BGP Neighbour Relationships

What it is

BGP is the path vector protocol that carries routes between autonomous systems, and every route depends on a working neighbour session.

BGP peers are configured by hand. They talk over TCP port 179 and do not discover each other. An eBGP session joins routers in different AS numbers, and an iBGP session joins routers in the same AS.

This page covers the session. The next page covers how BGP picks and shapes paths.

How it works

A session must reach Established before any route is exchanged.

Neighbour states

A peer that stays in Active or Idle never came up. The usual causes are no route to the peer address, a wrong remote AS, a wrong neighbour address, an ACL blocking TCP 179, or an authentication mismatch.

R1# show ip bgp summary
R1# show ip bgp neighbors 192.0.2.2
R1# show bgp ipv6 unicast summary

In show ip bgp summary, a number in the last column means Established and shows the count of prefixes received. A state name means the session is not up.

Timers

The default keepalive is 60 seconds and the hold time is 180 seconds on Cisco devices. Two peers negotiate the lower of the two hold times.

R1(config-router)# neighbor 192.0.2.2 timers 30 90

eBGP, iBGP and next hop

Several rules explain why a session or its routes fail.

• eBGP packets have a TTL of 1, so peers must be directly connected unless you use ebgp-multihop.
• A loopback session also needs update-source Loopback0 on both ends.
• eBGP changes the next hop to itself when advertising routes. iBGP does not, so routes learned from eBGP carry the external next hop into the AS.
• A router will not use a route whose next hop it cannot reach. Fix this with next-hop-self or by advertising the external link in the IGP.
• iBGP does not pass routes learned from an iBGP peer to another iBGP peer. Use a full mesh or a route reflector.

R2(config)# router bgp 65002
R2(config-router)# neighbor 10.0.0.1 remote-as 65001
R2(config-router)# neighbor 10.0.0.1 ebgp-multihop 2
R2(config-router)# neighbor 10.0.0.1 update-source Loopback0
R2(config-router)# neighbor 10.2.2.3 remote-as 65002
R2(config-router)# neighbor 10.2.2.3 next-hop-self

Synchronization is an old rule that stopped iBGP routes being used until the IGP also knew them. It is off by default and rarely used.

Authentication

BGP supports MD5 authentication on the TCP session with a password. Both ends must use the same password.

R1(config-router)# neighbor 192.0.2.2 password MYSECRET

A password mismatch normally leaves the session stuck in Active or Idle. The device logs messages about TCP packets with a bad MD5 digest.

AS numbers and route refresh

BGP supports 4 byte AS numbers. Older routers that do not know 4 byte numbers see the placeholder AS 23456. Notation can be shown as plain numbers or in dot form.

Private AS numbers are for use inside organisations. The 16 bit range is 64512 to 65534. A provider can strip them with remove-private-as.

Route refresh lets a router ask a peer to resend its routes after a policy change, with no session reset.

R1# clear ip bgp 192.0.2.2 soft in

Peer groups and address families

A peer group applies the same settings to many neighbours, which shortens configuration and keeps policy consistent.

R1(config-router)# neighbor INTERNAL peer-group
R1(config-router)# neighbor INTERNAL remote-as 65002
R1(config-router)# neighbor INTERNAL update-source Loopback0
R1(config-router)# neighbor 10.2.2.3 peer-group INTERNAL

Address families keep IPv4 and IPv6 apart. A neighbour must be activated inside the address family before it exchanges prefixes of that type.

R1(config-router)# neighbor 2001:DB8::2 remote-as 65002
R1(config-router)# address-family ipv6 unicast
R1(config-router-af)# neighbor 2001:DB8::2 activate
R1(config-router-af)# exit-address-family
R1(config-router)# address-family ipv4 vrf RED
R1(config-router-af)# neighbor 10.1.1.2 remote-as 65100
R1(config-router-af)# neighbor 10.1.1.2 activate

For VRF-lite, the neighbour is defined inside the address-family ipv4 vrf section and sessions run inside that VRF.