BGP Conditional Advertisement — Advertise Map and Non-Exist Map

BGP conditional advertisement advertises a prefix to a neighbour only when a condition about another prefix is met. It is the tool for active/backup multi-homing where you want a provider used only when the primary path has actually failed.

The problem it solves: normally, if you advertise your prefix to both ISPs, both will attract traffic and you have no control over the split. If you advertise to only one, you have no failover. Conditional advertisement gives you both, advertise to the backup provider only when the primary is down.

The Two Forms

non-exist-map is by far the more common of the two.

How It Works

Three pieces have to line up:

1. An advertise-map naming the prefix you conditionally advertise.
2. A non-exist-map naming the prefix whose absence triggers it, the tracked prefix.
3. The router checks the BGP table for the tracked prefix every 60 seconds.

Two details that surprise people:

• The check runs against the BGP table, not the routing table. A prefix suppressed by a route map, or present but not best, still counts as existing.
• The check runs on a 60-second scan timer. Failover is not immediate, expect up to a minute plus BGP convergence time.

Configuration, Backup ISP Scenario

AS 65001 is multi-homed to ISP-A (primary) and ISP-B (backup). It owns 203.0.113.0/24 and wants that advertised to ISP-B only when the ISP-A path is gone. It tracks a prefix ISP-A originates, 198.51.100.0/24, as the health indicator.

! Prefix we conditionally advertise
ip prefix-list OUR-PREFIX seq 5 permit 203.0.113.0/24

! Prefix whose disappearance means ISP-A is down
ip prefix-list ISP-A-PREFIX seq 5 permit 198.51.100.0/24

route-map ADVERTISE-OURS permit 10
 match ip address prefix-list OUR-PREFIX

route-map TRACK-ISP-A permit 10
 match ip address prefix-list ISP-A-PREFIX

router bgp 65001
 address-family ipv4 unicast
  neighbor 198.51.100.1 remote-as 64500        ! ISP-A
  neighbor 203.0.113.254 remote-as 64501       ! ISP-B
  neighbor 203.0.113.254 advertise-map ADVERTISE-OURS non-exist-map TRACK-ISP-A

While 198.51.100.0/24 is in the BGP table, 203.0.113.0/24 is withheld from ISP-B. When it disappears, the advertisement to ISP-B starts within one scan interval.

Verification

Router# show ip bgp neighbors 203.0.113.254 | include Condition
Router# show ip bgp neighbors 203.0.113.254 advertised-routes
Router# show ip bgp 198.51.100.0
Router# debug ip bgp updates

The first command reports the condition status directly:

Condition-map TRACK-ISP-A, Advertise-map ADVERTISE-OURS, status: Withdraw

Withdraw means the tracked prefix exists and the advertisement is suppressed. Advertise means it is gone and the prefix is being sent.

Picking the Tracked Prefix

This is the decision that determines whether the whole thing works, and it is easy to get wrong.

• Do not track a prefix that is reachable via both providers. If ISP-B also carries a path to it, it never disappears from your BGP table and the condition never fires.
• Track something specific to the primary path, ideally a prefix originated by ISP-A itself, or one you agree with them for the purpose.
• Do not track the default route if you receive one from both providers, for the same reason.
• Consider what a partial failure looks like. If the BGP session to ISP-A stays up but the path beyond them is broken, the tracked prefix stays present and no failover happens.

The Alternatives

Conditional advertisement is not always the right tool. Compare it against the simpler options:

Prepending is usually tried first and is often enough. Adding your own ASN several times makes the backup path look longer, and most networks will prefer the shorter one. It is advisory rather than binding, a remote network with a local preference policy will ignore your prepends entirely, but it costs one line of configuration.

Conditional advertisement is what you use when advisory is not good enough: when the backup provider’s link is expensive, metered, or genuinely must carry nothing until it is needed.

Caveats Worth Knowing Before Deploying

• The 60-second scan. Failover takes up to a minute plus convergence. Do not use conditional advertisement where sub-second failover is required.
• It reads the BGP table, not the RIB. A prefix present but not selected as best still satisfies the condition.
• Only one advertise-map per neighbour per address family on most IOS versions.
• The advertise-map prefix must be in the BGP table to begin with. If it is not originated or learned, there is nothing to advertise when the condition fires.
• Test the failure, do not assume it. Shut the primary session in a maintenance window and confirm the advertisement appears. A conditional advertisement that has never been exercised is a hypothesis.
• Watch for flapping. If the tracked prefix is itself unstable, your advertisement will appear and disappear repeatedly, which is exactly the behaviour route dampening punishes.

Frequently Asked Questions

What is the difference between exist-map and non-exist-map?

non-exist-map advertises when the tracked prefix is absent, the backup-link case. exist-map advertises when it is present, used when your advertisement depends on something else being reachable.

How quickly does conditional advertisement react?

Up to 60 seconds, because the condition is evaluated on the BGP scan timer, plus normal convergence time. It is not a fast-failover mechanism.

Why is my prefix not being advertised when the condition is met?

Check that the prefix in the advertise-map is actually in the BGP table, that the tracked prefix has genuinely disappeared (show ip bgp <prefix>), and that the route maps match what you think, a prefix-list with the wrong length modifier is a common cause.

Should I use conditional advertisement or AS-path prepending?

Try prepending first, it is one line and usually sufficient. Use conditional advertisement when you need the backup path to carry genuinely no traffic until the primary fails, and can accept the slower failover.

Does it work with iBGP?

Yes, the mechanism is the same, though the use case is far less common. It is normally applied to eBGP neighbours where you are controlling what an external provider sees.

Can I track more than one prefix?

The non-exist-map can match multiple prefixes, but the condition is satisfied when any matched prefix exists. To require all of them to disappear, you need separate logic, which is usually a sign the design should be simplified. See the BGP configuration guide for the wider policy toolkit.