Summary

  • RFC 9871 can preserve an (endpoint, origin color) NLRI while an LCM extended community translates the intended behavior into the receiving color domain's local number.
  • The border mapping belongs to a peering agreement and local route policy; a syntactically valid LCM value does not authenticate that the two operators meant the same thing.
  • Different LCM values on paths to the same endpoint and color are a declared misconfiguration. Best-path selection and a warning contain it; they do not determine the correct meaning.

One route, two dictionaries

A color in BGP Color-Aware Routing is a non-zero 32-bit integer. Its compactness is useful precisely because it is not a sentence. The operator assigns the sentence: low delay, avoid a resource, insert a network function, or another routing behavior. RFC 9871 calls the nodes that share that mapping a color domain. A color domain may span several routing domains, but its semantic unity comes from configuration and administration, not from the number itself.

The specification's border example refuses a convenient fiction. Low delay is C2 in Domain Two and C1 in Domain One. Domain Two advertises (E2,C2) through BGP CAR. At the border, the route can retain that NLRI while LCM-EC changes from C2 to C1. Nodes in Domain One then use the local value for next-hop resolution and service steering.

This is not ordinary renaming. RFC 9871 says that, when present, LCM-EC supplies the route's intent color for validation, resolution, AIGP calculation and steering instead of the NLRI color. The stable key identifies the advertised route; the transitive extended community carries the current domain's interpretation. An audit that stores only the key preserves identity while discarding the decision that gave it operational meaning.

Three colors can coexist without being synonyms

The NLRI color distinguishes a route to an endpoint. LCM-EC maps that route's intent into a local color domain. BGP Color-EC can specify a different color for resolving the route's next hop, for example when a transit domain offers a coarser or different local intent. RFC 9871 permits LCM-EC and Color-EC to appear together and gives a default resolution order: local policy first, then Color-EC, then LCM-EC.

That order is a custody chain. A dashboard that displays one generic “color” erases which field supplied the value, which policy overrode it, and which domain's vocabulary it represents. The minimally useful record is the received NLRI and attributes, peer, policy version, mapping actor, resulting route, and timestamp. The later FIB and packet observation remain separate records.

RFC 9256 makes a similar distinction inside SR Policy: color helps identify a policy, but candidate-path validity, active selection and forwarding-plane instantiation are different states. RFC 9012 defines the Color Extended Community and tunnel-encapsulation machinery. RFC 7311 supplies AIGP context. None turns a shared integer into a universal service definition.

The border owns the translation

RFC 9871 allows the advertising or receiving border speaker to attach or update LCM-EC. Which side acts is determined by the operators' peering agreement and expressed by local policy. Protocol syntax therefore preserves administrative independence instead of silently appointing one domain's dictionary as global.

That freedom creates a precise governance obligation. The mapping record should name the source intent, destination intent, route scope, agreement version, approving owners, effective time and rollback. Unique endpoint prefixes normally scope colors well enough that separate domains need coordinate only the mapping. A shared transport service using the same coordinated service IP is the exception: its associated colors also need coordination because prefix scope no longer separates the claims.

The RFC also says LCM-EC and Color-EC must not be filtered from the relevant CAR and service routes, or the intended behavior will not be achieved. A route may remain reachable in a routing table after its semantic attribute disappears. “The prefix is still present” is therefore not evidence that the agreed treatment survived an intermediate policy.

Determinism is not reconciliation

An implementation should send at most one LCM-EC. If several instances arrive on one route, the receiver must ignore all but the numerically highest. That rule produces deterministic parsing from malformed or redundant input; it does not say the highest number is the correct business interpretation.

A different conflict has an explicit operational diagnosis. If multiple paths for the same endpoint and color carry different LCM values, RFC 9871 calls that a remapping misconfiguration. The LCM on the selected BGP best path should be installed, and a warning should be logged. The network keeps moving, but the winning path has not adjudicated the agreement. Remediation still needs the two policy histories and the intended mapping.

The new CAR SAFIs separate infrastructure routes from ordinary service-route families and require explicit configuration and filtering. IANA records SAFI 83 for BGP CAR and 84 for VPN CAR. RFC 4760 supplies the multiprotocol BGP framework; RFC 4271 and RFC 7606 supply base behavior and error handling. These layers make the mechanism inspectable. They do not prove adoption or correctness.

Experimental code, real control surface

RFC 9871 is Experimental. RFC 9832 describes another Experimental approach to classful transport. Their publication records show an evaluated design space, not a winner or a deployed fact. A Leadership Alliance decision should therefore separate trial authority from production authority: where may CAR be enabled, which peers may carry it, which mappings are acceptable, and what evidence closes a test?

Security controls protect different links. RFC 5925 can protect a TCP session; route policy can limit the new SAFI; the base BGP security model still applies. Yet a correctly authenticated peer can advertise a mapping that is wrong for the agreement. RFC 9871 warns that manipulated CAR routes can divert traffic, insert an unwanted node, avoid controls or cause denial of service. Authentication of the messenger is not validation of the semantic translation.

Sources