BGP Cheat Sheet
BGP Cheat Sheet: Configuration, Best-Path Selection, Troubleshooting & Security
A practical, beginner-friendly to engineer-level guide to Border Gateway Protocol (BGP), featuring an original three-router Cisco IOS XE lab, verified command examples, and fast troubleshooting workflows.
Editorial edition • Updated October 2026 • MAG212 CYBER
1. What is BGP?
Border Gateway Protocol is the interdomain path-vector routing protocol used to exchange reachability information and routing policies between autonomous systems (AS). Unlike OSPF, it does not automatically choose paths by shortest internal cost. BGP applies routing policy and path attributes to select one best path among eligible candidates.
| Characteristic | eBGP | iBGP |
|---|---|---|
| Peers | Different AS numbers | Same AS number |
| Common purpose | Exchange routing information across organizations | Distribute BGP reachability within one AS |
| Default TTL / peering | TTL 1 by default, so peers are usually directly connected; non-adjacent peers need ebgp-multihop (or disable-connected-check) | TTL 255; commonly peers between loopbacks across a routed core |
| Cisco AD (default) | 20 | 200 |
| Next-hop behavior | Typically rewrites next hop to self when advertising externally | Often preserves external next hop; next-hop reachability matters |
| Route propagation | AS_PATH loop prevention | iBGP split horizon; full mesh or route reflectors |
2. BGP Lab Topology — Three Routers
All IP addresses below are reserved documentation space or private addresses. The lab uses AS 65100 for the simulated ISP and AS 65200 for the enterprise. The edge and core run iBGP over the internal network.
R1 — ISP (AS 65100)
interface GigabitEthernet0/0
description TO-R2-ENTERPRISE
ip address 203.0.113.1 255.255.255.252
no shutdown
!
ip route 198.51.100.0 255.255.255.0 Null0
!
router bgp 65100
bgp router-id 1.1.1.1
neighbor 203.0.113.2 remote-as 65200
address-family ipv4 unicast
network 198.51.100.0 mask 255.255.255.0
neighbor 203.0.113.2 activate
exit-address-familynetwork statement in this isolated training scenario. Never originate documentation prefixes or an unowned address block into the public internet.R2 — Enterprise edge (AS 65200)
interface GigabitEthernet0/0
description TO-R1-ISP
ip address 203.0.113.2 255.255.255.252
no shutdown
!
interface GigabitEthernet0/1
description TO-R3-CORE
ip address 10.0.0.1 255.255.255.252
no shutdown
!
router bgp 65200
bgp router-id 2.2.2.2
neighbor 203.0.113.1 remote-as 65100
neighbor 10.0.0.2 remote-as 65200
address-family ipv4 unicast
neighbor 203.0.113.1 activate
neighbor 10.0.0.2 activate
neighbor 10.0.0.2 next-hop-self
exit-address-familyR3 — Enterprise core (AS 65200)
interface GigabitEthernet0/0
description TO-R2-EDGE
ip address 10.0.0.2 255.255.255.252
no shutdown
!
router bgp 65200
bgp router-id 3.3.3.3
neighbor 10.0.0.1 remote-as 65200
address-family ipv4 unicast
neighbor 10.0.0.1 activate
exit-address-family3. The Six BGP Neighbor States
| State | What it means | What to check |
|---|---|---|
| Idle | BGP waits or resets the peer connection | Config, administrative shutdown, reachability |
| Connect | Trying to establish TCP connection | Routes, ACLs, TCP 179 |
| Active | TCP connection attempt failed; retrying | Peer IP, remote-AS, firewall, TTL and authentication |
| OpenSent | OPEN sent; checking peer capabilities | AS mismatch, version/capabilities |
| OpenConfirm | OPEN accepted; waiting for KEEPALIVE | Timers and session resets |
| Established | BGP session is up; UPDATE messages can flow | Address-family activation and policies if no prefixes |
4. BGP Path Attributes — Fast Reference
| Attribute | Preference / use | Where it matters |
|---|---|---|
| Weight (Cisco-specific) | Highest wins; local router only | Local path preference, never sent to peers |
| LOCAL_PREF | Highest wins; default commonly 100 | Normally propagated via iBGP, not ordinary eBGP |
| AS_PATH | Shorter usually wins | Shows AS sequence, helps prevent AS loops |
| ORIGIN | IGP (i) preferred to EGP (e), then incomplete (?) | How route entered BGP |
| MED | Lower preferred under normal comparison rules | Hints preferred entry into a neighboring AS |
| NEXT_HOP | Must be reachable | Common cause of unusable BGP routes |
| COMMUNITY | Policy tags; no universal numeric priority | Apply routing policies at scale |
| ORIGINATOR_ID / CLUSTER_LIST | Loop prevention with route reflectors | iBGP route reflection |
5. Cisco BGP Best-Path Selection — Simplified Order
Before comparing attributes, BGP discards ineligible candidates (for example, routes with unreachable next hops). Cisco’s precise algorithm contains advanced cases, knobs, and later tie-breakers; use the table as a study sequence, not as a universal vendor-neutral algorithm.
| Order | Rule | Winner |
|---|---|---|
| 1 | Weight | Highest |
| 2 | Local preference | Highest |
| 3 | Locally originated | Local |
| 4 | AS_PATH length | Shortest |
| 5 | Origin code | IGP, then EGP, then incomplete |
| 6 | MED (subject to comparison conditions) | Lowest |
| 7 | eBGP vs iBGP | eBGP |
| 8 | IGP cost to next hop | Lowest |
| 9 | Older eBGP path (when applicable) | Oldest |
| 10 | Router ID, cluster list, neighbor address | Tie breakers |
6. Control Outbound Routing: LOCAL_PREF
Scenario: Your AS receives the same prefix from ISP-A and ISP-B. Prefer ISP-A for traffic leaving your network. Apply an inbound route map to routes received from ISP-A and set LOCAL_PREF to 200.
ip prefix-list DEMO-PREFIX seq 5 permit 198.51.100.0/24
!
route-map PREFER-ISP-A permit 10
match ip address prefix-list DEMO-PREFIX
set local-preference 200
!
route-map PREFER-ISP-A permit 100
!
router bgp 65200
address-family ipv4 unicast
neighbor 203.0.113.1 route-map PREFER-ISP-A in
exit-address-familyWhy the permit 100? An unmatched route map route is denied implicitly. The second entry allows all other routes to pass unchanged, assuming other inbound filters permit them. For real Internet edge deployments, always use explicit import/export prefix policies and an agreed maximum-prefix limit.
7. Influence Inbound Routing: AS-PATH Prepending
Scenario: You want other networks to view a backup link as less attractive for your own legitimate prefix. Add your ASN multiple times on outbound advertisements over the backup peer. This is only a hint; upstream policies can override it.
ip prefix-list OWN-PREFIX seq 5 permit 192.0.2.0/24
!
route-map BACKUP-PREPEND permit 10
match ip address prefix-list OWN-PREFIX
set as-path prepend 65200 65200 65200
!
router bgp 65200
address-family ipv4 unicast
neighbor 203.0.113.5 route-map BACKUP-PREPEND out
exit-address-familyConceptual second ISP at 203.0.113.5; configure the matching peer and real owned prefix separately. Outbound route-map entries with no subsequent permit entry deny nonmatching prefixes, which may be desirable for strict export control.
8. Essential Verification and Troubleshooting Commands
| Command (Cisco IOS XE) | What it tells you |
|---|---|
show ip bgp summary | Neighbor state; prefix count when established |
show bgp ipv4 unicast summary | Address-family focused peer health |
show ip bgp neighbors | Timers, resets, policies and peer details |
show ip bgp 198.51.100.0 | Candidate paths, attributes and chosen route |
show ip route 198.51.100.0 | Whether the route entered the routing table |
show ip route 203.0.113.1 | Reachability toward a peer or next hop |
show tcp brief | TCP session status (platform-dependent formatting) |
show running-config | section router bgp | BGP neighbor configuration and policies |
show ip bgp neighbors 203.0.113.1 advertised-routes | What your router is offering to a peer (policy matters) |
show ip bgp neighbors 203.0.113.1 routes | Accepted routes from a peer, if enabled/supported |
Troubleshooting workflow
- Neighbor never establishes: ping peer, verify route, ACL/TCP 179,
remote-as, BGP authentication, and TTL/eBGP multihop where applicable. - Established but zero routes: check IPv4/IPv6 address family, inbound prefix policies, origin
networkstatements and exact RIB matches. - Route in BGP, absent from RIB: next-hop reachability, competing administrative distance, RIB failure or policy.
- Wrong exit path: inspect weight, LOCAL_PREF, AS_PATH, ORIGIN and MED in order; confirm where policies are attached.
- Unexpected withdrawals: check interface flaps, session reset reason, max-prefix, peer updates and logs.
9. Secure BGP at the Edge
Adopt strict export filtering to prevent accidental leaks; reject bogon or unauthorized origins as appropriate to your policy; monitor unexpected AS_PATH and volume changes; and use route dampening carefully rather than treating it as a universal fix. RPKI validates route-origin authorization, but it does not cryptographically validate the complete AS_PATH.
10. Quick Interview Questions & Answers
A: TCP port 179; its reliable transport carries BGP protocol messages.
A: eBGP peers have different ASNs; iBGP peers share an ASN.
A: The TCP session has not successfully formed. Check connectivity, peer IP, ASNs, filters, authentication and TTL.
A: No. Weight, LOCAL_PREF and local origination can override it before AS_PATH is compared.
A: It gives internal peers a reachable next hop when learning routes originating from external neighbors.
A: No. It originates the matching prefix into BGP only when an exact route exists in the appropriate routing table.
A: Route reflectors or confederations can reduce full-mesh requirements.
A: LOCAL_PREF is a common AS-wide tool for influencing outbound choices.
A: No. It influences some remote selection decisions but cannot override other networks’ policies.
A: A peer in Established state; check received/advertised prefixes separately.
11. Mini Practice Scenario
Question: R2 learns 198.51.100.0/24 from two peers. Path A has LOCAL_PREF 200 and AS_PATH 65100 64496 64497. Path B has LOCAL_PREF 100 and AS_PATH 65101. Assuming both are valid and have equal weight, which wins?
Answer: Path A. LOCAL_PREF is compared before AS_PATH length, so 200 beats 100 regardless of Path B having fewer AS hops.
12. Sources & Verification
This is an original MAG212 CYBER teaching guide. The lab, diagram and explanations were written independently and checked against the BGP-4 standard and Cisco documentation.
RFC 4271 — A Border Gateway Protocol 4 (BGP-4) · Cisco — BGP Best Path Selection Algorithm · RFC 6811 — BGP Prefix Origin Validation (RPKI)
Commands are educational Cisco IOS/IOS XE examples. Test in a lab before applying to a production edge. Defaults and CLI syntax vary by vendor and version.