Cisco IOS / IOS-XEConfig1,758 downloads

BGP Advanced Configuration — Cisco IOS / IOS-XE

Generate advanced BGP configurations for Cisco IOS/IOS-XE including route reflectors, confederations, route policies, multipath, BFD, and VPNv4.

↓ example.txt

What is it?

BGP (Border Gateway Protocol, RFC 4271) is the routing protocol of the Internet — the only Exterior Gateway Protocol (EGP) in production use today. Unlike IGPs (OSPF, EIGRP) which route based on metrics, BGP routes based on path attributes (AS-PATH, LOCAL_PREF, MED, COMMUNITIES), giving operators fine-grained policy control over traffic engineering. Cisco IOS/IOS-XE implements the full RFC 4271 feature set plus Cisco-proprietary extensions: Weight (highest priority, local to the router, not in RFC), peer groups for scalable configuration, route reflectors (RFC 4456) for iBGP scalability, confederations (RFC 5065) for very large ASes, and 'fall-over bfd' for sub-second convergence using Bidirectional Forwarding Detection. BGP uses TCP port 179 for reliable session establishment and has no maximum hop count — it is purpose-built for inter-domain routing at Internet scale.

When to use

·Connecting to one or more ISPs (always use BGP for multi-homed Internet connectivity)
·iBGP within a large enterprise or SP core for scalable route distribution
·MPLS VPN PE-CE routing between provider edge and customer edge routers
·When you need policy-based path selection (prefer one ISP over another, traffic engineering)
·Multi-homing with active-active or active-standby failover to different ISPs
·When your AS needs to exchange routing information with external autonomous systems
·SD-WAN route exchange between edge devices and controllers

When NOT to use

·Small campus or branch LANs with no ISP connection — use OSPF or EIGRP instead
·Single-homed sites with one ISP — use a static default route to the ISP
·When BGP complexity exceeds the operational benefit for the network size
·For routing between VLANs on a single switch — use an SVI with a routing protocol

How it compares

vs OSPFOSPF is an IGP for routing within your organization — it's fast, link-state, and metric-based. BGP is an EGP for routing between organizations — it's policy-based and scales to Internet size. Use OSPF internally and BGP externally.

vs EIGRPEIGRP is Cisco-proprietary (now open) and simpler to configure for internal routing. BGP is the standard for external connectivity and supports far more policy control. They serve different purposes — not direct competitors.

vs iBGP vs eBGPeBGP is used between routers in different autonomous systems (ISP peering). iBGP is used between routers in the same AS to carry external routes internally. iBGP requires full mesh or route reflectors; eBGP does not split-horizon.

Prerequisites

→IP reachability to BGP peer must exist — for eBGP this means a direct link; for iBGP an IGP must reach the loopback used as update-source
→AS numbers assigned — public ASNs from ARIN/RIPE/APNIC for Internet peering, private ASNs 64512-65535 (2-byte) or 4200000000-4294967294 (4-byte) for internal use
→Route policies (prefix-lists, community-lists, route-maps) should be defined BEFORE applying to neighbors to avoid transient policy gaps
→For iBGP with route reflectors: understand cluster design and client/non-client topology
→MTU consistency on BGP peering interfaces (especially important for eBGP over WAN links)

Config Generator

Router Hostname *

Local AS Number *

Local AS number. Use 4-byte ASN format: 65000 or 4200000001

BGP Router ID *

Must be unique. Use the loopback0 IP address.

Log Neighbor Changes

Log BGP neighbor state changes to syslog — strongly recommended

no bgp default ipv4-unicast (recommended)

Prevents auto-activation of neighbors in IPv4 AF — best practice for multi-AF deployments

AS-Path Multipath Relax

Allow eBGP multipath across different ASes — required for ECMP to multiple upstream ISPs

Compare Router-ID for identical paths

Always Compare MED

Compare MED across different ASes — disabled by default, enable with caution in multi-provider environments

Deterministic MED

Ensure consistent best-path selection regardless of order routes are received

MED Confederation: treat missing MED as worst

Route Reflector Cluster ID

Set only on Route Reflector. Must be unique per RR cluster. Usually set to the RR loopback IP.

Confederation Identifier

External AS number for confederation — the AS presented to the outside world

Confederation Peers

Space-separated list of confederation member ASes

Keepalive Timer (seconds)

Keepalive interval. Default 60s. Reduce to 10s for faster detection (with holdtime 30).

Hold Time (seconds)

Hold time. Default 180s. Must be 3x keepalive. Set to 0 to disable.

BGP Graceful Restart (NSF/SSO support)

Allows BGP sessions to survive a route processor failover (NSF/SSO)

Stale Path Timer (seconds)

How long to keep stale routes during graceful restart

Enable BGP Route Dampening

Suppress flapping routes. Use carefully — can delay convergence. Not recommended for iBGP.

Dampening Half-Life (minutes)

Dampening Reuse Threshold

Dampening Suppress Threshold

Dampening Max Suppress (minutes)

Max eBGP Paths (ECMP)

Maximum eBGP equal-cost paths for load balancing. Requires multipath-relax for different ASes.

Max iBGP Paths (ECMP)

Maximum iBGP equal-cost paths. Requires route reflector or full mesh.

AS-Path Access Lists

IP Community Lists

Prefix Lists

Route Maps

BGP Neighbors

Networks to Advertise

Aggregate Addresses

Redistribute OSPF

OSPF Process ID

OSPF Redistribution Route-Map

Redistribute Static

Static Redistribution Route-Map

Redistribute Connected

Connected Redistribution Route-Map

Enable VPNv4 Address Family (MPLS PE)

VPNv4 Neighbors

Verification commands

show ip bgp summary

Overview of all BGP neighbors, their state, and prefix counts

ExpectedState column shows numeric (prefixes received) for established neighbors; 'Idle', 'Active', 'Connect' indicate problems

show ip bgp neighbors X.X.X.X

Detailed session info for a specific neighbor: state, timers, capabilities, counters

ExpectedBGP state = Established, version = 4, capabilities should show route-refresh, 4-byte ASN

show ip bgp

Full BGP table with all prefixes, next-hops, and path attributes

ExpectedBest paths marked with >, valid paths with *, locally originated with i

show ip bgp X.X.X.X

Detailed path information for a specific prefix: all paths, attributes, and best-path decision

ExpectedShows LOCAL_PREF, WEIGHT, AS-PATH, MED, ORIGIN, NEXT_HOP for each path

show ip bgp regexp ^65001_

Filter BGP table by AS-PATH regex — show routes learned from AS 65001

ExpectedLists all prefixes with AS-PATH starting with 65001

show ip bgp community 65000:100

Filter BGP table by community value

ExpectedLists all prefixes tagged with community 65000:100

show ip bgp neighbors X.X.X.X advertised-routes

Show routes being sent to this neighbor after outbound policy

ExpectedList of prefixes this router is advertising to the neighbor

show ip bgp neighbors X.X.X.X received-routes

Show all routes received from this neighbor before inbound policy (requires soft-reconfig inbound)

ExpectedRequires 'neighbor X soft-reconfiguration inbound' configured

show ip bgp neighbors X.X.X.X routes

Show routes accepted from this neighbor after inbound policy

ExpectedPrefixes that passed inbound policy and are candidates for best-path selection

show ip bgp neighbors X.X.X.X policy

Show inbound and outbound policies applied to this neighbor

ExpectedLists route-maps, prefix-lists, filter-lists applied in/out

Debug commands

debug ip bgp X.X.X.X events

Live BGP session event debugging for a specific neighbor

WarningUse with caution in production. Always run 'undebug all' after. Can generate heavy syslog.

debug ip bgp X.X.X.X updates

Debug BGP UPDATE message processing for a specific neighbor

WarningVery verbose in production. Restrict to specific neighbor IP always.

clear ip bgp X.X.X.X soft

Soft reset BGP session — re-applies policies without tearing down the TCP session

WarningSafe to run in production. Hard reset ('clear ip bgp X.X.X.X') tears down the session.

clear ip bgp X.X.X.X soft in

Re-apply inbound policy without tearing down the session

WarningRequires soft-reconfiguration inbound OR route-refresh capability

Common mistakes & fixes

SymptomNeighbor stuck in Active state

CauseTCP connection to peer fails — routing to peer missing, ACL blocking TCP 179, wrong update-source, or wrong AS number configured

FixCheck routing to peer IP with 'ping', verify no ACL blocks TCP 179, confirm remote-as matches peer's actual AS, verify update-source interface is up

SymptomRoutes received but not in routing table

CauseNext-hop is not reachable — common with iBGP where next-hop is the eBGP peer's IP, not covered by IGP

FixAdd 'next-hop-self' on the iBGP neighbor, or redistribute the next-hop into the IGP, or add a static route to the next-hop

SymptomRoutes not being advertised to neighbor

CauseRoute-map or prefix-list blocking outbound, network statement missing, or the route is not in the BGP table

FixCheck 'show ip bgp neighbors X advertised-routes' vs 'show ip bgp' — if in table but not advertised, check outbound policy. If not in table, verify network statement and routing table.

SymptomMED not being compared between paths from different ASes

CauseBy default IOS only compares MED between paths from the same AS neighbor

FixAdd 'bgp always-compare-med' — use with caution as it changes best-path selection globally

SymptomeBGP multipath not working with multiple upstream ISPs

CauseBGP requires equal AS-PATH length AND same neighboring AS for multipath by default

FixAdd 'bgp bestpath as-path multipath-relax' to allow multipath across different ASes. Also verify 'maximum-paths' is set > 1.

SymptomCommunity attributes not passed to neighbor

Causesend-community is disabled by default for all BGP neighbors

FixAdd 'neighbor X.X.X.X send-community both' — required for both standard (traffic engineering) and extended (VPN RT/RD) communities

SymptomSession flapping with 'Notification: OPEN Error/Bad Peer AS'

Causeremote-as configured does not match the AS number in the peer's OPEN message

FixVerify the peer's actual AS with 'show ip bgp summary' on the remote router, or check with the ISP

Further learning

Recommended books to go deeper on this topic.

BGP Design and Implementation

Randy Zhang & Micah Bartell · Cisco Press · The practical BGP bible — iBGP, eBGP, policies, communities, design patterns

Kindle ↗Hardcover ↗Paperback ↗

Internet Routing Architectures

Sam Halabi · Cisco Press · BGP for ISPs and large enterprise — AS path, route reflectors, confederation

Hardcover ↗