Visual RFC.
ALL RFCs / RFC 4456
Read the RFC ↗
RFC 4456 / ROUTE REFLECTION

Deploy the roles without changing their meaning

06

Redundancy, attributes and network topology still need deliberate configuration.

RFC 4456 · § 11EXAMPLE
4 / 4
Deploy the roles without changing their meaningA blocked inference separates loop-history fields from signatures, encryption and route authorization. The stop rejects a security claim, not every route; underlying BGP security issues remain unchanged.Preserve topology and security limitsORIGINATOR_ID and CLUSTER_LISTProvide reflection-loop historyDo not infer authenticity from presenceNot signatures, encryption or route authorizationUnderlying BGP security issues remainRFC4456 · chapter 6 · state 4 · offline examples
04
Keep loop control separate from security

No successful authenticated path is inferred from the mere presence of reflection attributes.

Source for this drawing: RFC 4456 · Read RFC section 11 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

Reflection is a control-plane distribution design, not authentication or automatic configuration.

  • BGP provides no way for a router to identify itself dynamically as a client of a reflector. Client roles are configured; a conventional BGP speaker can be a client. The diagram labels configuration, not a new client flag in a BGP packet (§§6,11).
  • In one simple multi-cluster design, RRs treat one another as non-clients and maintain a full mesh among those RRs, while clients peer with their cluster’s RR. That is one topology, not a requirement that every possible RR hierarchy use the same roles. Additional RRs can remove the single-reflector failure point when correctly connected (§§6–7,11).
  • When reflecting, an RR SHOULD NOT modify NEXT_HOP, AS_PATH, LOCAL_PREF or MED. These are path attributes for the next hop, AS history, internal preference and Multi-Exit Discriminator. The selected model preserves them while adding or preserving the reflection attributes (§10). NEXT_HOP is not automatically changed to the RR.
  • MED comparisons and differing IGP costs can yield selections different from a full mesh. The reflection topology should be considered together with the network topology, and some deployments keep extra client sessions for path quality. The original publication describes configuration approaches, not a universally optimal topology or a guarantee that fewer sessions means identical choices (§11).
  • RFC4456 does not change BGP’s underlying security issues. ORIGINATOR_ID and CLUSTER_LIST detect reflection loops; they are not signatures, encryption or proof that a route is authorized. This educational guide sends no real BGP traffic and changes no network configuration (§12).
  • Official status is Draft Standard, April2006. It obsoletes1966 and2796, has no formal Updates targets or obsoleted-by entry, and is updated by7606. These are publication relationships, not versions of BGP or a claim that7606 replaces all reflection semantics.
DETAILS

Fictional offline routing examples. Lines show BGP control sessions or route advertisements, not user-packet forwarding paths. Helpers model selected reflection and attribute rules; they do not implement a BGP daemon, TCP session, full decision process or production configuration.

Read the RFC section ↗

All chapters in RFC 4456

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗