AWS directconnect: Direct Connect BGP community and AS_PATH loop prevention notes
Summary
Adds a note that local preference tags must be configured as standard BGP communities (extended communities are not evaluated and may be stripped), and a new section on standard eBGP AS_PATH loop prevention where routes containing ASN 7224 twice are not installed, with advice to filter AWS-learned routes.
Security assessment
The added content concerns BGP route preference and loop prevention, i.e., routing correctness and availability rather than a security control or vulnerability fix. No authentication, encryption, or exposure issue is described.
Evidence
+Direct Connect applies standard eBGP loop prevention to the routes that you advertise over private and transit virtual interfaces. If the AS_PATH of a route contains the Direct Connect ASN `7224` two or more times, Direct Connect treats the route as a loop and doesn't install it.
Diff
diff --git a/directconnect/latest/UserGuide/routing-and-bgp.md b/directconnect/latest/UserGuide/routing-and-bgp.md index d4857f2..d1b18b4 100644 --- a//directconnect/latest/UserGuide/routing-and-bgp.md +++ b//directconnect/latest/UserGuide/routing-and-bgp.md @@ -197,0 +198,4 @@ The following local preference BGP community tags are supported: +###### Note + +Configure these tags as standard BGP communities. Direct Connect doesn't evaluate extended BGP communities, such as route targets, for route preference, and might remove them when it receives the route. If you apply a tag as an extended community, Direct Connect doesn't return an error. + @@ -201,0 +206,8 @@ Local preference BGP community tags are evaluated before any AS_PATH attribute, +### AS_PATH loop prevention + +Direct Connect applies standard eBGP loop prevention to the routes that you advertise over private and transit virtual interfaces. If the AS_PATH of a route contains the Direct Connect ASN `7224` two or more times, Direct Connect treats the route as a loop and doesn't install it. + +This usually happens when your network re-advertises routes that it learned over one virtual interface to AWS over another virtual interface. This produces an AS_PATH like `65300 7224 7224 16509 14618`. + +To avoid this, filter routes that you learned from AWS out of the routes that you advertise to AWS. +