Associating Communities with Static and Aggregate Routes

Border gateway protocol (BGP) communities are optional, transitive attributes attached to BGP route prefixes to carry more information about that route prefix. Multiple route prefixes can have the same community attached such that it can be matched by a routing policy. As a result, the presence of a community value can be used to influence and control routing policies.

A BGP community is a 32-bit value that is written as two 16-bit numbers separated by a colon. The first number usually represents the autonomous system (AS) number that defines or originates the community while the second is set by the network administrator.

Knowledge of RFC 4271 (BGP-4) and RFC 1997 (BGP Communities Attribute) is assumed throughout this document, as well as knowledge of multi-protocol BGP (MP-BGP) and RFC 4364 (BGP/MPLS IP VPNs).

For SR Linux aggregate routes, it is possible to add a community directly on the aggregate route, without a routing policy. However, for static routes, the community is attached when the static route is redistributed into BGP using a routing policy.

The community value can be in the 4-byte format comprising of a 2-byte AS value, followed by a 2-byte decimal value, separated by a colon. It can also be the name of a well-known standard community, such as: no-export, no-advertise, no-export-subconfed.

Any community added can be matched using a routing policy.

The purpose of this example is to provision static and aggregate IPv4 route prefixes and associate a community with each route. These routes are then redistributed into the BGP protocol and advertised to other BGP speakers.

This is shown for IPv4 routes within an IP-VRF. Well-known, standard communities are also configured to show that the correct behavior is observed.

CE connections for next-hops shows the Customer Edge (CE) routers connected to PE-1.

The IP-VRF configuration for PE-1 is as follows:

# on PE-1:
enter candidate
    network-instance VRF1 {
        type ip-vrf
        admin-state enable
        interface int-VRF1onPE-1-CE-7 {
            interface-ref {
                interface ethernet-1/7
                subinterface 1
            }
        }
        interface int-VRF1onPE-1-CE-8 {
            interface-ref {
                interface ethernet-1/8
                subinterface 1
            }
        }
        interface loop1 {
            interface-ref {
                interface lo0
                subinterface 0
            }
        }
        protocols {
            bgp-ipvpn {
                bgp-instance 1 {
                    admin-state enable
                    mpls {
                        next-hop-resolution {
                            allowed-tunnel-types [
                                ldp
                            ]
                        }
                    }
                }
            }
            bgp-vpn {
                bgp-instance 1 {
                    route-distinguisher {
                        rd 192.0.2.1:1
                    }
                    route-target {
                        export-rt target:64496:1
                        import-rt target:64496:1
                    }
                }
            }
        }

with interfaces:

# on PE-1:
enter candidate
    interface ethernet-1/7 {
        admin-state enable
        vlan-tagging true
        ethernet {
            port-speed 100G
        }
        subinterface 1 {
            type routed
            admin-state enable
            description int-VRF1onPE-1-CE-7
            ipv4 {
                admin-state enable
                address 172.16.17.1/30 { }
            }
            vlan {
                encap {
                    single-tagged {
                        vlan-id 1
                    }
                }
            }
        }
    }
    interface ethernet-1/8 {
        admin-state enable
        vlan-tagging true
        ethernet {
            port-speed 100G
        }
        subinterface 1 {
            type routed
            description int-VRF1onPE-1-CE-8
            admin-state enable
            ipv4 {
                admin-state enable
                unnumbered {
                    admin-state enable
                    interface lo0.0
                }
            }
            vlan {
                encap {
                    single-tagged {
                        vlan-id 1
                    }
                }
            }
        }
    }
    interface lo0 {
        admin-state enable
        subinterface 0 {
            admin-state enable
            description "loop1 in VRF1"
            ipv4 {
                admin-state enable
                address 192.0.2.100/32 {
                    primary
                }
            }
        }
    }

For the unnumbered interface ethernet-1/8.1, the IP address is borrowed from the loopback interface lo0.0.

LDP is used as the label-switching protocol for next-hop resolution.

PE-4 is configured with an interface toward CE-6 that supports EBGP. The following export policy is configured:

# on PE-4:
enter candidate
    routing-policy {
        policy rp-BGP-VPN-accept {
            statement stmt-10 {
                match {
                    protocol bgp-ipvpn
                }
                action {
                    policy-result accept
                }

The configuration of VRF1 on PE-4 is as follows:

# on PE-4:
enter candidate
    network-instance VRF1 {
        type ip-vrf
        admin-state enable
        interface int-VRF1onPE-4-CE-6 {
            interface-ref {
                interface ethernet-1/6
                subinterface 1
            }
        }
        protocols {
            bgp-ipvpn {
                bgp-instance 1 {
                    admin-state enable
                    mpls {
                        next-hop-resolution {
                            allowed-tunnel-types [
                                ldp
                            ]
                        }
                    }
                }
            }
            bgp {
                admin-state enable
                autonomous-system 64496
                router-id 192.0.2.4
                ebgp-default-policy {
                    import-reject-all false
                    export-reject-all false
                }
                afi-safi ipv4-unicast {
                    admin-state enable
                }
                group grp-VRF1-ext {
                    admin-state enable
                    peer-as 64497
                    export-policy [
                        rp-BGP-VPN-accept
                    ]
                }
                neighbor 172.16.46.2 {
                    admin-state enable
                    peer-group grp-VRF1-ext
                }
            }
            bgp-vpn {
                bgp-instance 1 {
                    route-distinguisher {
                        rd 192.0.2.4:1
                    }
                    route-target {
                        export-rt target:64496:1
                        import-rt target:64496:1
                    }
                }
            }
        }

with interface:

# on PE-4:
enter candidate
    interface ethernet-1/6 {
        admin-state enable
        vlan-tagging true
        ethernet {
            port-speed 100G
        }
        subinterface 1 {
            type routed
            admin-state enable
            description int-VRF1onPE-4-CE-6
            ipv4 {
                admin-state enable
                address 172.16.46.1/30 { }
            }
            vlan {
                encap {
                    single-tagged {
                        vlan-id 1
                    }
                }
            }
        }

A static route has multiple next-hop options: direct connected IP address, black-hole, indirect IP address, and interface-name. In SR Linux, a static route points to a next-hop-group and the type of next-hop is defined inside that next-hop-group.

CE connections for next-hops shows a pair of CE routers connected to PE-1. The link to CE-7 is a numbered link. The link to CE-8 is an unnumbered link. The loopback interface address is used as a reference address for the unnumbered Ethernet interface.

Beyond CE-7 are several /24 subnets. Static routes to these individual subnets are created on PE-1 using a static route with a next-hop type of interface address or an indirect address. The indirect address is learned using a static route.

Beyond CE-8 is a single /24 subnet. A static route to this subnet is created with a reference to an interface as the next-hop.

There are several well-known, standard communities:

• no-export: the route is not advertised to any external peer. This route should be present in the route tables of all BGP speakers in the originating AS, but not in those in neighboring ASs.

• no-advertise: the route is not advertised to any peer. This route should not be present in any router as BGP-learned route.

The requirement for each subnet is:

• 10.100.100.0/24 must not be advertised outside of the AS. This must be associated with the standard, well-known community no-export. The community value is encoded as 65535:65281 (0xFFFFFF01), but the CLI requires the keyword no-export.

  # on PE-1:
  enter candidate
      routing-policy {
          prefix-set ps-100 {
              prefix 10.100.100.0/24 mask-length-range exact { }
          }
          standard-community-set scs-no-export {
              member [
                  no-export
              ]
          }
          policy rp-ps-100-no-export {
              statement stmt-10 {
                  match {
                      prefix {
                          prefix-set ps-100
                      }
                  }
                  action {
                      policy-result accept
                      bgp {
                          standard-community {
                              operation add
                              method reference
                              referenced-sets [
                                  scs-no-export
                              ]
                          }
                      }
                  }
              }
          }
  
  enter candidate
      network-instance VRF1 {
          next-hop-groups {
              group nhg-172.16.17.2 {
                  admin-state enable
                  nexthop 1 {
                      ip-address 172.16.17.2
                      admin-state enable
                  }
              }
          }
          static-routes {
              admin-state enable
              route 10.100.100.0/24 {
                  admin-state enable
                  next-hop-group nhg-172.16.17.2
              }
          }

• 10.100.101.0/24 must be advertised with a community value 64496:101

  # on PE-1:
  enter candidate
      routing-policy {
          prefix-set ps-101 {
              prefix 10.100.101.0/24 mask-length-range exact { }
          }
          standard-community-set scs-101 {
              member [
                  64496:101
              ]
          }
          policy rp-ps-101 {
              statement stmt-10 {
                  match {
                      prefix {
                          prefix-set ps-101
                      }
                  }
                  action {
                      policy-result accept
                      bgp {
                          standard-community {
                              operation add
                              method reference
                              referenced-sets [
                                  scs-101
                              ]
                          }
                      }
                  }
              }
          }
  
  enter candidate
      network-instance VRF1 {
          next-hop-groups {
              group nhg-172.16.17.2 {
                  admin-state enable
                  nexthop 1 {
                      ip-address 172.16.17.2
                      admin-state enable
                  }
              }
          }
          static-routes {
              admin-state enable
              route 10.100.101.0/24 {
                  admin-state enable
                  next-hop-group nhg-172.16.17.2
              }
          }

• 10.100.102.0/24 must not be advertised to any BGP peer. This must be associated with the standard, well-known community no-advertise. The community value is encoded as 65535:65282 (0xFFFFFF02), but the CLI requires the keyword no-advertise.

  # on PE-1:
  enter candidate
      routing-policy {
          prefix-set ps-102 {
              prefix 10.100.102.0/24 mask-length-range exact { }
          }
          standard-community-set scs-no-advertise {
              member [
                  no-advertise
              ]
          }
          policy rp-ps-102-no-advertise {
              statement stmt-10 {
                  match {
                      prefix {
                          prefix-set ps-102
                      }
                  }
                  action {
                      policy-result accept
                      bgp {
                          standard-community {
                              operation add
                              method reference
                              referenced-sets [
                                  scs-no-advertise
                              ]
                          }
                      }
                  }
              }
          }
  
  enter candidate
      network-instance VRF1 {
          next-hop-groups {
              group nhg-172.16.17.2 {
                  admin-state enable
                  nexthop 1 {
                      ip-address 172.16.17.2
                      admin-state enable
                  }
              }
          }
          static-routes {
              admin-state enable
              route 10.100.102.0/24 {
                  admin-state enable
                  next-hop-group nhg-172.16.17.2
              }
          }

• 10.100.103.0/24 must be advertised with a community value 64496:103 and a route tag value 10.

  # on PE-1:
  enter candidate
      routing-policy {
          prefix-set ps-103 {
              prefix 10.100.103.0/24 mask-length-range exact { }
          }
          tag-set ts-10 {
              tag-value [
                  10
              ]
          }
          standard-community-set scs-103 {
              member [
                  64496:103
              ]
          }
          policy rp-ps-103 {
              statement stmt-10 {
                  match {
                      prefix {
                          prefix-set ps-103
                      }
                  }
                  action {
                      policy-result accept
                      bgp {
                          standard-community {
                              operation add
                              method reference
                              referenced-sets [
                                  scs-103
                              ]
                          }
                      }
                      internal-tags {
                          set-tag-set [
                              ts-10
                          ]
                      }
                  }
              }
          }
  
  enter candidate
      network-instance VRF1 {
          next-hop-groups {
              group nhg-172.16.17.2 {
                  admin-state enable
                  nexthop 1 {
                      ip-address 172.16.17.2
                      admin-state enable
                  }
              }
          }
          static-routes {
              admin-state enable
              route 10.100.103.0/24 {
                  admin-state enable
                  next-hop-group nhg-172.16.17.2
              }
          }

• 10.100.104.0/24 must be advertised with a community value 64496:104. It is reachable via 192.0.2.7 which, in turn, is reachable via 172.16.17.2. This is using a static route which does not need to be advertised, therefore, it is associated with the no-advertise community.

  # on PE-1:
  enter candidate
      routing-policy {
          prefix-set ps-104 {
              prefix 10.100.104.0/24 mask-length-range exact { }
          }
          prefix-set ps-7 {
              prefix 192.0.2.7/32 mask-length-range exact { }
          }
          standard-community-set scs-104 {
              member [
                  64496:104
              ]
          }
          standard-community-set scs-no-advertise {
              member [
                  no-advertise
              ]
          }
          policy rp-ps-104 {
              statement stmt-10 {
                  match {
                      prefix {
                          prefix-set ps-104
                      }
                  }
                  action {
                      policy-result accept
                      bgp {
                          standard-community {
                              operation add
                              method reference
                              referenced-sets [
                                  scs-104
                              ]
                          }
                      }
                  }
              }
          }
          policy rp-ps-7-no-advertise {
              statement stmt-10 {
                  match {
                      prefix {
                          prefix-set ps-7
                      }
                  }
                  action {
                      policy-result accept
                      bgp {
                          standard-community {
                              operation add
                              method reference
                              referenced-sets [
                                  scs-no-advertise
                              ]
                          }
                      }
                  }
              }
          }
  
  enter candidate
      network-instance VRF1 {
          next-hop-groups {
              group nhg-192.0.2.7 {
                  admin-state enable
                  nexthop 1 {
                      ip-address 192.0.2.7
                      admin-state enable
                  }
              }
              group nhg-172.16.17.2 {
                  admin-state enable
                  nexthop 1 {
                      ip-address 172.16.17.2
                      admin-state enable
                  }
              }
          }
          static-routes {
              admin-state enable
              route 10.100.104.0/24 {
                  admin-state enable
                  next-hop-group nhg-192.0.2.7
              }
              route 192.0.2.7/32 {
                  admin-state enable
                  next-hop-group nhg-172.16.17.2
              }
          }

• 10.100.105.0/24 must be advertised with a community value 64496:105. It is reachable via the unnumbered interface to CE-8.

  # on PE-1:
  enter candidate
      routing-policy {
          prefix-set ps-105 {
              prefix 10.100.105.0/24 mask-length-range exact { }
          }
          standard-community-set scs-105 {
              member [
                  64496:105
              ]
          }
          policy rp-ps-105 {
              statement stmt-10 {
                  match {
                      prefix {
                          prefix-set ps-105
                      }
                  }
                  action {
                      policy-result accept
                      bgp {
                          standard-community {
                              operation add
                              method reference
                              referenced-sets [
                                  scs-105
                              ]
                          }
                      }
                  }
              }
          }
  
  enter candidate
      network-instance VRF1 {
          next-hop-groups {
              group nhg-ethernet-1/8 {
                  admin-state enable
                  nexthop 1 {
                      admin-state enable
                      resolve false
                      interface-ref {
                          interface ethernet-1/8
                          subinterface 1
                      }
                  }
              }
          }
          static-routes {
              admin-state enable
              route 10.100.105.0/24 {
                  admin-state enable
                  next-hop-group nhg-ethernet-1/8
              }
          }

On PE-1, static routes are configured that match the static routes from CE connections for next-hops, and the preceding conditions.

The default behavior of an IP-VRF is to export all static and connected routes into a BGP labeled route with the appropriate route-target extended community configured in the bgp-vpn bgp-instance context.

# On PE-1:
    network-instance default {
        protocols {
            bgp {
                group grp-internal {
                    export-policy [
                        rp-ps-100-no-export
                        rp-ps-101
                        rp-ps-102-no-advertise
                        rp-ps-103
                        rp-ps-104
                        rp-ps-105
                        rp-ps-7-no-advertise
                    ]

The following BGP table on PE-1 shows which routes have been exported correctly to RR-5:

A:admin@PE-1# show / network-instance default protocols bgp neighbor 192.0.2.5 advertised-routes l3vpn-ipv4-unicast
---------------------------------------------------------------------------------------------------------------------------------------------------------
Peer        : 192.0.2.5, remote AS: 64496, local AS: 64496
Type        : static
Description : None
Group       : grp-internal
---------------------------------------------------------------------------------------------------------------------------------------------------------
Origin codes: i=IGP, e=EGP, ?=incomplete
+-------------------------------------------------------------------------------------------------------------------------------------------------------+
|      Route-            Network            Path-id            Next Hop             MED              LocPref             AsPath             Origin      |
|  distinguisher                                                                                                                                        |
+=======================================================================================================================================================+
| 192.0.2.1:1        10.100.100.0/24    0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        10.100.101.0/24    0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        10.100.102.0/24    0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        10.100.103.0/24    0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        10.100.104.0/24    0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        10.100.105.0/24    0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        172.16.17.0/30     0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        192.0.2.7/32       0                  192.0.2.1                 -                 100                                     i        |
| 192.0.2.1:1        192.0.2.100/32     0                  192.0.2.1                 -                 100                                     i        |
+-------------------------------------------------------------------------------------------------------------------------------------------------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
9 advertised BGP routes
---------------------------------------------------------------------------------------------------------------------------------------------------------

A:admin@PE-4# show / network-instance default protocols bgp routes l3vpn-ipv4-unicast summary
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP route table of network-instance "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
---------------------------------------------------------------------------------------------------------------------------------------------------------
+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+
|       Status       |       Route        |      Network       |      Next Hop      |        MED         |      LocPref       |      Path Val      |
|                    |   Distinguisher    |                    |                    |                    |                    |                    |
+====================+====================+====================+====================+====================+====================+====================+
| u*>                | 192.0.2.1:1        | 10.100.100.0/24    | 192.0.2.1          |                    | 100                |  i                 |
| u*>                | 192.0.2.1:1        | 10.100.101.0/24    | 192.0.2.1          |                    | 100                |  i                 |
| u*>                | 192.0.2.1:1        | 10.100.103.0/24    | 192.0.2.1          |                    | 100                |  i                 |
| u*>                | 192.0.2.1:1        | 10.100.104.0/24    | 192.0.2.1          |                    | 100                |  i                 |
| u*>                | 192.0.2.1:1        | 10.100.105.0/24    | 192.0.2.1          |                    | 100                |  i                 |
| u*>                | 192.0.2.1:1        | 172.16.17.0/30     | 192.0.2.1          |                    | 100                |  i                 |
| u*>                | 192.0.2.1:1        | 192.0.2.100/32     | 192.0.2.1          |                    | 100                |  i                 |
| u*>                | 192.0.2.4:1        | 172.16.46.0/30     | 0.0.0.0            |                    |                    |  i                 |
+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
8 received BGP routes: 8 used, 8 valid, 0 stale
8 available destinations: 0 with ECMP multipaths
---------------------------------------------------------------------------------------------------------------------------------------------------------

A:admin@PE-4# show / network-instance default protocols bgp routes l3vpn-ipv4-unicast prefix 10.100.100.0/24
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.100.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Route-distinguisher: 192.0.2.1:1   Network: 10.100.100.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source    : neighbor 192.0.2.5
    Route Preference: MED is -, LocalPref is 100
    BGP next-hop    : 192.0.2.1
    Path            :  i
    Communities     : no-export, target:64496:1
Path 1 was advertised to: 
[  ]
---------------------------------------------------------------------------------------------------------------------------------------------------------

The prefix 10.100.101.0/24 is a member of community 64496:101. This is correctly advertised to PE-4.

A:admin@PE-4# show / network-instance default protocols bgp routes l3vpn-ipv4-unicast prefix 10.100.101.0/24
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.101.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Route-distinguisher: 192.0.2.1:1   Network: 10.100.101.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source    : neighbor 192.0.2.5
    Route Preference: MED is -, LocalPref is 100
    BGP next-hop    : 192.0.2.1
    Path            :  i
    Communities     : 64496:101, target:64496:1
Path 1 was advertised to: 
[  ]
---------------------------------------------------------------------------------------------------------------------------------------------------------

The prefix 10.100.103.0/24 is a member of community 64496:103. This is correctly advertised to PE-4, as follows:

A:admin@PE-4# show / network-instance default protocols bgp routes l3vpn-ipv4-unicast prefix 10.100.103.0/24
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.103.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Route-distinguisher: 192.0.2.1:1   Network: 10.100.103.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source    : neighbor 192.0.2.5
    Route Preference: MED is -, LocalPref is 100
    BGP next-hop    : 192.0.2.1
    Path            :  i
    Communities     : 64496:103, target:64496:1
Path 1 was advertised to: 
[  ]
---------------------------------------------------------------------------------------------------------------------------------------------------------

The prefix 10.100.104.0/24 is a member of community 64496:104. This is correctly advertised to PE-4, as follows:

A:admin@PE-4# show / network-instance default protocols bgp routes l3vpn-ipv4-unicast prefix 10.100.104.0/24
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.104.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Route-distinguisher: 192.0.2.1:1   Network: 10.100.104.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source    : neighbor 192.0.2.5
    Route Preference: MED is -, LocalPref is 100
    BGP next-hop    : 192.0.2.1
    Path            :  i
    Communities     : 64496:104, target:64496:1
Path 1 was advertised to: 
[  ]
---------------------------------------------------------------------------------------------------------------------------------------------------------

The prefix 10.100.105.0/24 is a member of community 64496:105. This is correctly advertised to PE-4.

A:admin@PE-4# show / network-instance default protocols bgp routes l3vpn-ipv4-unicast prefix 10.100.105.0/24
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.105.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Route-distinguisher: 192.0.2.1:1   Network: 10.100.105.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source    : neighbor 192.0.2.5
    Route Preference: MED is -, LocalPref is 100
    BGP next-hop    : 192.0.2.1
    Path            :  i
    Communities     : 64496:105, target:64496:1
Path 1 was advertised to: 
[  ]
---------------------------------------------------------------------------------------------------------------------------------------------------------

The following route table of VRF1 on PE-4 shows that these five BGP-learned routes 10.100.x.0/24 are present as valid routes.

A:admin@PE-4# show / network-instance VRF1 ipv4 route all
=========================================================================================================================================================
IPv4-unicast route table for ip-vrf network-instance: VRF1
---------------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
     : L (leaked route from another network-instance)
     : B (backup NHG active and displayed)
     : S (statistics supported)
     : D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------------------------------------
Prefix               Route Type   Metric   Pref    Flags    Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------------------------------------
10.100.100.0/24      bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40000)
10.100.101.0/24      bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40000)
10.100.103.0/24      bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40000)
10.100.104.0/24      bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40000)
10.100.105.0/24      bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40000)
172.16.17.0/30       bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40000)
172.16.46.0/30       local        0        0       >        172.16.46.1(ethernet-1/6.1)
192.0.2.100/32       bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40000)

The following route table on CE-6 shows only four of the 10.100.x.0/24 routes as valid BGP-learned routes, as expected. The prefix 10.100.100.0/24 is not received from PE-4 because it is a member of the no-export community.

A:admin@CE-6# show / network-instance default ipv4 route all
=========================================================================================================================================================
IPv4-unicast route table for default network-instance
---------------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
     : L (leaked route from another network-instance)
     : B (backup NHG active and displayed)
     : S (statistics supported)
     : D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------------------------------------
Prefix               Route Type   Metric   Pref    Flags    Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------------------------------------
10.100.101.0/24      bgp          0        170     >        172.16.46.1(route:local)
10.100.103.0/24      bgp          0        170     >        172.16.46.1(route:local)
10.100.104.0/24      bgp          0        170     >        172.16.46.1(route:local)
10.100.105.0/24      bgp          0        170     >        172.16.46.1(route:local)
172.16.17.0/30       bgp          0        170     >        172.16.46.1(route:local)
172.16.46.0/30       local        0        0       >        172.16.46.2(ethernet-1/4.1)
192.0.2.100/32       bgp          0        170     >        172.16.46.1(route:local)

Static route 10.100.101.0/24 is received on CE-6 with the correct community 64496:101, as follows:

A:admin@CE-6# show / network-instance default protocols bgp routes ipv4 prefix 10.100.101.0/24 detail
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.101.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Network: 10.100.101.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source      : neighbor 172.16.46.1
    Route Preference  : MED is -, No LocalPref
    BGP next-hop      : 172.16.46.1
    Path              :  i [64496]
    Communities       : 64496:101
    RR Attributes     : No Originator-ID, Cluster-List is [ - ]
    Aggregation       : Not an aggregate route
    Unknown Attr      : None
    Invalid Reason    : None
    Tie Break Reason  : none
    Route Flap Damping: None
---------------------------------------------------------------------------------------------------------------------------------------------------------

Static route 10.100.103.0/24 is received on CE-6 with the correct community 64496:103, as follows:

A:admin@CE-6# show / network-instance default protocols bgp routes ipv4 prefix 10.100.103.0/24 detail
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.103.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Network: 10.100.103.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source      : neighbor 172.16.46.1
    Route Preference  : MED is -, No LocalPref
    BGP next-hop      : 172.16.46.1
    Path              :  i [64496]
    Communities       : 64496:103
    RR Attributes     : No Originator-ID, Cluster-List is [ - ]
    Aggregation       : Not an aggregate route
    Unknown Attr      : None
    Invalid Reason    : None
    Tie Break Reason  : none
    Route Flap Damping: None
---------------------------------------------------------------------------------------------------------------------------------------------------------

Static route 10.100.104.0/24 is received on CE-6 with the correct community 64496:104, as follows:

A:admin@CE-6# show / network-instance default protocols bgp routes ipv4 prefix 10.100.104.0/24 detail
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.104.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Network: 10.100.104.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source      : neighbor 172.16.46.1
    Route Preference  : MED is -, No LocalPref
    BGP next-hop      : 172.16.46.1
    Path              :  i [64496]
    Communities       : 64496:104
    RR Attributes     : No Originator-ID, Cluster-List is [ - ]
    Aggregation       : Not an aggregate route
    Unknown Attr      : None
    Invalid Reason    : None
    Tie Break Reason  : none
    Route Flap Damping: None
---------------------------------------------------------------------------------------------------------------------------------------------------------

Static route 10.100.105.0/24 is received on CE-6 with the correct community 64496:105.

A:admin@CE-6# show / network-instance default protocols bgp routes ipv4 prefix 10.100.105.0/24 detail
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.100.105.0/24" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Network: 10.100.105.0/24
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source      : neighbor 172.16.46.1
    Route Preference  : MED is -, No LocalPref
    BGP next-hop      : 172.16.46.1
    Path              :  i [64496]
    Communities       : 64496:105
    RR Attributes     : No Originator-ID, Cluster-List is [ - ]
    Aggregation       : Not an aggregate route
    Unknown Attr      : None
    Invalid Reason    : None
    Tie Break Reason  : none
    Route Flap Damping: None
---------------------------------------------------------------------------------------------------------------------------------------------------------

An aggregate route can be configured to represent a larger number of prefixes. For example, a set of prefixes 10.101.0.0/24 to 10.101.7.0/24 can be represented as a single aggregate prefix of 10.101.0.0/21.

This is because the third octet in the range 0 to 7 can be represented by the 8 bits 00000000 to 00000111. The first 5 bits of this octet are common, along with the previous 2 octets, giving a prefix where the first 21 bits are common. Therefore, the aggregate can be written as 10.101.0.0/21.

To illustrate the configuration of an aggregate, consider following.

CE-7 connectivity shows a CE router (CE-7), in AS 64498, that advertises a series of contiguous prefixes via BGP.

• 10.101.0.0/24 to 10.101.7.0/24

• 10.102.0.0/24 to 10.102.7.0/24

Instead of advertising all these prefixes out of the IP-VRF toward an external CE individually, an aggregate route can be configured that summarizes each set of eight prefixes and a community can be directly associated with each aggregate route.

The configuration for VRF2 on PE-1, including the external BGP configuration is as follows:

# on PE-1:
enter candidate
    network-instance VRF2 {
        type ip-vrf
        admin-state enable
        interface int-VRF2onPE-1-CE-7 {
            interface-ref {
                interface ethernet-1/7
                subinterface 2
            }
        }
        protocols {
            bgp-ipvpn {
                bgp-instance 1 {
                    admin-state enable
                    mpls {
                        next-hop-resolution {
                            allowed-tunnel-types [
                                ldp
                            ]
                        }
                    }
                }
            }
            bgp {
                admin-state enable
                autonomous-system 64496
                router-id 192.0.2.1
                ebgp-default-policy {
                    import-reject-all false
                    export-reject-all false
                }
                afi-safi ipv4-unicast {
                    admin-state enable
                }
                group grp-VRF2-ext {
                    admin-state enable
                    peer-as 64498
                }
                neighbor 172.16.117.2 {
                    admin-state enable
                    peer-group grp-VRF2-ext
                }
            }
            bgp-vpn {
                bgp-instance 1 {
                    route-distinguisher {
                        rd 192.0.2.1:2
                    }
                    route-target {
                        export-rt target:64496:2
                        import-rt target:64496:2
                    }
                }
            }
        }

with interface:

# on PE-1:
enter candidate
    interface ethernet-1/7 {
        admin-state enable
        vlan-tagging true
        ethernet {
            port-speed 100G
        }
        subinterface 2 {
            type routed
            admin-state enable
            description int-VRF2onPE-1-CE-7
            ipv4 {
                admin-state enable
                address 172.16.117.1/30 { }
            }
            vlan {
                encap {
                    single-tagged {
                        vlan-id 2
                    }
                }
            }
        }

The BGP neighbor relationship on PE-1 shows the following:

A:admin@PE-1# show / network-instance VRF2 protocols bgp neighbor
---------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF2"
Flags: S static, D dynamic, L discovered by LLDP, B BFD enabled, - disabled, * slow
---------------------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------------------
+-----------------+------------------------+-----------------+------+---------+--------------+--------------+------------+------------------------+
|    Net-Inst     |          Peer          |      Group      | Flag | Peer-AS |    State     |    Uptime    |  AFI/SAFI  |     [Rx/Active/Tx]     |
|                 |                        |                 |  s   |         |              |              |            |                        |
+=================+========================+=================+======+=========+==============+==============+============+========================+
| VRF2            | 172.16.117.2           | grp-VRF2-ext    | S    | 64498   | established  | 0d:0h:1m:43s | ipv4-      | [32/32/0]              |
|                 |                        |                 |      |         |              |              | unicast    |                        |
+-----------------+------------------------+-----------------+------+---------+--------------+--------------+------------+------------------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
1 configured neighbors, 1 configured sessions are established, 0 disabled peers
0 dynamic peers

The following output shows the received BGP routes on PE-1:

A:admin@PE-1# show / network-instance VRF2 protocols bgp neighbor 172.16.117.2 received-routes ipv4
---------------------------------------------------------------------------------------------------------------------------------------------------------
Peer        : 172.16.117.2, remote AS: 64498, local AS: 64496
Type        : static
Description : None
Group       : grp-VRF2-ext
---------------------------------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
+-------------------------------------------------------------------------------------------------------------------------------------------------------+
|      Status            Network            Path-id            Next Hop             MED              LocPref             AsPath             Origin      |
+=======================================================================================================================================================+
|       u*>          10.101.0.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.0.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.1.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.1.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.2.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.2.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.3.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.3.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.4.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.4.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.5.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.5.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.6.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.6.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.7.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.101.7.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.0.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.0.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.1.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.1.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.2.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.2.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.3.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.3.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.4.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.4.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.5.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.5.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.6.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.6.1/32      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.7.0/24      0                  172.16.117.2              -                              [64498]                    i        |
|       u*>          10.102.7.1/32      0                  172.16.117.2              -                              [64498]                    i        |
+-------------------------------------------------------------------------------------------------------------------------------------------------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
32 received BGP routes : 32 used 32 valid
---------------------------------------------------------------------------------------------------------------------------------------------------------

PE-4 also has a VRF2 instance configured, so that it receives the imported BGP routes. The service configuration for VRF2 on PE-4 is as follows:

# on PE-4:
enter candidate
    network-instance VRF2 {
        type ip-vrf
        admin-state enable
        interface int-VRF2onPE-4-CE-6 {
            interface-ref {
                interface ethernet-1/6
                subinterface 2
            }
        }
        protocols {
            bgp-ipvpn {
                bgp-instance 1 {
                    admin-state enable
                    mpls {
                        next-hop-resolution {
                            allowed-tunnel-types [
                                ldp
                            ]
                        }
                    }
                }
            }
            bgp {
                admin-state enable
                router-id 192.0.2.4
                autonomous-system 64496
                ebgp-default-policy {
                    import-reject-all false
                    export-reject-all false
                }
                afi-safi ipv4-unicast {
                    admin-state enable
                }
                group grp-VRF2-ext {
                    admin-state enable
                    peer-as 64497
                }
                neighbor 172.16.146.2 {
                    admin-state enable
                    peer-group grp-VRF2-ext
                }
            }
            bgp-vpn {
                bgp-instance 1 {
                    route-distinguisher {
                        rd 192.0.2.4:2
                    }
                    route-target {
                        export-rt target:64496:2
                        import-rt target:64496:2
                    }
                }
            }
        }

with interface:

# on PE-4:
enter candidate
    interface ethernet-1/6 {
        admin-state enable
        vlan-tagging true
        ethernet {
            port-speed 100G
        }
        subinterface 2 {
            type routed
            admin-state enable
            description int-VRF2onPE-4-CE-6
            ipv4 {
                admin-state enable
                address 172.16.146.1/30 { }
            }
            vlan {
                encap {
                    single-tagged {
                        vlan-id 2
                    }
                }
            }
        }

CE-6 connectivity shows the connectivity between PE-4 and CE-6. PE-4 only forwards a summarizing aggregate route toward CE-6.

PE-4 receives labeled BGP route prefixes from PE-1 via the route reflector and installs them in the FIB for VRF2, as follows:

A:admin@PE-4# show / network-instance VRF2 ipv4 route all
=========================================================================================================================================================
IPv4-unicast route table for ip-vrf network-instance: VRF2
---------------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
     : L (leaked route from another network-instance)
     : B (backup NHG active and displayed)
     : S (statistics supported)
     : D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------------------------------------
Prefix               Route Type   Metric   Pref    Flags    Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------------------------------------
10.101.0.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.0.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.1.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.1.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.2.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.2.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.3.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.3.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.4.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.4.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.5.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.5.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.6.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.6.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.7.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.101.7.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.0.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.0.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.1.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.1.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.2.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.2.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.3.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.3.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.4.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.4.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.5.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.5.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.6.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.6.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.7.0/24        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
10.102.7.1/32        bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
172.16.117.0/30      bgp-ipvpn    10       170     >        192.0.2.1(tunnel:ldp, label:40001)
172.16.146.0/30      local        0        0       >        172.16.146.1(ethernet-1/6.2)

On CE-6, an additional interface is configured toward VRF2 on PE-4, as follows:

# on CE-6:
enter candidate
    network-instance default {
        interface int-CE-6-VRF2onPE-4 {
            interface-ref {
                interface ethernet-1/4
                subinterface 2
            }
        }

# on CE-6:
enter candidate
    interface ethernet-1/4 {
        admin-state enable
        vlan-tagging true
        ethernet {
            port-speed 100G
        }
        subinterface 2 {
            type routed
            admin-state enable
            description int-CE-6-VRF2onPE-4
            ipv4 {
                admin-state enable
                address 172.16.146.2/30 { }
            }
            vlan {
                encap {
                    single-tagged {
                        vlan-id 2
                    }
                }
            }
        }

The BGP configuration of CE-6 is as follows:

# on CE-6:
enter candidate
    network-instance default {
        protocols {
            bgp {
                admin-state enable
                autonomous-system 64497
                router-id 192.0.2.6
                ebgp-default-policy {
                    import-reject-all false
                    export-reject-all false
                }
                afi-safi ipv4-unicast {
                    admin-state enable
                }
                group grp-ext-toVRF2onPE-4 {
                    admin-state enable
                    peer-as 64496
                }
                neighbor 172.16.146.1 {
                    admin-state enable
                    peer-group grp-ext-toVRF2onPE-4
                }
            }
        }

The BGP neighbor state for PE-4 is as follows:

A:admin@PE-4# show / network-instance VRF2 protocols bgp neighbor 172.16.146.2
---------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF2"
Flags: S static, D dynamic, L discovered by LLDP, B BFD enabled, - disabled, * slow
---------------------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------------------
+-----------------+------------------------+-----------------+------+---------+--------------+--------------+------------+------------------------+
|    Net-Inst     |          Peer          |      Group      | Flag | Peer-AS |    State     |    Uptime    |  AFI/SAFI  |     [Rx/Active/Tx]     |
|                 |                        |                 |  s   |         |              |              |            |                        |
+=================+========================+=================+======+=========+==============+==============+============+========================+
| VRF2            | 172.16.146.2           | grp-VRF2-ext    | S    | 64497   | established  | 0d:0h:16m:24 | ipv4-      | [6/0/0]                |
|                 |                        |                 |      |         |              | s            | unicast    |                        |
+-----------------+------------------------+-----------------+------+---------+--------------+--------------+------------+------------------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
1 configured neighbors, 1 configured sessions are established, 0 disabled peers
0 dynamic peers

To advertise a summarizing aggregate route with an associated community string, an aggregate route is required. In this case, the 10.101.x.0/24 group of prefixes is associated with community 64496:10100. The 10.102.x.0/24 group of prefixes is associated with the standard community no-export, so that it is not advertised to any external peer. These aggregate routes are configured in VRF2 on PE-4, as follows:

# on PE-4:
enter candidate
    network-instance VRF2 {
        aggregate-routes {
            route 10.101.0.0/21 {
                admin-state enable
                communities {
                    add [
                        64496:10100
                    ]
                }
            }
            route 10.102.0.0/21 {
                admin-state enable
                communities {
                    add [
                        no-export
                    ]
                }
            }

The following export policy is required on PE-4 to allow the advertising of the aggregate route. No community is applied using this policy.

# on PE-4:
enter candidate
    routing-policy {
        policy rp-VPN-Agg {
            statement stmt-10 {
                match {
                    protocol aggregate
                }
                action {
                    policy-result accept
                }

This is applied as an export policy within the group context of the BGP configuration of the IP-VRF, as follows:

# on PE-4:
    network-instance VRF2 {
        protocols {
            bgp {
                group grp-VRF2-ext {
                    export-policy [
                        rp-PE-4-VPN-Agg
                    ]

The aggregate route 10.101.0.0/21 is received at CE-6 via BGP. The community that was associated with this prefix is seen: 64496:10100. The route is seen as an aggregate, with PE-4 as the aggregating router (192.0.2.4).

A:admin@CE-6# show / network-instance default protocols bgp routes ipv4 prefix 10.101.0.0/21 detail
---------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.101.0.0/21" network-instance  "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
Network: 10.101.0.0/21
Received Paths: 1
  Path 1: <Best,Valid,Used,>
    Route source      : neighbor 172.16.146.1
    Route Preference  : MED is -, No LocalPref
    BGP next-hop      : 172.16.146.1
    Path              :  i [64496]
    Communities       : 64496:10100
    RR Attributes     : No Originator-ID, Cluster-List is [ - ]
    Aggregation       : 64496 192.0.2.4
    Unknown Attr      : None
    Invalid Reason    : None
    Tie Break Reason  : none
    Route Flap Damping: None

Path 1 was advertised to: 
[ 172.16.46.1 ]
Route Preference: MED is -, No LocalPref
Path            :  i [64497, 64496]
Communities     : 64496:10100
RR Attributes   : No Originator-ID, Cluster-List is [ - ]
Aggregation     : 64496 192.0.2.4
Unknown Attr    : None
---------------------------------------------------------------------------------------------------------------------------------------------------------

A:admin@CE-6# show / network-instance default ipv4 route all
=========================================================================================================================================================
IPv4-unicast route table for default network-instance
---------------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
     : L (leaked route from another network-instance)
     : B (backup NHG active and displayed)
     : S (statistics supported)
     : D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------------------------------------
Prefix               Route Type   Metric   Pref    Flags    Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------------------------------------
10.100.101.0/24      bgp          0        170     >        172.16.46.1(route:local)
10.100.103.0/24      bgp          0        170     >        172.16.46.1(route:local)
10.100.104.0/24      bgp          0        170     >        172.16.46.1(route:local)
10.100.105.0/24      bgp          0        170     >        172.16.46.1(route:local)
10.101.0.0/21        bgp          0        170     >        172.16.146.1(route:local)
172.16.17.0/30       bgp          0        170     >        172.16.46.1(route:local)
172.16.46.0/30       local        0        0       >        172.16.46.2(ethernet-1/4.1)
172.16.146.0/30      local        0        0       >        172.16.146.2(ethernet-1/4.2)
192.0.2.100/32       bgp          0        170     >        172.16.46.1(route:local)

The aggregate route 10.102.0.0/21 is not received at CE-6: PE-4 does not advertise it, because it is associated with the no-export community.