Skip to main content

BGP Fundamentals

An AS is a collection of routers under a single organization's control, it uses one or more IGPs and common metrics to route packets within the AS. BGP can be used as an IGP.

Autonomous System Numbers (ASNs)

An organization requiring connectivity to the Internet must obtain an ASN. Two blocks of private ASNs are available for any organization to use, as long as these ASNs are never exchanged publicly on the Internet.

  • 64512 to 65534
  • 4200000000 to 4294967294

It is imperative to use only the ASN assigned by the IANA, the ASN assigned by your service provider, or a private ASN

BGP Sessions

A BGP session is an established adjacency between two BGP routers. Multi-hop sessions require a route to establish the TCP session with the remote endpoint.

  • Internal BGP (iBGP): Sessions established with an iBGP router that are in the same AS or that participate in the same BGP confederation.
  • External BGP (eBGP): Sessions established with a BGP router that are in a different AS.

Path Attributes

BGP uses path attributes (PAs) associated with each network path. The PAs provide BGP with granularity and control of routing policies in BGP. The BGP prefix PAs are classified as any of the following:

  • Well-known mandatory (must be included with every prefix advertisement).
  • Well-known discretionary (may or may not be included with the prefix advertisement).
  • Optional transitive (stay with the route advertisement from AS to AS).
  • Optional non-transitive (cannot be shared from AS to AS).

Well-known attributes must be recognized by all BGP implementations. Optional attributes do not have to be recognized by all BGP implementations.

Loop Prevention

BGP is a path vector routing protocol and does not contain a complete topology of the network, as do link-state routing protocols. BGP behaves like distance vector protocols, ensuring that a path is loop free.

The BGP attribute AS_Path is a well-known mandatory attribute and includes a complete list of all the ASNs that the prefix advertisement has traversed from its source AS. AS_Path is used as a loop-prevention mechanism in BGP. If a BGP router receives a prefix advertisement with its AS listed in AS_Path, it discards the prefix because the router thinks the advertisement forms a loop.

Address Families

Multiprotocol BGP (MP-BGP) extends BGP beyond IPv4 unicast to support multiple network protocols and routing types.

  • AFI (Address Family Identifier): Identifies the network protocol (IPv4, IPv6).

  • SAFI (Subsequent Address Family Identifier): Identifies the routing type (unicast, multicast).

  • NLRI (Network Layer Reachability Information): Contains advertised prefixes and prefix lengths.

  • MP_REACH_NLRI / MP_UNREACH_NLRI: BGP attributes used to advertise and withdraw routes for different address families.

Key points:

  • Each AFI/SAFI combination maintains its own routing database, configuration, and policies.

  • Multiple address families can share a single BGP session.

  • BGP uses AFI/SAFI identifiers to distinguish routes belonging to different address families.

Exam takeaway: MP-BGP supports multiple independent address families over a single BGP session, using AFI/SAFI to identify them and MP_REACH_NLRI / MP_UNREACH_NLRI to exchange routing information.

Inter-Router Communication

BGP establishes TCP sessions (port 179) between manually configured neighbors (peers). Unlike IGPs, BGP does not use Hello packets or dynamically discover neighbors.

  • TCP: Provides reliable delivery, sequencing, acknowledgments, and retransmissions.

  • Fragmentation: BGP typically sets the Don't Fragment (DF) bit and relies on Path MTU Discovery.

  • Multi-hop: Unlike typical IGP adjacencies, BGP peers can be multiple router hops apart, provided IP reachability exists in both directions.

  • Routing: Multi-hop peers need routes to each other's IP addresses (static or IGP). Intermediate routers do not need to run BGP.

Single-Hop vs. Multi-Hop BGP

image.png

  • R1–R2: Directly connected BGP peers.

  • R2–R4: Multi-hop BGP peers; R3 only forwards traffic and does not need a BGP session.

For multi-hop eBGP, configure ebgp-multihop and ensure bidirectional routing.

Example (R2–R4):

R2(config)# ip route 10.34.1.0 255.255.255.0 10.23.1.3
R2(config)# router bgp 65002
R2(config-router)# neighbor 10.34.1.4 remote-as 65004
R2(config-router)# neighbor 10.34.1.4 ebgp-multihop 2

R4(config)# ip route 10.23.1.0 255.255.255.0 10.34.1.3
R4(config)# router bgp 65004
R4(config-router)# neighbor 10.23.1.2 remote-as 65002
R4(config-router)# neighbor 10.23.1.2 ebgp-multihop 2

Note: These configurations assume the IP addresses and links shown in the OCG topology. Standard directly connected eBGP does not require ebgp-multihop; multihop iBGP does not require that command.

BGP Message Types

BGP uses four message types:

Type Message Purpose
1 OPEN Establishes peering and negotiates session parameters
2 UPDATE Advertises or withdraws routes
3 NOTIFICATION Reports errors and terminates the session
4 KEEPALIVE Maintains neighbor availability

OPEN

Exchanged when establishing a BGP session. The session also requires the correct neighbor source IP, appropriate authentication (if configured), and valid TTL/reachability. Includes:

  • BGP version: Must match (BGP-4).

  • ASN: Must match the neighbor's configured remote-as.

  • Hold Time: Negotiated using the lower value advertised by both peers.

  • Router ID (RID): Unique 32-bit identifier, manually or automatically assigned; also used for loop prevention.

  • Optional parameters: Negotiate BGP capabilities.

UPDATE

Advertises new routes, modifies existing routes, or withdraws routes. An UPDATE also resets the Hold Timer.

  • NLRI: Contains advertised prefixes.

  • Path Attributes (PAs): Describe routes and influence BGP path selection.

  • Withdrawn Routes: Identifies prefixes that are no longer reachable.

KEEPALIVE

Confirms that a neighbor remains operational without relying solely on TCP connection status. Receiving a KEEPALIVE or UPDATE resets the Hold Timer.

  • Default Hold Time (Cisco): 180 seconds.

  • Default Keepalive Interval: 60 seconds (one-third of Hold Time).

  • Minimum nonzero Hold Time: 3 seconds.

  • Hold Time = 0: Disables KEEPALIVEs and hold-time expiration.

NOTIFICATION

Sent when BGP detects a session error (such as timer expiration, invalid parameters, or a requested reset). It closes the BGP connection. If the Hold Timer expires, the session drops, routes learned from that neighbor are removed, and affected routes may be withdrawn from other peers.

BGP Neighbor States (Finite-State Machine)

BGP uses a six-state FSM to establish and maintain peer relationships.

image.png

State Description
1. Idle Initial state. Attempts to initiate TCP connectivity and listens for incoming connections. Repeated failures trigger ConnectRetry timer backoff (starting at 60 seconds and doubling after further failures, as described in the OCG).
2. Connect Attempts the TCP three-way handshake on port 179. Success → OpenSent; failure → Active. ConnectRetry expiration triggers another connection attempt.
3. Active Retries TCP connectivity. Success → OpenSent (sends OPEN and initially sets a 4-minute Hold Timer); failure → Connect, resetting ConnectRetry.
4. OpenSent OPEN has been sent. Waits for the peer's OPEN and validates five session requirements (detailed below).
5. OpenConfirm OPEN accepted and KEEPALIVE sent (unless Hold Time = 0). Waits for peer's KEEPALIVE → Established. Timeout, NOTIFICATION, or stop → Idle.
6. Established Session operational. Neighbors exchange UPDATE messages. Receiving UPDATE or KEEPALIVE resets the Hold Timer; expiration or errors → Idle.

OpenSent — Session Validation

Both BGP neighbors exchange OPEN messages and verify these five requirements:

  1. BGP Version: Both peers must use a compatible BGP version (BGP-4).

  2. Neighbor IP Address: The peer's TCP source IP must match the configured neighbor IP.

  3. Autonomous System (ASN): The ASN received in the OPEN must match the configured remote-as.

  4. BGP Router ID (RID): Must be valid, nonzero, and unique between the peers.

  5. Security Parameters: Authentication (password) and TTL-related security requirements must be correctly configured.

After validation:

  • Success: Negotiate the Hold Time (lowest advertised value), send KEEPALIVE if Hold Time is nonzero, and transition to OpenConfirm.

  • Invalid OPEN: Send NOTIFICATION and return to Idle.

  • TCP disconnection: Close the session, reset ConnectRetry, and transition to Active.

  • Other unexpected events may return the FSM to Idle.

Important: The TCP source IP, authentication, and TTL checks are connection/security requirements, not literal fields within the BGP OPEN message. The OPEN itself includes the BGP version, ASN, Hold Time, BGP Identifier, and optional capabilities.

Established — Session Maintenance

  • UPDATE: Advertises, modifies, or withdraws routes.

  • KEEPALIVE: Confirms neighbor availability.

  • Hold Timer: Resets whenever an UPDATE or KEEPALIVE is received.

  • Hold Timer expiration: BGP terminates the session, removes routes learned from that peer, and sends appropriate withdrawals to other peers.

Default Cisco timers: Keepalive = 60 seconds; Hold Time = 180 seconds. The minimum nonzero negotiated Hold Time is 3 seconds. A Hold Time of 0 disables KEEPALIVE transmission and hold-time expiration.

ENARSI Exam Notes:

  • Successful sequence: Idle → Connect → OpenSent → OpenConfirm → Established.

  • Active ≠ Established: It means BGP is attempting TCP connectivity.

  • Connect ↔ Active: These states handle failed TCP connection attempts.

  • OpenSent: Five neighbor/session requirements must be validated before progressing.

  • Established: Only state where normal BGP routing information is exchanged.

image.png