BGP: Enterprise Configuration

April 15, 2026·3 min read·576 words

BGP (Border Gateway Protocol) is the Internet's inter-AS routing protocol and the backbone of the modern enterprise (MPLS, SD-WAN, multi-cloud). This guide covers enterprise BGP configuration: eBGP/iBGP, path attributes, communities, BFD, and 2026 best practices.

Essential terminology

AS (Autonomous System): routing domain identified by an ASN (1-4.2 billion)
Private ASNs: 64512-65534 (16-bit), 4200000000-4294967294 (32-bit)
eBGP: peering between different ASes (TTL 1 by default, 255 for multihop)
iBGP: peering within the same AS (full mesh required unless using a route reflector)
NLRI: Network Layer Reachability Information
Prefix: advertised network (e.g., 10.0.0.0/24)

BGP path attributes (order of preference)

Weight (Cisco, local): higher is preferred
Local Preference (within the AS): higher is preferred
AS_PATH: shorter is preferred
Origin: IGP > EGP > Incomplete
MED (Multi-Exit Discriminator): lower is preferred (inter-AS)
eBGP > iBGP
IGP cost to the next hop: lower is preferred
Router ID: lower is preferred (tiebreaker)

Basic Cisco IOS configuration

router bgp 65001
bgp router-id 10.0.0.1
bgp log-neighbor-changes
no bgp default ipv4-unicast: disable by default
neighbor 203.0.113.2 remote-as 65002
neighbor 203.0.113.2 description Peer-FAI-OVH
neighbor 203.0.113.2 password CiscoBGPPass
address-family ipv4 ; neighbor 203.0.113.2 activate ; neighbor 203.0.113.2 soft-reconfiguration inbound ; network 10.0.0.0 mask 255.255.0.0
neighbor 203.0.113.2 route-map RM-IN in ; neighbor 203.0.113.2 route-map RM-OUT out

Juniper configuration

set routing-options autonomous-system 65001
set protocols bgp group EXT type external
set protocols bgp group EXT peer-as 65002
set protocols bgp group EXT neighbor 203.0.113.2
set protocols bgp group EXT export ADVERTISE-LOCAL
set policy-options policy-statement ADVERTISE-LOCAL term 1 from route-filter 10.0.0.0/16 exact
set policy-options policy-statement ADVERTISE-LOCAL term 1 then accept

Route maps and prefix lists (Cisco)

ip prefix-list PL-OUR-PREFIXES seq 10 permit 10.0.0.0/16
route-map RM-OUT permit 10 ; match ip address prefix-list PL-OUR-PREFIXES ; set as-path prepend 65001 65001 (e.g., prepending to influence traffic)
route-map RM-IN deny 10 ; match as-path 1 (match a transit ASN to reject)

Communities

ip community-list 1 permit 65001:100: high local-preference tag
route-map RM-IN permit 20 ; match community 1 ; set local-preference 200
Well-known BGP communities: no-export, no-advertise, local-as
Large Communities (RFC 8092): for 4-byte ASNs

BFD for fast convergence

bfd-template single-hop BGP-BFD ; interval min-tx 300 min-rx 300 multiplier 3
neighbor 203.0.113.2 bfd
Convergence: <1s vs 90s (default BGP keepalive)

iBGP full mesh vs route reflectors

iBGP rule: re-advertising iBGP-learned routes to iBGP peers is prohibited → a full mesh is required. Scale: N(N-1)/2 sessions. 50 routers = 1225 sessions!

Route Reflectors (RR)

RR clients have 1 session to the RR
The RR re-advertises iBGP routes to its clients
Placement: at least 2 RRs for redundancy (RR clustering)
Recommended for >20 iBGP routers

Enterprise best practices

Always use MD5 or TCP-AO authentication
Maximum-prefix limits: neighbor X maximum-prefix 10000 80 (alert at 80%)
Systematically filter inbound and outbound traffic (no 'permit any')
Use soft reconfiguration or route refresh (RFC 2918)
BFD for <1s convergence
Document communities (65001:100 = high LP, 65001:200 = backup, etc.)

BGP multi-homing

Active/Standby

Inbound: AS_PATH prepending on the backup link. Outbound: low local preference on the backup link.

Active/Active

Load balancing through BGP ECMP (maximum-paths 2). Risk of asymmetric traffic—pay close attention to firewalls.

Troubleshooting

show ip bgp summary: session status
show ip bgp 10.0.0.0: route details
show ip bgp neighbors X received-routes: routes received before filtering
show ip bgp neighbors X routes: routes after inbound filtering
debug ip bgp updates (use caution in production!)

Order from OPTINOC

Enterprise BGP routers (Cisco ISR/ASR, Juniper MX, FortiGate, Palo Alto). Turnkey eBGP multi-homing and iBGP RR configuration. BGP training for OPTINOC customer teams.