Here is some context to the scenario (note that I have snuffed some stuff as this is a real network with real public IP's)
The route is a directly connected LAN on the CE:
Code:
CE#show ip route | i 10.44.72.0/24
C 10.44.72.0/24 is directly connected, Vlan10
BGP config on CE
Code:
router bgp 65135
bgp log-neighbor-changes
bgp redistribute-internal
redistribute connected route-map CONNECTED <<<<<<<<route enters BGP process here
redistribute static route-map STATIC
neighbor X.X.X.49 remote-as X
neighbor X.X.X.49 description X
neighbor X.X.X.49 password 7 X
neighbor X.X.X.49 timers 15 45
neighbor X.X.X.49 send-community
neighbor X.X.X.49 allowas-in
neighbor X.X.X.49 route-map CE-FROM-PE-BACKUP in
neighbor X.X.X.49 route-map CE-TO-PE-BACKUP out <<<<<<<<<Community set here
Code:
CE#show run | section CE-TO-PE-BACKUP
neighbor X.X.X.49 route-map CE-TO-PE-BACKUP out
route-map CE-TO-PE-BACKUP deny 10
match community MPLUS-TRACKING
route-map CE-TO-PE-BACKUP permit 100
set metric 0
set community 65135:123 65135:456 additive <<<<<<<<<<community set
Over to the PE we receive the route via BGP with the attached communities.
Code:
PE#sh ip bgp vpnv4 vrf XXX 10.44.72.0/24
BGP routing table entry for X:X:10.44.72.0/24, version 703105176
Paths: (1 available, best #1, table XXX)
Advertised to update-groups:
1 45
65135
X.X.X.50 from X.X.X.50 (X.X.X.68) <<<<<<<<<<<<<<<<<<.68 is the loopback of the CE which is the Router-ID
Origin incomplete, metric 0, localpref 150, valid, external, best
Community: 65135:123 65135:456<<<<<<<<<<<<<<<<< here's our communities
Extended Community: RT:X:X RT:X:X
mpls labels in/out 1472/nolabel
But the PE advertises the route back again! Surely this is not supposed to happen.
Code:
PE#sh ip bgp vpnv4 vrf XXX neighbors X.X.X.50 advertised-routes | include 10.44.72.0
*> 10.44.72.0/24 X.X.X.50 0 150 0 65135 ?
Our only protectection from this back on the CE is to filter the route using community we attached using an inbound route map
Code:
neighbor X.X.X.49 route-map CE-FROM-PE-BACKUP in
Code:
CE#show run | section CE-FROM-PE-BACKUP
route-map CE-FROM-PE-BACKUP deny 10<<<<<<<<<<<<<<DENY
match community SITE-ID
route-map CE-FROM-PE-BACKUP permit 100
set local-preference 90
set weight 100
set community no-export additive
Code:
CE#show ip community-list SITE-ID
Named Community standard list SITE-ID
permit 65135:456 <<<<<<<<<<<<<<<<<<<
Any ideas on why this is happening? You help is greatly appreciated in advance.
