Protocol Atlas

L3 · egp · reviewed

BGP

Border Gateway Protocol 4

A TCP session that exchanges path attributes, then picks one path with a total-order waterfall — not a shortest-path flood.

Presenter modeEmbed this figure

BGP Finite State Machine (FSM)RFC 4271 · DRAFT STANDARD · January 2006UPDATE Message FormatRFC 4271 · DRAFT STANDARD · January 2006Breaking Ties (Phase 2)RFC 4271 · DRAFT STANDARD · January 2006LOCAL_PREFRFC 4271 · DRAFT STANDARD · January 2006Avoiding Routing Information LoopsRFC 4456 · DRAFT STANDARD · April 2006Multiprotocol Reachable NLRI - MP_REACH_NLRI (Type Code 14):RFC 4760 · DRAFT STANDARD · January 2007Prefix-to-AS Mapping DatabaseRFC 6811 · PROPOSED STANDARD · January 2013BGP Only to Customer (OTC) AttributeRFC 9234 · PROPOSED STANDARD · May 2022

Why it exists

Interior protocols flood topology and compute the same tree. The Internet cannot flood 900 000 prefixes as link-state. BGP exchanges paths with attributes, then each speaker independently picks one with a documented total order. Decision ProcessRFC 4271 · DRAFT STANDARD · January 2006

Idle to Established

Two speakers open a TCP session on port 179, exchange OPEN with capabilities, then KEEPALIVE, and only then send UPDATE.

R1 · AS 65001FSM: IdleR2 · AS 65002FSM: IdleeBGP
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
R1 · AS 65001routerFSM: Idle
R2 · AS 65002routerFSM: Idle
R1 · AS 65001 — R2 · AS 65002linkup · eBGP
1 / 5

Both speakers are Idle. Nothing is sent until an operator (or a restart) moves the session to Connect or Active.

What changed

  • R1 · AS 65001: FSM → Idle
  • R2 · AS 65002: FSM → Idle

How it works

A session is a TCP FSM (Idle → Connect/Active → OpenSent → OpenConfirm → Established). Only Established carries UPDATE. iBGP does not re-advertise iBGP-learned paths, which is why a full mesh, a route reflector, or a confederation exists. BGP Finite State Machine (FSM)RFC 4271 · DRAFT STANDARD · January 2006

Best-path after NEXT_HOP resolvability: Weight (Cisco), LOCAL_PREF, local origination, AS_PATH length (AS_SET counts as one; confed segments do not count), ORIGIN, MED (same neighboring AS unless always-compare), eBGP over iBGP, IGP metric to NEXT_HOP, BGP Identifier / ORIGINATOR_ID, CLUSTER_LIST, peer address. Breaking Ties (Phase 2)RFC 4271 · DRAFT STANDARD · January 2006

IPv6 unicast, VPNv4 and EVPN do not use the IPv4 NLRI field. They use MP_REACH_NLRI, type 14, with an AFI and SAFI. Multiprotocol Reachable NLRI - MP_REACH_NLRI (Type Code 14):RFC 4760 · DRAFT STANDARD · January 2007

Try it

Run the waterfall

Pick one of the 25 hand-built cases and watch which comparison eliminates the loser. Weight and ROV are labelled as local policy.

Hand-built case
Local policy (not RFC 4271)

Winner: A · expected A on local-pref

  1. local-prefA has LOCAL_PREF 200; B has 100.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

ORIGIN IGP, AS_PATH 65001, NEXT_HOP 192.0.2.1, one IPv4 NLRI. Constructed from RFC 4271 §4.3, not captured.

TCP
BGP messages ride a TCP session on port 179. RFC 4271
BGP header
16-octet marker, 2-octet length, 1-octet type. RFC 4271
UPDATE body
Withdrawn-routes length, path attributes, then NLRI. RFC 4271

Configure it

eBGP to AS 65002 with an explicit router-id and next-hop-self on iBGP.

Cisco IOS-XE 17.12 · Catalyst 9500, ISR 4451, Catalyst 8300draft

  1. router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 192.0.2.2 remote-as 65002

    The AS in `router bgp` is this speaker. remote-as 65002 makes the session eBGP. Router-id is the BGP Identifier in OPEN.

    RFC 4271 §4.2

  2.  address-family ipv4 unicast
  neighbor 192.0.2.2 activate
  network 192.0.2.0 mask 255.255.255.0

    IPv4 unicast must be activated. `network` originates a local prefix; it is not an IGP redistribution.

    RFC 4271 §9.4

Verify

show ip bgp summary
Neighbor 192.0.2.2 state Established, AFI IPv4 unicast.

Caveats

  • Draft syntax. IOS-XE default address-family activation varies by version.

When it breaks

Symptom first, because that is what you have when it happens.

  1. Neighbor stuck in Idle or Active.

    Narrow it down

    1. Confirm TCP to port 179 from both addresses.
    2. Diff the configured AS numbers and the source addresses.

    Cause

    TCP never establishes, or OPEN is refused (AS mismatch, hold time, capability).

    Fix

    Fix reachability and the OPEN fields. BGP will not skip TCP.

    Finite State MachineRFC 4271 · DRAFT STANDARD · January 2006

  2. Prefix is in Adj-RIB-In and missing from LOC-RIB.

    Narrow it down

    1. Check NEXT_HOP reachability in the IGP.
    2. Confirm the IGP interface is not a connected /32 that does not recurse.

    Cause

    RFC 4271 §9.1.2.1 dropped an unresolvable NEXT_HOP before the waterfall.

    Fix

    Advertise the next hop, or set next-hop-self on iBGP.

    Route Resolvability ConditionRFC 4271 · DRAFT STANDARD · January 2006

  3. A prefix is learned from a customer with a foreign AS_PATH.

    Narrow it down

    1. Inspect AS_PATH and communities on the customer session.
    2. Check whether OTC or roles are configured.

    Cause

    Export policy leaked a provider or peer path to another provider.

    Fix

    Apply RFC 9234 roles/OTC, and prefix-filter customer sessions to their AS.

    BGP Only to Customer (OTC) AttributeRFC 9234 · PROPOSED STANDARD · May 2022

  4. iBGP path oscillates between reflectors.

    Narrow it down

    1. Show ORIGINATOR_ID and CLUSTER_LIST on the oscillating prefix.
    2. Confirm cluster-ids are unique per reflector.

    Cause

    Reflectors share a cluster-id or ignore ORIGINATOR_ID.

    Fix

    Unique cluster-id per RR; never reflect a path whose ORIGINATOR_ID is self.

    Avoiding Routing Information LoopsRFC 4456 · DRAFT STANDARD · April 2006

  5. A signed prefix is still preferred from an invalid origin AS.

    Narrow it down

    1. Show origin-validation state Valid / NotFound / Invalid.
    2. Check whether invalid paths are eligible for best-path.

    Cause

    ROV is collected but not applied as policy before 9.1.2.2.

    Fix

    Prefer Valid, drop or deprefer Invalid. RFC 6811 is not automatic in 4271.

    Prefix-to-AS Mapping DatabaseRFC 6811 · PROPOSED STANDARD · January 2013

Design notes

Missing MED may be treated as 0 or as infinity. RFC 4271 §5.1.4 allows either. Cisco uses 0. The waterfall model exposes both. MULTI_EXIT_DISCRFC 4271 · DRAFT STANDARD · January 2006

Route reflection replaces the iBGP mesh but needs ORIGINATOR_ID and CLUSTER_LIST so a reflected path is not re-reflected into a loop. Avoiding Routing Information LoopsRFC 4456 · DRAFT STANDARD · April 2006

Misconceptions

“BGP always picks the shortest AS_PATH.”
AS_PATH is the fourth RFC comparison, after LOCAL_PREF and local origination. Weight, if present, is even earlier and is not in the RFC. Breaking Ties (Phase 2)RFC 4271 · DRAFT STANDARD · January 2006
“MED is compared between all paths.”
By default MED is compared only among paths from the same neighboring AS. always-compare-med is an explicit local policy. MULTI_EXIT_DISCRFC 4271 · DRAFT STANDARD · January 2006
“IPv6 routes use the same NLRI field as IPv4.”
IPv6 unicast is MP_REACH_NLRI with AFI 2. The IPv4 NLRI field of RFC 4271 is not used. Multiprotocol Reachable NLRI - MP_REACH_NLRI (Type Code 14):RFC 4760 · DRAFT STANDARD · January 2007

More walkthroughs

Two eBGP paths, one winnerdesign-choice

R1 hears 192.0.2.0/24 from AS 65010 (LOCAL_PREF 80, AS_PATH 1) and AS 65020 (LOCAL_PREF 120, AS_PATH 3). LOCAL_PREF decides; AS_PATH is never consulted.

R1 · choosercandidates: 2ISP A · AS 65010ISP B · AS 65020eBGPeBGP
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
R1 · chooserroutercandidates: 2
ISP A · AS 65010router—
ISP B · AS 65020router—
R1 · chooser — ISP A · AS 65010linkup · eBGP
R1 · chooser — ISP B · AS 65020linkup · eBGP
1 / 3

Both neighbors are Established. Two candidate paths exist for the same prefix. Best-path is a total order over those candidates, not a flood.

What changed

  • Emphasis on R1 · chooser
  • R1 · chooser: candidates → 2

A customer leaks a provider pathfailure

AS 65001 learns 203.0.113.0/24 from transit AS 64496 and exports it to transit AS 64497. 64497 prefers the customer path because it is shorter, and the prefix is now a leak.

AS 64496 · transitAS 65001 · customerAS 64497 · transit203.0.113.0/24provider→customercustomer→provider
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
AS 64496 · transitrouter—
AS 65001 · customerrouter—
AS 64497 · transitrouter—
203.0.113.0/24cloud—
AS 64496 · transit — AS 65001 · customerlinkup · provider→customer
AS 65001 · customer — AS 64497 · transitlinkup · customer→provider
AS 64496 · transit — 203.0.113.0/24linkup
1 / 3

AS 64496 originates or transits 203.0.113.0/24 and advertises it to its customer 65001. That is a provider-to-customer announcement.

What changed

  • UPDATE to customer: AS 64496 · transit → AS 65001 · customer

Terms

LOCAL_PREF
A well-known discretionary attribute. Higher is better. Compared in Phase 2 before AS_PATH length. Not sent to eBGP peers.
AS_PATH
The sequence (and optional set) of ASes a path has traversed. Shorter wins after LOCAL_PREF. An AS_SET counts as one, not as its cardinality.
MULTI_EXIT_DISC
An optional non-transitive metric. Lower is better. Compared only among paths from the same neighboring AS unless a local always-compare policy is on.
Route reflector
An iBGP speaker allowed to re-advertise iBGP-learned paths to clients. ORIGINATOR_ID and CLUSTER_LIST prevent reflection loops.
Origin validation
RFC 6811 maps a prefix to Valid, NotFound, or Invalid using RPKI. Applying those states to best-path is local policy, not a rewrite of RFC 4271 §9.1.2.2.

Check yourself

  • Why does iBGP require a full mesh, a reflector, or a confederation?
  • Two eBGP paths: LOCAL_PREF 120 with AS_PATH length 3, versus LOCAL_PREF 80 with length 1. Which wins?
  • When is MED compared by default?
  • What happens to a path whose NEXT_HOP is not resolvable?
  • What loop-prevention attribute does a route reflector set?
  • Where does an IPv6 unicast prefix travel in BGP?
  • What are the RFC 6811 origin-validation states?
  • What does RFC 9234’s OTC attribute prevent?