BGP: Enterprise Configuration
·3 min read·576 words
BGP (Border Gateway Protocol) is the Internet's inter-AS routing protocol and the backbone of the modern enterprise (MPLS, SD-WAN, multi-cloud). This guide covers enterprise BGP configuration: eBGP/iBGP, path attributes, communities, BFD, and 2026 best practices.
Essential terminology
- AS (Autonomous System): routing domain identified by an ASN (1-4.2 billion)
- Private ASNs: 64512-65534 (16-bit), 4200000000-4294967294 (32-bit)
- eBGP: peering between different ASes (TTL 1 by default, 255 for multihop)
- iBGP: peering within the same AS (full mesh required unless using a route reflector)
- NLRI: Network Layer Reachability Information
- Prefix: advertised network (e.g., 10.0.0.0/24)
BGP path attributes (order of preference)
- Weight (Cisco, local): higher is preferred
- Local Preference (within the AS): higher is preferred
- AS_PATH: shorter is preferred
- Origin: IGP > EGP > Incomplete
- MED (Multi-Exit Discriminator): lower is preferred (inter-AS)
- eBGP > iBGP
- IGP cost to the next hop: lower is preferred
- Router ID: lower is preferred (tiebreaker)
Basic Cisco IOS configuration
- router bgp 65001
- bgp router-id 10.0.0.1
- bgp log-neighbor-changes
- no bgp default ipv4-unicast: disable by default
- neighbor 203.0.113.2 remote-as 65002
- neighbor 203.0.113.2 description Peer-FAI-OVH
- neighbor 203.0.113.2 password CiscoBGPPass
- address-family ipv4 ; neighbor 203.0.113.2 activate ; neighbor 203.0.113.2 soft-reconfiguration inbound ; network 10.0.0.0 mask 255.255.0.0
- neighbor 203.0.113.2 route-map RM-IN in ; neighbor 203.0.113.2 route-map RM-OUT out
Juniper configuration
- set routing-options autonomous-system 65001
- set protocols bgp group EXT type external
- set protocols bgp group EXT peer-as 65002
- set protocols bgp group EXT neighbor 203.0.113.2
- set protocols bgp group EXT export ADVERTISE-LOCAL
- set policy-options policy-statement ADVERTISE-LOCAL term 1 from route-filter 10.0.0.0/16 exact
- set policy-options policy-statement ADVERTISE-LOCAL term 1 then accept
Route maps and prefix lists (Cisco)
- ip prefix-list PL-OUR-PREFIXES seq 10 permit 10.0.0.0/16
- route-map RM-OUT permit 10 ; match ip address prefix-list PL-OUR-PREFIXES ; set as-path prepend 65001 65001 (e.g., prepending to influence traffic)
- route-map RM-IN deny 10 ; match as-path 1 (match a transit ASN to reject)
Communities
- ip community-list 1 permit 65001:100: high local-preference tag
- route-map RM-IN permit 20 ; match community 1 ; set local-preference 200
- Well-known BGP communities: no-export, no-advertise, local-as
- Large Communities (RFC 8092): for 4-byte ASNs
BFD for fast convergence
- bfd-template single-hop BGP-BFD ; interval min-tx 300 min-rx 300 multiplier 3
- neighbor 203.0.113.2 bfd
- Convergence: <1s vs 90s (default BGP keepalive)
iBGP full mesh vs route reflectors
iBGP rule: re-advertising iBGP-learned routes to iBGP peers is prohibited → a full mesh is required. Scale: N(N-1)/2 sessions. 50 routers = 1225 sessions!
Route Reflectors (RR)
- RR clients have 1 session to the RR
- The RR re-advertises iBGP routes to its clients
- Placement: at least 2 RRs for redundancy (RR clustering)
- Recommended for >20 iBGP routers
Enterprise best practices
- Always use MD5 or TCP-AO authentication
- Maximum-prefix limits: neighbor X maximum-prefix 10000 80 (alert at 80%)
- Systematically filter inbound and outbound traffic (no 'permit any')
- Use soft reconfiguration or route refresh (RFC 2918)
- BFD for <1s convergence
- Document communities (65001:100 = high LP, 65001:200 = backup, etc.)
BGP multi-homing
Active/Standby
Inbound: AS_PATH prepending on the backup link. Outbound: low local preference on the backup link.
Active/Active
Load balancing through BGP ECMP (maximum-paths 2). Risk of asymmetric traffic—pay close attention to firewalls.
Troubleshooting
- show ip bgp summary: session status
- show ip bgp 10.0.0.0: route details
- show ip bgp neighbors X received-routes: routes received before filtering
- show ip bgp neighbors X routes: routes after inbound filtering
- debug ip bgp updates (use caution in production!)
Order from OPTINOC
Enterprise BGP routers (Cisco ISR/ASR, Juniper MX, FortiGate, Palo Alto). Turnkey eBGP multi-homing and iBGP RR configuration. BGP training for OPTINOC customer teams.