RFC 5291
Outbound Route Filtering Capability for BGP-4
RFC 5291: Outbound Route Filtering Capability for BGP-4 🎀
okay bestie, let's get into it 💖 This is RFC 5291 from the Network Working Group, published in August 2008 as a Standards Track document. The authors are E. Chen (Cisco Systems) and Y. Rekhter (Juniper Networks). The title block doesn't list anything it obsoletes or updates, so it doesn't replace or change any earlier RFC 🦋
Status of This Memo ✨
so this is an Internet standards track protocol for the Internet community, and the authors are asking for discussion and suggestions for improvements 🌸 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share it with everyone 💅
Abstract 🧚
the big idea here is a BGP-based mechanism. A BGP speaker can send its BGP peer a set of Outbound Route Filters (ORFs), and the peer uses them to constrain/filter its outbound routing updates to the speaker 💜
1. Introduction 🍓
okay so, it's pretty common for a BGP speaker [BGP-4] to receive a bunch of routes from its peers and then filter out the ones it doesn't want, based on its local routing policy. The thing is, making, sending, and processing those routing updates all costs resources. So it would be really useful if those unwanted updates never got generated in the first place ✨
This document defines a BGP-based mechanism that lets a BGP speaker send its BGP peer a set of Outbound Route Filters (ORFs). The peer then applies these filters, on top of any locally configured outbound filters it already has (if it has any), to constrain/filter its outbound routing updates to the speaker. Main character energy, honestly 👑
2. Specification of Requirements 🫶
the key words are the official BCP 14 ones, and they're interpreted the way RFC 2119 [RFC2119] describes. Here they are, in all their capital glory:
"MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
3. Outbound Route Filter (ORF) 🦋
this section borrows two terms, "Address Family Identifier (AFI)" and "Subsequent Address Family Identifier (SAFI)". They mean exactly the same thing as in [BGP-MP], so no new meanings to memorize 💖
Conceptually, an ORF entry is a tuple of the form <AFI/SAFI, ORF-Type, Action, Match, ORF-value>. An ORF is one or more ORF entries that share a common AFI/SAFI and ORF-Type. You identify an ORF by <AFI/SAFI, ORF-Type> 🎀
- The AFI/SAFI component gives you coarse-grained control, limiting the ORF to only the routes whose Network Layer Reachability Information (NLRI) matches the AFI/SAFI component of the ORF.
- The ORF-Type component decides what goes in the ORF-value.
- The Action component controls how the remote peer handles the ORF Request. It can be ADD, REMOVE, or REMOVE-ALL. ADD adds an ORF entry to the ORF on the remote peer. REMOVE deletes a previously installed ORF entry on the remote peer. REMOVE-ALL deletes all the previously installed entries in the specified ORF on the remote peer 🔥
- The Match component gives you matching granularity on a per-ORF-entry basis. It's either PERMIT or DENY. PERMIT asks the peer to pass updates for the set of routes that match the ORF entry. DENY asks the peer not to pass updates for the set of routes that match the ORF entry 💅
bestie, this one is a hard rule 🚨 When an ORF is defined, an ORF-specific matching rule MUST be specified, so there's zero ambiguity about which ORF entry counts as the matching entry when a route passes through the ORF 😭
4. Carrying ORF Entries in BGP 🌈
ORF entries ride along in the BGP ROUTE-REFRESH message [BGP-RR] ✨
A BGP speaker can tell an incoming ROUTE-REFRESH message that carries ORF entries apart from a plain ROUTE-REFRESH message by checking the Message Length field in the BGP message header 🧚
A single ROUTE-REFRESH message MAY carry multiple ORF entries across one or more ORFs, as long as they all share the same AFI/SAFI 💜
From an encoding point of view, each ORF entry has a common part and a type-specific part, as shown in Figures 1 and 2 🍓
The common part is <AFI/SAFI, ORF-Type, Action, Match>, and it gets encoded like this:
- The AFI/SAFI component of an ORF entry goes in the AFI/SAFI field of the ROUTE-REFRESH message.
- Right after the AFI/SAFI component is the one-octet When-to-refresh field. Its value can be IMMEDIATE (0x01) or DEFER (0x02). The meanings of IMMEDIATE and DEFER are covered in the "Operation" section of this document 🌸
- After the When-to-refresh field comes one or more ORFs, grouped by ORF-Type.
- The ORF-Type component is a one-octet field.
- The "Length of ORF entries" component is a two-octet field holding the total length (in octets) of the ORF entries that follow for the specified ORF type ⭐
Here's the layout (Figure 1) 👇
+--------------------------------------------------+
| Address Family Identifier (2 octets) |
+--------------------------------------------------+
| Reserved (1 octet) |
+--------------------------------------------------+
| Subsequent Address Family Identifier (1 octet) |
+--------------------------------------------------+
| When-to-refresh (1 octet) |
+--------------------------------------------------+
| ORF Type (1 octet) |
+--------------------------------------------------+
| Length of ORF entries (2 octets) |
+--------------------------------------------------+
| First ORF entry (variable) |
+--------------------------------------------------+
| Second ORF entry (variable) |
+--------------------------------------------------+
| ... |
+--------------------------------------------------+
| N-th ORF entry (variable) |
+--------------------------------------------------+
| ORF Type (1 octet) |
+--------------------------------------------------+
| Length of ORF entries (2 octets) |
+--------------------------------------------------+
| First ORF entry (variable) |
+--------------------------------------------------+
| Second ORF entry (variable) |
+--------------------------------------------------+
| ... |
+--------------------------------------------------+
| N-th ORF entry (variable) |
+--------------------------------------------------+
| ... |
+--------------------------------------------------+
Figure 1: Carrying ORF Entries in the ROUTE-REFRESH MessageThe rest of the common part gets packed into the first octet of each ORF entry, from the most significant bit to the least significant bit (Figure 2) 🎀
- Action is a two-bit field. It's 0 for ADD, 1 for REMOVE, and 2 for REMOVE-ALL.
- Match is a one-bit field. It's 0 for PERMIT and 1 for DENY. This field only matters when Action is ADD or REMOVE 🦋
- Reserved is a 5-bit field. It's set to 0 on transmit and ignored on receipt.
+---------------------------------+
| Action (2 bit) |
+---------------------------------+
| Match (1 bit) |
+---------------------------------+
| Reserved (5 bits) |
+---------------------------------+
| Type specific part (variable) |
+---------------------------------+
Figure 2: ORF Entry EncodingAnd if Action is REMOVE-ALL, the entry is just the common part, nothing else 💀
5. Outbound Route Filtering Capability 💖
any BGP speaker that's willing to receive ORF entries from its peer, or that would like to send ORF entries to its peer, announces this using the Outbound Route Filtering Capability, which is described below 🌈
The Outbound Route Filtering Capability is a new BGP Capability [BGP-CAP], defined like this:
- Capability code: 3
- Capability length: variable
- Capability value: one or more of the entries shown in Figure 3
+--------------------------------------------------+
| Address Family Identifier (2 octets) |
+--------------------------------------------------+
| Reserved (1 octet) |
+--------------------------------------------------+
| Subsequent Address Family Identifier (1 octet) |
+--------------------------------------------------+
| Number of ORFs (1 octet) |
+--------------------------------------------------+
| ORF Type (1 octet) |
+--------------------------------------------------+
| Send/Receive (1 octet) |
+--------------------------------------------------+
| ... |
+--------------------------------------------------+
| ORF Type (1 octet) |
+--------------------------------------------------+
| Send/Receive (1 octet) |
+--------------------------------------------------+
Figure 3: Outbound Route Filtering Capability EncodingHere's what each field means 🧚
- Address Family Identifier (AFI): this field is the same one used in [BGP-MP].
- Subsequent Address Family Identifier (SAFI): this field is the same one used in [BGP-MP].
- Number of ORF Types: this field contains the number of Filter Types listed in the fields that follow.
- ORF Type: this field contains the value of an ORF Type.
- Send/Receive: this field shows whether the sender is (a) willing to receive ORF entries from its peer (value 1), (b) would like to send ORF entries to its peer (value 2), or (c) both (value 3), for that ORF Type 🔥
ok the vibes are immaculate so far, and we've got the whole foundation locked in 🫶
6. Operation ✨
okay bestie, this is where the peers actually start talking 💬 A BGP speaker that is willing to receive ORF entries from its peer, or would like to send ORF entries to its peer, SHOULD advertise the Outbound Route Filtering Capability to that peer using the BGP Capabilities advertisement [BGP-CAP] 🎀
A BGP speaker that implements the Outbound Route Filtering Capability MUST support the BGP ROUTE-REFRESH message, as defined in [BGP-RR] 💅 If a speaker advertises the Outbound Route Filtering Capability to a peer using the BGP Capabilities advertisement [BGP-CAP], it does not have to advertise the BGP Route Refresh Capability to that peer. no cap, that part is optional ✨
Now the main event 🔥 Picture a speaker that says it's willing to receive a certain set of <AFI/SAFI, ORF-Type> pairs from its peer. That speaker also gets the Outbound Route Filtering Capability back, which tells it the peer wants to send a certain set of <AFI/SAFI, ORF-Type> pairs to it. If, for a given AFI/SAFI, the overlap between those two sets is non-empty, the speaker SHOULD NOT advertise any routes with that AFI/SAFI to the peer until it has received a ROUTE-REFRESH message from the peer for that AFI/SAFI 🙈 That ROUTE-REFRESH can be either without any ORF entries, or with one or more ORF entries and the When-to-refresh field set to IMMEDIATE. But if the overlap is empty for a given AFI/SAFI, the speaker MUST follow normal BGP procedures 🦋
A BGP speaker may send a ROUTE-REFRESH message with one or more ORF entries to its peer only if two things are true. First, the peer advertises the Outbound Route Filtering Capability saying it is willing to receive ORF entries from the speaker. Second, the speaker advertises the Outbound Route Filtering Capability saying it wants to send ORF entries to the peer 💜 The message may contain only ORF entries of <AFI/SAFI, ORF-type> that the peer is willing to receive, as advertised to the speaker in the Outbound Route Filtering Capability.
When a BGP speaker gets a ROUTE-REFRESH message with one or more ORF entries from its peer, it does the following. If an <AFI/SAFI, ORF-type> carried by the message does not match an <AFI/SAFI, ORF-type> that the speaker is willing to receive from the peer (the one it advertised in the Outbound Route Filtering Capability), those ORF entries get ignored 🙅♀️ Otherwise, the speaker modifies the specified ORF it previously received, according to the ORF entries in the message. And if any field of an ORF entry in the message has an unrecognized value, the whole specified ORF previously received is removed. yikes, that's a full reset for that ORF 💀
If the Action component of an ORF entry is REMOVE, but the ORF previously received does not contain the specified entry, that ORF entry in the message is ignored 🌸
ORF entries with either REMOVE or REMOVE-ALL cannot remove locally configured outbound route filters 🔒
If the When-to-refresh field indicates IMMEDIATE, then after processing all the ORF entries in the message, the speaker re-advertises to the peer the routes from the Adj-RIB-Out associated with that peer. It only does this for routes with the same AFI/SAFI as what is carried in the message, and it takes into account all the ORF entries for that AFI/SAFI received from the peer ✨ The speaker MUST re-advertise all the routes that have been affected by the ORF entries carried in the message. It MAY also re-advertise routes that have not been affected by those ORF entries.
If the When-to-refresh field indicates DEFER, then after processing all the ORF entries in the message, the speaker defers re-advertising routes to the peer. Those are the routes from the Adj-RIB-Out associated with the peer that have the same AFI/SAFI as the message. It takes into account all the ORF entries received from the peer, and it keeps deferring until the speaker receives a later ROUTE-REFRESH message for the same AFI/SAFI. That later message has to be either without any ORF entries, or with one or more ORF entries and When-to-refresh set to IMMEDIATE ⏳
If the speaker receives a ROUTE-REFRESH message from the peer without any ORF entries, then the speaker sends the peer all routes from the Adj-RIB-Out associated with that peer whose AFI/SAFI is the same as what is carried in the message. It does this while taking into account any ORFs previously received from the peer (if there are any) 🫶
The set of ORF entries that the speaker sends to the peer expresses the speaker's local preference. The peer may or may not decide to honor that preference, so it's not a guarantee 🤷♀️
During a single BGP session, the speaker MAY pass multiple ORF entries to the peer 🌈
After a BGP speaker makes changes to the ORF entries it previously sent to a peer, the speaker MUST send the peer the updated ORF entries with either (a) When-to-refresh set to IMMEDIATE, or (b) When-to-refresh set to DEFER followed by a plain ROUTE-REFRESH message. The latter MUST be used by the speaker when there are other policy changes (in addition to the ORF entries) that require the peer to re-advertise all the routes 👑
The lifetime of an ORF is the duration of the BGP session during which the ORF is exchanged 🧚
An ORF is removed when its last ORF entry is removed. That can happen via REMOVE-ALL, or via a sequence of REMOVE 🗑️
If a particular route maintained by a BGP speaker does not match any of the ORF entries of any of the (non-empty) ORFs associated with a particular peer, then this route SHOULD NOT be advertised to that peer 🙈
If a BGP speaker maintains multiple ORFs of different ORF-Types for a particular peer, then the speaker decides whether to advertise a route to that peer by passing the route through each such ORF and combining the results. Combining a PERMIT with a DENY results in DENY. 🦋
7. IANA Considerations 💖
This document defines a new BGP Capability, the Outbound Route Filtering Capability. The Capability Code for the Outbound Route Filtering Capability is 3 🎀
As specified in this document, an ORF entry contains the ORF-Type field. For that field, IANA has created and now maintains a registry called "BGP Outbound Route Filtering (ORF) Types" 📋
IANA maintains and registers values for the ORF-Type field as follows:
- ORF-Type value
0is reserved. - ORF-Type values
1through63are to be assigned by IANA using either the Standards Action process defined in RFC 5226 [RFC5226], or the Early IANA Allocation process defined in RFC 4020 [RFC4020]. - ORF-Type values
64through127are to be assigned by IANA, using the "First Come First Served" policy defined in RFC 5226 [RFC5226]. - ORF-Type values
128through255are vendor-specific, and values in this range are not to be assigned by IANA 🌸
8. Manageability Considerations 🧁
The management objects for BGP ORFs will be defined separately, outside this document. However, it is suggested that the following management objects be defined:
The ORF Capability object describes the ORF Capability exchanged over a BGP session. It should include the ORF types and the Send/Receive values advertised and received for a BGP peer 📊
The ORF entry object should contain the ORF entries of each ORF sent and received for a BGP peer 🗂️
9. Security Considerations 🚨
🚨 This extension to BGP does not change the underlying security issues [BGP-4]. Bestie, the security story here is inherited from BGP-4 itself, so don't assume this extension fixes or adds anything on that front 😭
10. Acknowledgments 🫶
Some of the material in this document is adapted from a proposal for selective updates by Yakov Rekhter, Kannan Varadhan, and Curtis Villamizar 💜
11. Normative References 📚
[BGP-4] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border
Gateway Protocol 4 (BGP-4)", RFC 4271, January 2006.
[BGP-MP] Bates, T., Chandra, R., Katz, D., and Y. Rekhter,
"Multiprotocol Extensions for BGP-4", RFC 4760, January
2007.
[BGP-CAP] Chandra, R. and J. Scudder, "Capabilities Advertisement
with BGP-4", RFC 3392, November 2002.
[BGP-RR] Chen, E., "Route Refresh Capability for BGP-4", RFC 2918,
September 2000.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4020] Kompella, K. and A. Zinin, "Early IANA Allocation of
Standards Track Code Points", BCP 100, RFC 4020, February
2005.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226, May
2008.Authors' Addresses 🌷
Enke Chen
Cisco Systems, Inc.
170 W. Tasman Dr.
San Jose, CA 95134
Email: enkechen@cisco.com
Yakov Rekhter
Juniper Networks
1194 N. Mathilda Ave
Sunnyvale, CA 94089
Email: yakov@juniper.netFull Copyright Statement 📜
Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔏
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. Nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
📦 where this page comes from
- ietf: rfc5291 2008-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms