:65001:1 Color:42 LB:65002:16 COST:129:1:100 RT:65001:100 RT:10.0.0.1:200 RT:65538:300 
                          (LB non-transitive AS:bytes/sec:65002:2000.000)

Expanding the UPDATE between R2 and R3 shows Cost as Non-Transitive Opaque (0x43) / Cost Community (0x01) and Link Bandwidth as Non-Transitive 2-Octet AS-Specific (0x40) / Link Bandwidth (0x04).

No.1 UPDATE (R2 → R3, iBGP) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 133
    Type: UPDATE Message (2)
<snip>
            Carried extended communities: (7 communities)
                Route Origin: 65001:1 [Transitive 2-Octet AS-Specific]
                    Type: Transitive 2-Octet AS-Specific (0x00)
                    Subtype (AS2): Route Origin (0x03)
                    2-Octet AS: 65001
                    4-Octet AN: 1
                Color: 0x0000 0x0000 0x002a [Transitive Opaque]
                    Type: Transitive Opaque (0x03)
                    Subtype (Opaque): Color (0x0b)
                    Raw Value: 0x0000 0x0000 0x002a
                Cost Community: 100, POI: "Smallest IGP Metric" step (Evaluated after) [Non-Transitive Opaque]
                    Type: Non-Transitive Opaque (0x43)
                    Subtype (Non-transitive Opaque): Cost Community (0x01)
                    Point of insertion: "Smallest IGP Metric" step (129)
                    Community ID: 1
                    Cost: 100 (Evaluated after the original attribute value)
                Route Target: 1.2(65538):300 [Transitive 4-Octet AS-Specific]
                    Type: Transitive 4-Octet AS-Specific (0x02)
                    Subtype (AS4): Route Target (0x02)
                    4-Octet AS: 65538
                    2-Octet AN: 300
                Route Target: 10.0.0.1:200 [Transitive IPv4-Address-Specific]
                    Type: Transitive IPv4-Address-Specific (0x01)
                    Subtype (IPv4): Route Target (0x02)
                    IPv4 address: 10.0.0.1
                    2-Octet AN: 200
                Route Target: 65001:100 [Transitive 2-Octet AS-Specific]
                    Type: Transitive 2-Octet AS-Specific (0x00)
                    Subtype (AS2): Route Target (0x02)
                    2-Octet AS: 65001
                    4-Octet AN: 100
                Link Bandwidth: ASN 65002, 0.016 Mbps [Non-Transitive 2-Octet AS-Specific]
                    Type: Non-Transitive 2-Octet AS-Specific (0x40)
                    Subtype (Non-transitive AS2): Link Bandwidth (0x04)

Download the pcap of the packet in the tshark output above (No.1 UPDATE)

Crossing the AS boundary from R3 to R4 leaves five: the two non-transitive ones are gone.

No.1 UPDATE (R3 → R4, eBGP) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 107
    Type: UPDATE Message (2)
<snip>
            Carried extended communities: (5 communities)
                Route Origin: 65001:1 [Transitive 2-Octet AS-Specific]
                    Type: Transitive 2-Octet AS-Specific (0x00)
                    Subtype (AS2): Route Origin (0x03)
                    2-Octet AS: 65001
                    4-Octet AN: 1
                Color: 0x0000 0x0000 0x002a [Transitive Opaque]
                    Type: Transitive Opaque (0x03)
                    Subtype (Opaque): Color (0x0b)
                    Raw Value: 0x0000 0x0000 0x002a
                Route Target: 65001:100 [Transitive 2-Octet AS-Specific]
                    Type: Transitive 2-Octet AS-Specific (0x00)
                    Subtype (AS2): Route Target (0x02)
                    2-Octet AS: 65001
                    4-Octet AN: 100
                Route Target: 10.0.0.1:200 [Transitive IPv4-Address-Specific]
                    Type: Transitive IPv4-Address-Specific (0x01)
                    Subtype (IPv4): Route Target (0x02)
                    IPv4 address: 10.0.0.1
                    2-Octet AN: 200
                Route Target: 1.2(65538):300 [Transitive 4-Octet AS-Specific]
                    Type: Transitive 4-Octet AS-Specific (0x02)
                    Subtype (AS4): Route Target (0x02)

Download the pcap of the packet in the tshark output above (No.1 UPDATE)

R4’s table also shows five.

R4 show bgp 192.168.1.0/24 (STEP 4)
RP/0/RP0/CPU0:R4#show bgp 192.168.1.0/24
Thu Sep 10 04:38:04.185 UTC
<snip>
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65001, (received & used)
    10.3.4.3 from 10.3.4.3 (10.0.0.3)
      Origin IGP, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 18
      Community: 65001:1
      Extended community: SoO:65001:1 Color:42 RT:65001:100 RT:10.0.0.1:200 RT:65538:300 
      Origin-AS validity: (disabled)

STEP 5: matching on a Route Target

R2’s inbound policy gets a condition that raises LOCAL_PREF to 200 when the RT matches.

R2
extcommunity-set rt RT-FROM-R1
  65001:100
end-set
route-policy PASS-ALL
  set extcommunity bandwidth BW-R2 additive
  set extcommunity cost COST-R2 additive
  if extcommunity rt matches-any RT-FROM-R1 then
    set local-preference 200
  endif
  pass
end-policy

R2 show rpl route-policy PASS-ALL (STEP 5)
RP/0/RP0/CPU0:R2#show rpl route-policy PASS-ALL
Thu Sep 10 04:41:18.183 UTC
route-policy PASS-ALL
  set extcommunity bandwidth BW-R2 additive
  set extcommunity cost COST-R2 additive
  if extcommunity rt matches-any RT-FROM-R1 then
    set local-preference 200
  endif
  pass
end-policy
!

192.168.1.0/24 on R2 becomes LocPrf 200, and iBGP carries that to R3.

R2 show bgp (STEP 5)
RP/0/RP0/CPU0:R2#show bgp
Thu Sep 10 04:41:13.302 UTC
BGP router identifier 10.0.0.2, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0000000   RD version: 26
BGP main routing table version 26
BGP NSR Initial initsync version 4 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0/24     10.1.2.1                 0    200      0 65001 i
*> 192.168.2.0/24     0.0.0.0                  0         32768 i
*>i192.168.3.0/24     10.0.0.3                 0    100      0 i
*>i192.168.4.0/24     10.0.0.3                 0    100      0 65003 i

Processed 4 prefixes, 4 paths

R3 show bgp (STEP 5)
RP/0/RP0/CPU0:R3#show bgp
Thu Sep 10 04:41:36.503 UTC
BGP router identifier 10.0.0.3, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0000000   RD version: 34
BGP main routing table version 34
BGP NSR Initial initsync version 3 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*>i192.168.1.0/24     10.0.0.2                 0    200      0 65001 i
*>i192.168.2.0/24     10.0.0.2                 0    100      0 i
*> 192.168.3.0/24     0.0.0.0                  0         32768 i
*> 192.168.4.0/24     10.3.4.4                 0             0 65003 i

Processed 4 prefixes, 4 paths

STEP 6: stopping an advertisement with SoO

An SoO says which site injected the route, so refusing to advertise routes carrying a given value keeps a route from going back to its own site. R3 drops outbound when the SoO matches.

R3
extcommunity-set soo SOO-SITE1
  65001:1
end-set
route-policy TO-R4
  if extcommunity soo matches-any SOO-SITE1 then
    drop
  endif
  pass
end-policy

R3 show rpl route-policy TO-R4 (STEP 6)
RP/0/RP0/CPU0:R3#show rpl route-policy TO-R4
Thu Sep 10 04:45:05.927 UTC
route-policy TO-R4
  if extcommunity soo matches-any SOO-SITE1 then
    drop
  endif
  pass
end-policy
!

192.168.1.0/24 is gone from R4.

R4 show bgp (STEP 6)
RP/0/RP0/CPU0:R4#show bgp
Thu Sep 10 04:45:24.342 UTC
BGP router identifier 10.0.0.4, local AS number 65003
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0000000   RD version: 19
BGP main routing table version 19
BGP NSR Initial initsync version 6 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*> 192.168.2.0/24     10.3.4.3                               0 65002 i
*> 192.168.3.0/24     10.3.4.3                 0             0 65002 i
*> 192.168.4.0/24     0.0.0.0                  0         32768 i

Processed 3 prefixes, 3 paths

The UPDATE from R3 to R4 is a WITHDRAW.

No.1 UPDATE (R3 → R4, WITHDRAW) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 27
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 4
    Withdrawn Routes
        192.168.1.0/24
            Withdrawn route prefix length: 24
            Withdrawn prefix: 192.168.1.0

Download the pcap of the packet in the tshark output above (No.1 WITHDRAW)

STEP 7: restoring the policies (final state)

Returning R2’s PASS-ALL and R3’s TO-R4 to just pass brings the route and its extended communities back to R4.

R4 show bgp (final state)
RP/0/RP0/CPU0:R4#show bgp
Thu Sep 10 04:50:03.569 UTC
BGP router identifier 10.0.0.4, local AS number 65003
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0000000   RD version: 20
BGP main routing table version 20
BGP NSR Initial initsync version 6 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0/24     10.3.4.3                               0 65002 65001 i
*> 192.168.2.0/24     10.3.4.3                               0 65002 i
*> 192.168.3.0/24     10.3.4.3                 0             0 65002 i
*> 192.168.4.0/24     0.0.0.0                  0         32768 i

Processed 4 prefixes, 4 paths

R4 show bgp 192.168.1.0/24 (final state)
RP/0/RP0/CPU0:R4#show bgp 192.168.1.0/24
Thu Sep 10 04:50:03.756 UTC
<snip>
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65001, (received & used)
    10.3.4.3 from 10.3.4.3 (10.0.0.3)
      Origin IGP, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 20
      Community: 65001:1
      Extended community: SoO:65001:1 Color:42 RT:65001:100 RT:10.0.0.1:200 RT:65538:300 
      Origin-AS validity: (disabled)

Summary of the verification

IOS XR does not send extended communities to an eBGP peer by default; send-extended-community-ebgp is required (STEP 1, 2)
One attribute can mix all four structures (0x00 / 0x01 / 0x02 / 0x03) (STEP 3)
The transitive RT, SoO and Color cross an AS boundary; the non-transitive Link Bandwidth and Cost do not. They survive inside an AS (iBGP) and are removed at the eBGP boundary (STEP 3, 4)
set extcommunity replaces the whole attribute without additive. Different types do not coexist on their own (STEP 3)
RT and SoO work as match conditions with extcommunity rt matches-any and soo matches-any even without a VPN (STEP 5, 6)

Verification config and show output

Each STEP captures three kinds of file from all four routers. The verification config is the ..._run.txt (final state: STEP 7).

File	Content
`..._show.txt`	`show version` / `show interface description` / `show route` / `show bgp summary` / `show bgp` / `show bgp <prefix>` (four) / `show bgp neighbors` / `show bgp update-group` / `show ospf neighbor` / per-peer `advertised-routes`, `routes`, `received routes` / `show rpl route-policy` / `show rpl extcommunity-set`
`..._log.txt`	`show logging` limited to that STEP (a `logmsg` marker at the start of each STEP, its time passed to `show logging start`)
`..._run.txt`	`show running-config` at that STEP (the verification config of that STEP)

STEP 0: no extended community

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

STEP 1: R1 attaches an RT (no send-extended-community-ebgp)

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

STEP 2: send-extended-community-ebgp on R1

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

STEP 3: attach RT in three structures, SoO, Color, Link Bandwidth, Cost and COMMUNITY

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

STEP 4: R2 attaches Link Bandwidth and Cost inbound

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

STEP 5: R2 sets LOCAL_PREF 200 when the RT matches

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

STEP 6: R3 drops outbound when the SoO matches

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

STEP 7: restore the policies (final state)

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run

Packet captures were taken per STEP ("—" where that link was not captured).

STEP	R1-R2	R2-R3	R3-R4
0	pcap	—	pcap
1	pcap	—	—
2	pcap	—	pcap
3	pcap	pcap	pcap
4	pcap	pcap	pcap
5	—	pcap	—
6	—	—	pcap

References

Document	Title	Summary
RFC 4360	BGP Extended Communities Attribute	The attribute (2), the three structures (3), Route Target (4), Route Origin (5), operational rules (6)
RFC 5668	4-Octet AS Specific BGP Extended Community	The four-octet AS specific structure (Type high 0x02 / 0x42)
RFC 7153	IANA Registries for BGP Extended Communities	Organizes the Type and Sub-Type registries
RFC 4364	BGP/MPLS IP Virtual Private Networks (VPNs)	How Route Target and Site of Origin are used (4.3.1, 4.3.5)
RFC 1997	BGP Communities Attribute	The standard COMMUNITY
IANA BGP Extended Communities	Border Gateway Protocol (BGP) Extended Communities	The list of Types and Sub-Types

What an extended community is

Format

The main types

Behaviour (RFC 4360 6)

Configuration on IOS XR

Verification on real devices

STEP summary

STEP 0: no extended community

STEP 1: attaching it is not enough for eBGP

STEP 2: send-extended-community-ebgp delivers it

STEP 3: the four structures, transitive and non-transitive

STEP 4: non-transitive ones survive inside an AS

STEP 5: matching on a Route Target

STEP 6: stopping an advertisement with SoO

STEP 7: restoring the policies (final state)

Summary of the verification

Verification config and show output

References

Related articles

STEP 2: `send-extended-community-ebgp` delivers it