Multi-Layer Routing Domain Protection at Hyperscale: From Route Leak to Automated Enforcement#

Daria Shantalova, Express Backbone Team, Meta

• Why: A concrete, high-quality postmortem plus the system built in response — exactly the failure-driven content that transfers, because the preconditions (multiple routing domains, BGP between them, community-based policy) describe most large networks.
• What: An internal domain advertised a large volume of prefixes toward Meta's Express Backbone (the DC-to-DC backbone), each carrying a community the ingress route-map legitimately matched. The routes propagated through the iBGP mesh to every site, DC aggregation routers exhausted memory and restarted, and service disruption followed. The core insight: community-based filtering answers "is this tag allowed at this boundary?" but not "is this prefix allowed to carry this tag?" — that gap is where leaks live.
• How: Three independent layers at every domain boundary: (1) ID Communities — a registered tagging scheme where each prefix carries exactly one identity community defining origination and propagation scope, with missing/wrong/multiple tags as violations; (2) a Route Registry — an internal IRR-equivalent permit list per boundary, auto-generated into inbound prefix filters with a freshness SLA; (3) control-plane health monitoring that continuously validates the RIB against intent. Deployment exposed pervasive violations that were remediated within months, and automated enforcement now prevents recurrence.
• Where applicable: Built at Meta scale (dozens of data centers), but the three-layer pattern is deliberately presented as applicable without their stack — any operator running multi-domain BGP with community-scoped policy can copy the architecture.