Default External BGP (EBGP) Route Propagation Behavior without Policies
updates
- rfc-4271 — A Border Gateway Protocol 4 (BGP-4)
Extracted elements (11)
Explicit configuration of both Import and Export Policies is required for any EBGP session so that operators benefit from consistent behavior across different BGP implementations, reducing the consequences of software defects or operator misconfiguration.
The default-deny behavior for EBGP sessions is introduced because many deployed BGP speakers historically send and accept any and all route announcements by default, a permissive practice dating to the early Internet that now poses significant risks as the Internet has become more densely interconnected.
The 'N+1 N+2' release strategy is recommended for implementers transitioning to compliance: N+1 introduces an 'ebgp insecure-mode' parameter and informational warnings, while N+2 inverts the default so new installations are secure and upgraded installations remain on old behavior unless reconfigured.
This document updates RFC 4271 by inserting new paragraphs into Section 9.1 (Decision Process) and Section 9.1.3 (Phase 3: Route Dissemination), changing the default EBGP behavior from permissive to deny-by-default.
A BGP speaker MAY provide a configuration option to deviate from the default deny behaviors introduced by this document, allowing operators to revert to permissive EBGP behavior if explicitly configured.
Routes contained in an Adj-RIB-In associated with an EBGP peer SHALL NOT be considered eligible in the Decision Process if no explicit Import Policy has been applied.
Routes SHALL NOT be added to an Adj-RIB-Out associated with an EBGP peer if no explicit Export Policy has been applied.
Export Policy is defined as a local policy applied to select information for the Adj-RIBs-Out, determining which routes are advertised to other BGP speakers via UPDATE messages.
Import Policy is defined as a local policy applied to information in the Adj-RIBs-In, determining which routes learned from other BGP speakers are considered in the local Decision Process.
Explicitly configuring Import and Export Policies provides no protection against malicious or incorrect explicit configuration; the security considerations of RFC 4271 and vulnerability analysis of RFC 4272 also apply.
Permissive default routing policies can result in route leaks (RFC 7908) and routing of traffic through unexpected paths; these policies also have the potential to expose software defects or misconfiguration with unforeseen technical and business impacts. The default-deny update is intended to eliminate these inadvertent effects.