Route aggregation and summarization
Requirement / business driver
Shrink routing tables and bound how far a failure propagates, while not blackholing or badly de-optimizing traffic.
Benefits
Smaller RIB/FIB; fewer SPF/flooding events (topology hiding) so faster, more stable convergence; a single flap behind a summary doesn't ripple outward.
Costs / risks
- Suboptimal routing - a summary hides the longer-prefix specifics, so traffic may take a less-ideal path.
- Blackholing - advertising a summary when not all components are present; mitigate with a discard / Null0 route for the aggregate.
- Loss of granularity for fine traffic engineering.
Where and when
- Summarize at hierarchy boundaries: distribution->core, OSPF ABR/ASBR, IS-IS L1/L2, AS edges.
- Leak more-specifics (up to host routes) only where you need optimal routing or anycast reachability - accept the larger table as the price.
The summary's metric is information too
A summary usually inherits the lowest metric among its components - which quietly defeats the summary's purpose: when the best component fails, the summary is re-advertised with a new metric, and the topology change you built the boundary to hide leaks straight through it as churn. The design rule is that a summary should carry a constant metric. Two ways to get one: create a controlled component that is always the lowest-cost member of the range (an anchor inside the summary on the summarizing router - with the black-hole caveat that this local component keeps the summary alive even when every real component is gone), or set the summary metric by policy at the boundary. Either way, a summary whose metric moves is only half a summary.
The distribution-summary trap (twist favourite)
Summarizing distribution -> core is the textbook move - it stops EIGRP queries and bounds OSPF LSA flooding at the boundary - but it carries a topology prerequisite. With L2 access and an FHRP pair (Layer 2 fault isolation and resiliency), an access-uplink failure moves the gateway to the peer distribution switch - yet the failed-side switch still advertises the same summary to the core, because its other component prefixes keep the summary alive. The core keeps ECMP-ing return traffic to both distributions, and the half arriving at the switch that lost the specific route is black-holed behind its own summary. Summarizing at the distribution therefore requires a direct inter-distribution L3 link (giving the stale advertiser a path to the specifics) - or accepting the access layer as transit, which few designs want. The general rule: aggregate only where the aggregating devices share a path to every component, or the summary outlives the reachability it claims.
BGP aggregation and the AS_PATH trade
BGP summarization has a wrinkle IGP summarization does not: the aggregate is originated by the summarizing AS, and when its components carry different AS_PATHs, the aggregate's path sequence is null - the very information BGP's loop prevention relies on (drop routes listing my own ASN) has been erased for that prefix. The as-set option restores safety by attaching the unordered set of all component ASNs, so any AS present in a component still rejects the aggregate - but it couples fates: any component's path change or flap now churns the aggregate's attributes, and the aggregate is filtered wherever any listed ASN objects. The design rule: summarize where the components share a path story; reach for as-set knowingly (loop safety bought with churn coupling); and when the goal is inbound TE rather than table size, prefer the aggregate-plus-selective-more-specifics patterns of BGP in enterprise design over clever aggregate attributes.
Recommendation / justification
Summarize at boundaries by default; leak specifics only where optimality or anycast demands it. The justification is the failure-domain and table-size reduction; the tradeoff you must name is suboptimal routing vs scale.
Decision shorthand
Need smallest, most stable tables -> summarize. Need optimal path / anycast / host reachability -> leak the specific (bounded).
IPv6 / dual-stack note
IPv6's vast space makes structured addressing for summarization even more valuable - design the v6 plan so the same boundaries summarize cleanly.
Related
- Network hierarchy and topologies
- Generic routing and addressing - PBR, NAT, RIB-FIB
- Fast convergence techniques
Spaced repetition
The two main risks of summarization are [...].
The two main risks of summarization are suboptimal routing and blackholing.
You prevent a summary route from blackholing traffic (when components are missing) with a [...] for the aggregate.
You prevent a summary route from blackholing traffic (when components are missing) with a discard / Null0 route for the aggregate.
Summarization speeds convergence because it provides [...] - flaps behind the summary don't trigger SPF/flooding elsewhere.
Summarization speeds convergence because it provides topology hiding - flaps behind the summary don't trigger SPF/flooding elsewhere.
Summarizing at the distribution layer requires which topology element, and why?
A direct inter-distribution L3 link - after an access-uplink failure the failed-side distribution still advertises the summary (its other components keep it alive), so ECMP return traffic landing there is black-holed unless that switch has a path to the specifics.
What does BGP route aggregation do to loop prevention, and what does as-set cost?
An aggregate whose components have differing AS_PATHs is originated with a null path sequence - the my-ASN loop check is blind to it; as-set restores the component ASN set (loop safety back) but couples every component's churn and filtering fate into the aggregate.
Why can a summary leak the very churn it exists to hide, and what is the rule?
It inherits the lowest component metric, so the best component's failure re-advertises the summary with a new metric across the boundary; give summaries a constant metric - a controlled always-lowest anchor component (beware it also keeps the summary alive with nothing behind it) or a policy-set metric.
Sources
- White/Slice/Retana, Optimal Routing Design (full pass) - summary-metric stability and the anchor-component caveat.
- Cisco Press, CCIE Routing and Switching v5.0 OCG Vol 2, 5th Ed. - aggregate AS_PATH semantics and as-set.
- Cisco Live BRKCRS-2031 (Cisco Plus Canada 2012): Multilayer Campus Architectures and Design Principles - distribution-summary black hole and the inter-distribution link requirement
- Cisco Press, Optimal Routing Design (summarization / topology hiding).