🏷️ BGP Communities Explained
How a simple 32-bit tag attached to a route lets networks encode routing policy, control advertisement scope, and coordinate traffic engineering with their neighbors.
- Quick Answer
- Key Takeaways
- What Are BGP Communities?
- Why It Matters
- How It Works
- Architecture & Technical Detail
- Step-by-Step Process
- Visual Flow
- Practical Examples
- Real-World Use Cases
- Advantages
- Disadvantages & Risks
- Best Practices
- Security Considerations
- Performance Considerations
- Common Problems
- Troubleshooting
- Implementation Checklist
- Expert Tips
- Beginner Mistakes
- Comparison Tables
- Feature Table
- Key Terms Glossary
- FAQs
- Conclusion
This guide explains the different community formats, how they're actually used in practice, and how to read and apply the community conventions a network publishes for its customers and peers.
- Communities are optional route tags whose meaning is defined by local or mutually agreed-upon policy, not the BGP protocol itself.
- Standard communities are 32 bits; extended and large communities extend the format for more structured, larger-scale use cases.
- A small set of well-known communities (NO-EXPORT, NO-ADVERTISE, NO-PEER) have standardized, universal meaning.
- Most communities are used for one of three purposes: informational tagging, filtering/scoping, or traffic engineering.
- Transit providers commonly publish customer-usable communities that let customers influence their own route's local preference or propagation scope.
- Community-based export policy is the standard mechanism for preventing route leaks at scale.
🔍 What Are BGP Communities?
A BGP community is an optional transitive attribute that can be attached to a route, consisting of a numeric value that carries whatever meaning the networks using it choose to assign. Unlike core BGP attributes like AS-PATH or NEXT-HOP, which have fixed, protocol-defined behavior, a community's effect entirely depends on policy explicitly configured on a receiving router — the community itself is inert until something is configured to act on it.
The original (and still widely used) community format, defined in RFC 1997, is a 32-bit value conventionally written as two 16-bit numbers separated by a colon, such as 65000:100, where the first number is typically the AS number of the network defining the community's meaning, and the second number is a locally-assigned code for a specific policy action within that network's scheme.
This "AS:value" convention is a widely followed best practice, not a protocol requirement, but it serves an important practical purpose: it immediately tells anyone looking at a route's communities which network's documentation to consult to understand what that specific value means, since community meanings are defined per-network rather than globally (aside from the small set of standardized well-known communities).
Two extended formats address limitations of the original 32-bit community. Extended communities (RFC 4360) use a 64-bit value with a structured type field, commonly used for more complex applications like VPN route targets in MPLS networks. Large communities (RFC 8092) use three 32-bit fields instead of two 16-bit ones, specifically introduced to accommodate 4-byte ASNs (which became common as the original 2-byte ASN space filled up) that don't fit cleanly into the original 16-bit community format.
🎯 Why Communities Matter
Communities are the primary mechanism that makes sophisticated, maintainable BGP policy possible at scale. Without them, implementing something like "only advertise customer routes to Provider A, but advertise customer and peer routes to Provider B" would require manually maintaining and updating explicit prefix lists for every export policy — a brittle, error-prone approach that scales poorly as a network's customer base changes constantly.
With communities, a network instead tags every route once, at the point it's learned (customer route gets a "customer" community, peer route gets a "peer" community, and so on), and then writes export policy declaratively based on those tags: "advertise routes tagged customer or peer to Provider B, but only customer-tagged routes to Provider A." This policy remains correct automatically as the underlying customer base changes, since new customer routes get tagged consistently without any manual list maintenance — a foundational technique for preventing the kind of route leaks covered in ToolsNovaHub's Route Leaks guide.
Communities also enable a powerful form of indirect control: many transit providers and large networks publish specific "customer-settable" communities that let customers influence how their own routes are treated or propagated — requesting a lower local preference on a specific link, asking that a route not be advertised to a specific peer, or requesting regional-only propagation — all without needing direct configuration access to the provider's own routers. This effectively turns communities into a limited, safe remote-control interface for traffic engineering across an organizational boundary.
Beyond policy and traffic engineering, communities serve an important informational role: they let operators (and increasingly, automated tooling) understand at a glance where a given route came from and how it's being treated, which is invaluable both for day-to-day troubleshooting and for auditing routing policy correctness after the fact.
Communities also underpin much of the automation and tooling that has grown up around modern network operations. Configuration generation systems, route analysis tools, and monitoring dashboards increasingly rely on consistent community tagging to programmatically understand and visualize a network's routing policy, rather than requiring engineers to manually trace through raw prefix lists. This makes a well-designed community scheme not just a policy convenience but a genuine enabler of broader network automation maturity.
🏗️ Architecture & Community Types
Standard (32-bit) communities remain the most widely used format for general-purpose policy tagging and are supported by essentially every BGP implementation in existence, making them the safe default choice for most use cases. Their limitation is capacity: with only two 16-bit fields, encoding rich, multi-dimensional policy information (like a specific action plus a specific geographic region plus a specific AS) can require multiple separate community values rather than one compact encoding.
Extended communities address this by using a 64-bit value with an explicit type field that structures the remaining bits differently depending on the use case — most commonly seen in MPLS VPN route target and route origin applications, where the extra structure and capacity are genuinely needed, though they see comparatively limited use in general internet routing policy outside that context.
Large communities, the newest format, were introduced specifically to solve a real, growing problem: since the original 16-bit ASN space became exhausted and 4-byte ASNs became common, many networks with 4-byte ASNs couldn't cleanly represent "my ASN:my value" in the original 16-bit-field format. Large communities use three full 32-bit fields, comfortably accommodating a full 4-byte ASN in the first field alongside two additional 32-bit fields for function and parameter values, and have seen rapid adoption specifically among networks with 4-byte ASNs needing customer-facing traffic engineering communities.
A handful of well-known communities have standardized, universal meaning recognized by virtually every BGP implementation regardless of network: NO-EXPORT (65535:65281) prevents a route from being advertised outside the local confederation or AS boundary; NO-ADVERTISE (65535:65282) prevents the route from being advertised to any BGP neighbor at all; and NO-EXPORT-SUBCONFED restricts propagation within a confederation specifically. These require no bilateral agreement to use correctly since their behavior is standardized.
🔧 Step-by-Step: Designing a Community Scheme
Define your tagging categories
Decide what distinctions matter for your policy — typically at minimum customer/peer/transit origin, and possibly geographic region or service tier.
Choose a community format
Select standard communities for simplicity, or large communities if your ASN is a 4-byte number or you need richer structured encoding.
Reserve a documented value range
Assign specific numeric ranges to specific meanings (e.g., 100–199 for origin type, 200–299 for customer-requested actions) and document this scheme.
Implement tagging on ingress
Configure import policy on every session to apply the appropriate community as routes are received.
Build export policy from tags
Write export filters that key off community values rather than manually maintained prefix lists.
Publish customer-facing communities
If offering customer-controlled traffic engineering, clearly document which communities customers can set and exactly what effect each one has.
Strip internal-only communities at the border
Ensure communities meant only for internal policy don't leak out to external neighbors where they carry no meaning (or worse, an unintended one).
💡 Practical Examples
A transit provider tags every customer route with community 65000:100 (customer-origin) on ingress. Its export policy then simply says "advertise anything tagged customer-origin, peer-origin, or transit-origin to other customers; advertise only customer-origin and peer-origin to peers; advertise only customer-origin to other transit providers" — a compact, maintainable three-line policy that correctly scopes propagation regardless of how many thousands of individual customer prefixes exist underneath it.
A large ISP publishes a documented set of customer-usable communities, including 65000:1000 ("don't advertise this route to peers, transit-only") and 65000:2000 through 65000:2099 ("set local preference to 50 through 149 respectively"), letting business customers with specific traffic engineering needs influence how their own advertised routes are treated without needing any direct configuration access to the ISP's own routers.
A network operating a 4-byte ASN adopts large communities specifically to implement a customer-facing "reduce local preference by region" scheme, since the original standard community format couldn't cleanly encode their full ASN value alongside the additional parameters needed for the region-specific behavior.
🎯 Scenario Walkthrough: Communities in Action
Scenario 1 — A transit provider's internal scheme. A mid-sized transit provider tags every route on ingress with an origin community, then writes export policy entirely in terms of those tags. When it onboards a new customer, no export filter changes are needed anywhere in the network — the new customer's routes are automatically tagged and correctly scoped the moment they're received.
Scenario 2 — A customer requesting traffic engineering. A business customer of that same transit provider notices asymmetric routing causing higher latency on inbound traffic via one of the provider's upstream links. Rather than filing a support ticket and waiting for manual configuration changes, the customer consults the provider's published community documentation and attaches a specific community to its own route announcement, requesting reduced local preference on that link — the change takes effect automatically on the provider's side.
Scenario 3 — Migrating to large communities. A network operating a 4-byte ASN that had been using a workaround encoding in standard communities migrates its entire scheme to large communities, cleanly representing its full ASN alongside richer parameter encoding, and updates its public documentation so customers and peers can transition to the new values.
These scenarios illustrate the three main ways communities create value: internal policy simplification, external customer self-service, and clean technical encoding as network requirements evolve.
✅ Implementation Checklist
Use this checklist when designing or auditing a BGP community scheme for your network.
- Tagging categories defined — at minimum customer/peer/transit origin, expanded as needed for your policy.
- Community format chosen deliberately — standard for simplicity, large communities if you hold a 4-byte ASN.
- Numeric value ranges documented — reserved and recorded so the scheme stays legible as it grows.
- Ingress tagging implemented consistently — applied on every relevant session, with no gaps.
- Export policy built from tags — not manually maintained, hard-to-audit prefix lists.
- Well-known communities used where appropriate — NO-EXPORT and NO-ADVERTISE for universal, no-negotiation-needed scoping.
- Customer-facing communities documented publicly — if offering customer-controlled traffic engineering.
- Internal-only communities stripped at the border — verified not to leak to external neighbors.
- Scheme documented internally — so the design remains maintainable as network team membership changes.
- Policy audited periodically — confirming export/import behavior still matches the documented scheme after configuration changes.
📚 Key Terms Glossary
- Standard community
- The original 32-bit BGP community format defined in RFC 1997, conventionally written as two 16-bit numbers separated by a colon, such as 65000:100.
- Extended community
- A 64-bit, typed community format defined in RFC 4360, most commonly used for structured applications like MPLS VPN route targets and route origins.
- Large community
- A community format using three 32-bit fields, defined in RFC 8092 specifically to accommodate 4-byte ASNs that don't fit cleanly into the original 16-bit field format.
- Well-known community
- A small set of standardized community values, like NO-EXPORT and NO-ADVERTISE, with universal meaning recognized across virtually all BGP implementations without needing bilateral agreement.
- 4-byte ASN
- An Autonomous System Number from the expanded 32-bit numbering space, introduced once the original 16-bit ASN space became exhausted, requiring large communities for clean encoding.
- Blackholing
- A traffic engineering technique, commonly triggered via a specific community, that causes a provider to automatically null-route a specified prefix across its network, often used for DDoS mitigation.
- Origin tagging
- The practice of attaching a community to a route as it's learned, reflecting whether it came from a customer, peer, or transit provider, forming the basis of declarative export policy.
- Transitive attribute
- A BGP attribute, including most commonly used communities, that a router propagates onward to its neighbors by default, as opposed to non-transitive attributes that are dropped.