BGP Policy Engineering on IOS XE — Part 2

Aman Singh

5 min readJan 1, 2026

Building up on my previous post here — https://medium.com/@aks001235/bgp-policy-engineering-on-ios-xe-666d4570245e

Challenge 3:

R1 must:

Tag all /16 prefixes with community 65001:100
Tag all /24 prefixes with community 65001:200

R3 must:

Advertise only routes with community 65001:100 to R4
Drop everything else

R1 Initial BGP configuration:

R1(config)#do sh running-config | section bgp
router bgp 65001
bgp router-id 1.1.1.1
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 65001
neighbor 2.2.2.2 update-source Loopback0
neighbor 3.3.3.3 remote-as 65001
neighbor 3.3.3.3 update-source Loopback0
!
address-family ipv4
 network 10.1.0.0 mask 255.255.0.0
 network 10.1.1.0 mask 255.255.255.0
 neighbor 2.2.2.2 activate
 neighbor 2.2.2.2 next-hop-self
 neighbor 2.2.2.2 route-map R1-PERMIT-65002-SLASH-24 in
 neighbor 2.2.2.2 route-map COMMUNITY_TAGGING_OUT out
 neighbor 3.3.3.3 activate
 neighbor 3.3.3.3 next-hop-self
 neighbor 3.3.3.3 route-map COMMUNITY_TAGGING_OUT out
exit-address-family
R1(config)#do sh running-config | section COMMUNITY_TAGGING_OUT
 neighbor 2.2.2.2 route-map COMMUNITY_TAGGING_OUT out
 neighbor 3.3.3.3 route-map COMMUNITY_TAGGING_OUT out
route-map COMMUNITY_TAGGING_OUT permit 50 
match ip address prefix-list MATCH_16_PREFIX
set community 4259905636
route-map COMMUNITY_TAGGING_OUT permit 60 
match ip address prefix-list MATCH_24_PREFIX
set community 4259905736

R3 Initial BGP Configuration

R3(config)#do sh running-config | section bgp
router bgp 65001
bgp router-id 3.3.3.3
bgp log-neighbor-changes
neighbor 1.1.1.1 remote-as 65001
neighbor 1.1.1.1 update-source Loopback0
neighbor 2.2.2.2 remote-as 65001
neighbor 2.2.2.2 update-source Loopback0
neighbor 4.4.4.4 remote-as 65002
neighbor 4.4.4.4 ebgp-multihop 2
neighbor 4.4.4.4 update-source Loopback0
!
address-family ipv4
 network 10.3.0.0 mask 255.255.0.0
 network 10.3.3.0 mask 255.255.255.0
 neighbor 1.1.1.1 activate
 neighbor 1.1.1.1 next-hop-self
 neighbor 2.2.2.2 activate
 neighbor 2.2.2.2 next-hop-self
 neighbor 4.4.4.4 activate
 neighbor 4.4.4.4 next-hop-self
 neighbor 4.4.4.4 route-map MATCH_100_COMMUNITY out
exit-address-family

Community List and Prefix Lists on R3

R3(config)#do sh running-config | section MATCH_100_COMMUNITY
neighbor 4.4.4.4 route-map MATCH_100_COMMUNITY out
ip community-list standard MATCH_100_COMMUNITY permit 4259905636
match community MATCH_100_COMMUNITY

R3(config)#do sh running-config | include list
ip community-list standard MATCH_100_COMMUNITY permit 4259905636
ip prefix-list MATCH_PREFIX_LESS_PREFER seq 5 permit 0.0.0.0/0 ge 16 le 16
ip prefix-list MATCH_SLASH_16 seq 5 permit 0.0.0.0/0 ge 16 le 16
match ip address prefix-list MATCH_PREFIX_LESS_PREFER

Checking on R3 the routes advertised to R4:

I see no routes are being advertised from R3 to R4

R3(config)#do sh ip bgp neighbors 4.4.4.4 advertised-routes
Total number of prefixes 0

On R1, I don’t see the routes being tagged with the right community:

R1(config)#do sh bgp neighbors 2.2.2.2 advertised-routes 10.1.1.0/24
% Command accepted but obsolete, unreleased or unsupported; see documentation.
BGP routing table entry for 10.1.1.0/24, version 3
 Paths: (1 available, best #1, table default)
 Advertised Attributes
   Local Preference: 100
   Metric: 0
   Origin: IGP
   Nexthop: 1.1.1.1
R1(config)#

✅ Fix: Enable Community Advertisement on R1

neighbor 2.2.2.2 send-community both
neighbor 3.3.3.3 send-community both

After clearing BGP, I can see the right communities being set

R1(config)#do sh bgp neighbors 2.2.2.2 advertised-routes 10.1.0.0/16
% Command accepted but obsolete, unreleased or unsupported; see documentation.

BGP routing table entry for 10.1.0.0/16, version 2
 Paths: (1 available, best #1, table default)
 Advertised Attributes
   Local Preference: 100
   Metric: 0
   Origin: IGP
   Community: 4259905636
   Nexthop: 1.1.1.1

R1(config)#do sh bgp neighbors 2.2.2.2 advertised-routes 10.1.1.0/24
% Command accepted but obsolete, unreleased or unsupported; see documentation. 

BGP routing table entry for 10.1.1.0/24, version 3
 Paths: (1 available, best #1, table default)
 Advertised Attributes
   Local Preference: 100
   Metric: 0
   Origin: IGP
   Community: 4259905736
   Nexthop: 1.1.1.1

Still, I wasn’t able to get the right routes from R3 to be advertised to R4. After digging out for a while, I found out that it was a config mistake. Instead of the route-map, I configured the community-list in the neighbour towards R4. You can see the wrong config of R3 in the initial config, and I made the following change:

R3(config)#router bgp 65001
R3(config-router)#neighbor 4.4.4.4 route-map MATCH_COMM_OUT out

route-map MATCH_COMM_OUT permit 10
 match community MATCH_100_COMMUNITY

📤 Routes Now Advertised to R4

R3(config)#do sh bgp neighbors 4.4.4.4 advertised-routes

% Command accepted but obsolete, unreleased or unsupported; see documentation.


BGP table version is 287, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, 
             r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, 
             x best-external, a additional-path, c RIB-compressed, 
             t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

    Network          Next Hop            Metric LocPrf Weight Path
*>i  10.1.0.0/16      1.1.1.1                  0    100     0 i

The community will still be missing towards R4 from R3. If you want to advertise the routes with the community that was set in R1, you will have to enable “neighbor 4.4.4.4 send-community both” on R3.

Challenge 4:

On R2:

Get Aman Singh’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

If a route:

Is a /24
Comes from AS 65002
Has community 65001:200

Then:

Set MED = 50
Set Local Preference = 200

Otherwise:

Explicitly permit the route unchanged

🔍 Initial BGP State on R2

R2(config)#do sh ip bgp
BGP table version is 164, local router ID is 2.2.2.2
Network          Next Hop            Metric LocPrf Weight Path
*>i  10.1.0.0/16      1.1.1.1                  0    100     0 i
*>i  10.1.1.0/24      1.1.1.1                  0    100     0 i
*>   10.2.0.0/16      0.0.0.0                  0         32768 i
*>   10.2.2.0/24      0.0.0.0                  0         32768 i
*>i  10.3.0.0/16      3.3.3.3                  0    100     0 i
*>i  10.3.3.0/24      3.3.3.3                  0    100     0 i
*>   172.16.0.0       5.5.5.5                                0 65002 i
*>   172.16.4.0/24    5.5.5.5                                0 65002 i
*>   172.17.0.0       5.5.5.5                                0 65002 i
*>   172.17.5.0/24    5.5.5.5                                0 65002 i

After Configuration — Unexpected Result

R2(config)#do sh ip bgp all
BGP table version is 175, local router ID is 2.2.2.2
Network          Next Hop            Metric LocPrf Weight Path
*>   10.2.0.0/16      0.0.0.0                  0         32768 i
*>   10.2.2.0/24      0.0.0.0                  0         32768 i

Only locally originated routes remain.

Issue Identified

The problem is the missing explicit permit statement in the route-map for non-matching routes.

route-map SET_MED_LP_IN permit 100

Without this entry, all routes that do not match the first sequence are dropped, due to the implicit deny behaviour of route-maps.

BGP Configuration on R2

R2(config)#do sh running-config | section bgp
router bgp 65001
 bgp router-id 2.2.2.2
 bgp log-neighbor-changes
neighbor 1.1.1.1 remote-as 65001
 neighbor 1.1.1.1 update-source Loopback0
 neighbor 3.3.3.3 remote-as 65001
 neighbor 3.3.3.3 update-source Loopback0
 neighbor 5.5.5.5 remote-as 65002
 neighbor 5.5.5.5 ebgp-multihop 2
 neighbor 5.5.5.5 update-source Loopback0
address-family ipv4
 network 10.2.0.0 mask 255.255.0.0
 network 10.2.2.0 mask 255.255.255.0
neighbor 1.1.1.1 activate
 neighbor 1.1.1.1 next-hop-self
 neighbor 1.1.1.1 route-map SET_MED_LP_IN in
 neighbor 3.3.3.3 activate
 neighbor 3.3.3.3 next-hop-self
 neighbor 3.3.3.3 route-map SET_MED_LP_IN in
 neighbor 5.5.5.5 activate
 neighbor 5.5.5.5 next-hop-self
 neighbor 5.5.5.5 route-map SET_MED_LP_IN in
exit-address-family

🔧 Route-Map Configuration

R2(config)#do sh running-config | section SET_MED_LP_IN
route-map SET_MED_LP_IN permit 10
 match ip address prefix-list MATCH_SLASH_24
 match as-path 10
 match community MATCH_200_COMM
 set metric 50
 set local-preference 200
route-map SET_MED_LP_IN permit 100

R2(config)#do sh running-config | section MATCH_SLASH_24
ip prefix-list MATCH_SLASH_24 seq 5 permit 0.0.0.0/0 ge 24 le 24

R2(config)#do sh running-config | section as-path
ip as-path access-list 10 permit ^65002_

R2(config)#do sh running-config | section MATCH_200_COMM
ip community-list expanded MATCH_200_COMM permit 65001:200

Aman Singh

BGP Policy Engineering on IOS XE — Part 2

Challenge 3:

R1 must:

R1 Initial BGP configuration:

R3 Initial BGP Configuration

Community List and Prefix Lists on R3

Checking on R3 the routes advertised to R4:

✅ Fix: Enable Community Advertisement on R1

📤 Routes Now Advertised to R4

Challenge 4:

Get Aman Singh’s stories in your inbox

🔍 Initial BGP State on R2

After Configuration — Unexpected Result

Issue Identified

BGP Configuration on R2

🔧 Route-Map Configuration

Written by Aman Singh

No responses yet

More from Aman Singh

Understanding BGP Multipath

BGP is fundamentally a single best-path routing protocol. For every prefix, BGP runs its best-path algorithm and installs only one path…

BGP Path Attributes Explained

BGP uses path attributes to carry routing information and guide path selection. The following BGP Attributes are defined in RFC 4271.

MPLS Learning Lab: Hands-On Guide — Part 1

This writing includes the details of the lab that I am following while learning MPLS using another blog MPLS Configuration Tutorial »…

Inter-VLAN Routing: Router-on-a-Stick and SVI

In modern LANs, VLAN segmentation is essential for managing broadcast domains and improving security. But when devices in different VLANs…

Recommended from Medium

You’ve Applied for 50 Jobs and Heard Nothing Back. What Should You Change?

Sending more applications can feel productive. But when the results aren’t changing, it may be time to examine the process rather than…

10 n8n Workflows You Should Steal Immediately (Because They Run 80% of a Modern Business)

The exact node configurations, validation code, and human-in-the-loop safeguards that turn toy automations into resilient production…

Ants Solved Traffic Jams Before We Built Our First Highway

Millions of drivers still sit in gridlock every day. Tiny insects with no traffic lights, no maps and no leader figured it out long ago.

Dive into Dependently Typed Magic: Building a Lean 4-Inspired Prover with Rust (A Step-by-Step…

Alright, fellow coding adventurers and math enthusiasts! 👋 Have you ever found yourself scratching your head, wondering how those…

Writing Better Tests for AI-Generated Code

AI has made writing code faster and cheaper. A feature that used to take hours can now sometimes be built in minutes with an AI coding…

What Had to Come Has Come: The Lightweight Open-Source IDEA Is Here

How long has it been since you've done old-school programming, writing code with your own hands? As a new-age AI engineer, heavyweight…