AWS network-manager: Reorder Cloud WAN routing policy considerations into sections
Summary
Editorial restructuring of the Cloud WAN routing policies page: existing considerations about route evaluation/ordering, attachment type support, BGP/ASN constraints, and prefix lists/visibility are regrouped under new section headings; a few bullets were reworded (terminal vs. non-terminal allow/drop actions, summarization resetting BGP attributes, peering shared outbound policies). No new capability or control is introduced.
Security assessment
The change is primarily a documentation reorganization (new headings like '### Route evaluation and ordering' and '### BGP and ASN constraints'). Content touching trust boundaries (internal ASNs in BGP communities, route summarization resetting attributes, allow/drop terminal actions) is pre-existing guidance being reworded, and no specific vulnerability, incident, or CVE is referenced.
Evidence
+ * External AWS devices cannot advertise routes with BGP communities containing internal ASNs.
Diff
diff --git a/network-manager/latest/cloudwan/cloudwan-routing-policies.md b/network-manager/latest/cloudwan/cloudwan-routing-policies.md index 3cf40a584..66e0b918c 100644 --- a//network-manager/latest/cloudwan/cloudwan-routing-policies.md +++ b//network-manager/latest/cloudwan/cloudwan-routing-policies.md @@ -72 +72 @@ The following is a list of considerations that should be taken into account befo - * VPC attachments don't support BGP attribute modification +### Route evaluation and ordering @@ -74 +74,16 @@ The following is a list of considerations that should be taken into account befo - * Summarization only works outbound and on BGP-capable attachments + * Route summarization will remove all matched prefixes and replace them with a single summarized route. The summarized prefix will be advertised at the same time as matched prefixes are withdrawn. + + * The allow and drop actions are terminal. When a route matches either one, no further rules are evaluated for that route. Other actions, such as set-med and summarize, are non-terminal, so processing continues. A route that reaches the end of all rules without matching a terminal action is allowed, with any modifications applied. + + * Segment share policies are applied after attachment policies. + + * Routing policies associated across segments and Regions are unidirectional. + + * Routing policies are not supported for network function groups (service insertion). + + + + +### Attachment type support + + * VPC attachments don't support BGP attribute modification. @@ -76 +91 @@ The following is a list of considerations that should be taken into account befo - * Routing policies associated across segments and regions are unidirectional + * Summarization only works outbound and on BGP-capable attachments. @@ -78 +93,8 @@ The following is a list of considerations that should be taken into account befo - * No BGP community support on Direct Connect and TGW Peering attachments + * No BGP community support on Direct Connect and TGW peering attachments. + + * TGW route table attachments that use the same peering and are associated with the same segment share the same outbound routing policies across all similar attachments. For example, if attachment-1 has outbound routing policy 1 on segment prod and peering 1, and attachment-2 has outbound routing policy 2 on the same segment and peering, both policies apply to both attachments. + + + + +### BGP and ASN constraints @@ -82 +104 @@ The following is a list of considerations that should be taken into account befo - * Replace ASN is not support cross-region (CNE-to-CNE) + * Replace ASN is not supported cross-Region (CNE-to-CNE). @@ -84 +106 @@ The following is a list of considerations that should be taken into account befo - * Prefix list alias's must be unique per prefix list core network association + * External AWS devices cannot advertise routes with BGP communities containing internal ASNs. @@ -86 +108 @@ The following is a list of considerations that should be taken into account befo - * Prefix list modifications of entry values to the underlying core network routing state may not align with the prefix list state. + * Route summarization does not preserve the BGP attributes of the matched prefixes. The summarized route is advertised as a new route with reset attribute values: MED of 100, local-preference of 0, an empty AS-path, and empty communities. @@ -88 +109,0 @@ The following is a list of considerations that should be taken into account befo - * Routing policies are not supported for NFGs (Service Insertion) @@ -90 +110,0 @@ The following is a list of considerations that should be taken into account befo - * Segment share policies are applied after attachment policies @@ -92 +111,0 @@ The following is a list of considerations that should be taken into account befo - * External AWS devices cannot advertise routes with BGP communities containing internal ASNs @@ -94 +113 @@ The following is a list of considerations that should be taken into account befo - * The list-core-network-routing-information API shows the routing information before routing policies have been applied +### Prefix lists and visibility @@ -96 +115,3 @@ The following is a list of considerations that should be taken into account befo - * Route summarization will remove all matched prefixes and replace them with a single summarized route. The summarized prefix will be advertised at the same time as matched prefixes are withdrawn. + * Prefix list aliases must be unique per prefix list core network association. + + * Prefix list modifications of entry values to the underlying core network routing state may not align with the prefix list state. @@ -98 +119 @@ The following is a list of considerations that should be taken into account befo - * TGW Route Table Attachments that use the same Peering and are associated to the same segment will share the same outbound routing policies across all similar attachments. This means if you have TGW Route Table Attachment attachment-1 with outbound routing policy 1 on segment prod and peering 1 and you have TGW Route Table Attachment attachment-2 with outbound routing policy 2 on segment prod and peering 1, then both attachment-1 and attachment-2 will have both have routing policy 1 and routing policy 2 applied to both of the attachments. + * The `list-core-network-routing-information` API shows the routing information before routing policies have been applied.