eBGP vs iBGP and BGP Path Selection Order (CCNP ENARSI)
BGP (Border Gateway Protocol) is the path vector protocol that exchanges routes between autonomous systems, and it runs over TCP port 179. It does not pick a path with arithmetic. It walks an ordered list of thirteen tiebreakers, and five of the first eight are attributes an operator set on purpose.
That inversion is where most CCNP candidates lose marks. Every interior gateway protocol you have studied computes a number: OSPF adds up cost, EIGRP runs a composite formula, RIP counts hops. BGP compares policy first and topology fourth. The session type, eBGP or iBGP, then changes what happens to those attributes in flight, which is the other half of the exam.
Scope first. ENCOR 350-401 v1.2 asks one thing at topic 3.2.c: configure and verify eBGP between directly connected neighbors. ENARSI 300-410 v1.1 goes further at topic 1.11, troubleshooting BGP internal, external, unicast and VRF-Lite. Note the verb: ENARSI hands you broken output and expects a diagnosis, so the sections below end in it.
BGP Is a Path Vector Protocol, Not a Distance Vector One
The vector is the AS_PATH: the ordered list of autonomous systems a prefix has crossed, and that is BGP's entire topology view. No Dijkstra, no composite metric, no areas. In OSPF the lowest cost wins and the argument ends; in BGP the shortest AS_PATH is only the fourth tiebreaker.
Why BGP Runs Over TCP Port 179
BGP-4 is defined in RFC 4271, and section 3 gives the reasoning: "BGP uses TCP [RFC793] as its transport protocol. This eliminates the need to implement explicit update fragmentation, retransmission, acknowledgement, and sequencing. BGP listens on TCP port 179."
Two testable consequences:
- No hello based discovery. Every peer is typed in by hand with
neighbor <ip-address> remote-as <asn>, and IP reachability must exist first, because TCP connects before BGP does. - Anything blocking TCP 179 fails quietly, leaving the neighbor in Active. Control plane policing is ENARSI topic 3.3.
The TCP vs UDP breakdown covers why a protocol pays for a handshake.
AS_PATH: How BGP Prevents Loops Between Autonomous Systems
Loop prevention is two rules. RFC 4271 section 5.1.2 has a speaker prepend its own AS number to the leftmost position of the AS_PATH before sending to an eBGP peer. Section 9.1.2 has the receiver drop any route already carrying the local AS number. Send 198.51.100.0/24 out of AS 65001 around a ring; it returns as 65003 65002 65001 and AS 65001 discards it.
Three exam details:
- Prepending your own ASN more than once is AS path prepending, which makes a link less attractive.
- AS_SEQUENCE (type 2) is the ordered list. AS_SET (type 1) comes from aggregation and counts as length 1 however many ASNs it holds.
- Four byte ASNs come from RFC 6793, with placeholder AS_TRANS 23456. RFC 6996 reserves 64512 to 65534 and 4200000000 to 4294967294 as private, so 65535 is not.
eBGP vs iBGP: One Protocol, Two Sets of Rules
There is only one BGP. If the ASN in neighbor ... remote-as matches the ASN in router bgp the peer is internal; if it differs, external. Every row below follows from that.
| Behaviour | eBGP | iBGP |
|---|---|---|
| Peer ASN vs local ASN | different | same |
| Default TTL | 1, ebgp-multihop needed for non-adjacent peers | 255, peer may be several hops away |
| AS_PATH on advertisement | local ASN prepended | unchanged |
| NEXT_HOP on advertisement | rewritten | preserved |
| Administrative distance | 20 | 200 |
| Advertisement interval | 30 seconds | 0 seconds |
That advertisement interval row is the Cisco default, not the RFC value. RFC 4271 section 10 suggests 30 seconds on eBGP and 5 on iBGP; Cisco IOS and IOS XE default neighbor advertisement-interval to 30 for eBGP outside a VRF and 0 for iBGP. Answer 30 and 0 on a Cisco item.
Memorise the administrative distance row. eBGP at 20 beats OSPF at 110 and internal EIGRP at 90 and displaces the IGP copy of a prefix, while iBGP at 200 loses to every IGP. The full ladder is in our administrative distance guide.
Both session types come from one configuration. Comments need their own lines; IOS rejects a trailing !:
router bgp 65001
bgp router-id 1.1.1.1
! eBGP peer, directly connected, TTL 1
neighbor 203.0.113.2 remote-as 65002
! iBGP peer, ASN matches router bgp
neighbor 2.2.2.2 remote-as 65001
neighbor 2.2.2.2 update-source Loopback0
neighbor 2.2.2.2 next-hop-self
network 198.51.100.0 mask 255.255.255.0BGP Neighbor States: Read the Session Before You Read the Routes
Prove the session before you argue about attributes. On R1 the iBGP peer is up, the eBGP peer is not:
R1# show ip bgp summary
BGP router identifier 1.1.1.1, local AS number 65001
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
2.2.2.2 4 65001 52 54 5 0 0 00:43:12 1
203.0.113.2 4 65002 0 0 1 0 0 never ActiveRead the last two columns:
- A number in State/PfxRcd means Established, and that is how many prefixes the peer sent. 2.2.2.2 is up and sent one.
- A word in that column is a state, not a count. 203.0.113.2 in Active means TCP is not up, and
neversays it never has been. - MsgRcvd and MsgSent of 0 confirm it: nothing has crossed that session, so the fault is below BGP.
That split is the first triage step: a prefix count is a policy problem, a state name is a transport problem.
The state machine behind that column has six states: Idle waits for a start event, Connect waits for the TCP handshake, Active retries it, OpenSent waits for an OPEN, OpenConfirm for a keepalive, and Established means updates are flowing.
Only the failures matter. Idle or Active means TCP is failing: no route to the peer, a wrong update-source, a missing ebgp-multihop, an ACL dropping port 179, or a mismatched MD5 password, which breaks the TCP signature option before BGP speaks. A session that reaches OpenSent then resets to Idle is an OPEN parameter mismatch, a wrong remote ASN or an unacceptable hold time, generating an OPEN Message Error NOTIFICATION.
Timers trap people because the RFC and Cisco disagree. RFC 4271 suggests a 90 second hold; Cisco IOS documents timers bgp as keepalive 60 and holdtime 180, so answer 60 and 180. Hold time is negotiated down to the smaller of the two OPEN values.
In class I stop students typing a single BGP command until they can name the bucket from the summary output alone. Most of the lab time people lose goes on adjusting attributes over a session that never carried a packet.
The Inaccessible Next Hop: The Fault That Breaks Most Labs
With that eBGP session up, the NEXT_HOP row breaks labs. An eBGP learned route passed to an internal peer keeps its original next hop, which the internal router cannot reach. On R2 the prefix is in the BGP table and is not selected:
R2# show ip bgp
BGP table version is 5, local router ID is 2.2.2.2
Status codes: * valid, > best, i - internal, r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
* i 198.51.100.0/24 203.0.113.2 0 100 0 65002 iThe * says valid, the i says learned from an internal peer, and the missing > is the finding: no best path, so nothing reached the routing table. The per prefix view names the reason:
R2# show ip bgp 198.51.100.0
BGP routing table entry for 198.51.100.0/24, version 0
Paths: (1 available, no best path)
Not advertised to any peer
65002
203.0.113.2 (inaccessible) from 1.1.1.1 (1.1.1.1)
Origin IGP, metric 0, localpref 100, valid, internalTwo strings decide it. (inaccessible) means R2 has no IGP route to 203.0.113.2, so the path is disqualified before step 8, lowest IGP metric to the next hop, is even evaluated. no best path with one available path confirms it. Fix it on the advertising router with neighbor <ip-address> next-hop-self aimed at the internal neighbor. Cisco lists that command's default as "This command is disabled by default."
After the fix, the same command on R2 reads:
R2# show ip bgp 198.51.100.0
BGP routing table entry for 198.51.100.0/24, version 6
Paths: (1 available, best #1, table default)
65002
1.1.1.1 (metric 11) from 1.1.1.1 (1.1.1.1)
Origin IGP, metric 0, localpref 100, valid, internal, bestThe next hop is now R1's loopback, the IGP has a metric to it, and best appears. Confirm with show ip route 198.51.100.0: a path can be best in BGP and still lose the routing table to a lower administrative distance.
The iBGP Split Horizon Rule and Why You Need a Full Mesh
RFC 4271 section 9.2 is blunt: "When a BGP speaker receives an UPDATE message from an internal peer, the receiving BGP speaker SHALL NOT re-distribute the routing information contained in that UPDATE message to other internal peers (unless the speaker acts as a BGP Route Reflector [RFC2796])."
The cause is section 5.1.2: a speaker must not modify the AS_PATH toward an internal peer, so there is no loop detection signal inside the AS and the protocol bans re-advertisement instead. The consequence is the full mesh: n speakers require n*(n-1)/2 sessions. Ten routers is 45 sessions, twenty is 190, each one configured and troubleshot.
The route reflector is the exemption inside the rule, the parenthesis quoted above: clients peer only with it. RFC 4456 replaces the lost loop check with ORIGINATOR_ID, type code 9, carrying the originator's BGP Identifier, and CLUSTER_LIST, type code 10, which gains the local cluster ID at every reflection.
The BGP Best Path Selection Algorithm, In Order
Cisco's algorithm has thirteen steps, not the eight or eleven on study forums. BGP compares two paths at a time and stops at the first step with a winner.
- Highest WEIGHT. Cisco proprietary, never advertised. Default 32768 local, 0 learned.
- Highest LOCAL_PREF. Default 100, AS wide, never sent to an eBGP peer.
- Locally originated.
networkorredistributebeats anaggregate-addressaggregate. - Shortest AS_PATH. An AS_SET counts as 1; confederation segments do not count.
- Lowest origin type. IGP (i) beats EGP (e) beats INCOMPLETE (?).
- Lowest MULTI_EXIT_DISC. Default 0, compared only when the first neighboring AS matches.
bgp bestpath med missing-as-worstreads a missing MED as 4294967294. - eBGP over iBGP.
- Lowest IGP metric to the BGP next hop.
- Multipath determination.
maximum-pathsdefaults to 1. - When both paths are external, the oldest wins.
- Lowest router ID, or ORIGINATOR_ID where route reflector attributes exist.
- Shortest cluster list, route reflector environments only.
- Lowest neighbor address.
Three commands bend the order: bgp bestpath as-path ignore skips step 4, bgp always-compare-med widens step 6 across autonomous systems, bgp bestpath compare-routerid skips step 10. The classroom mnemonic, We Love Oranges As Oranges Mean Pure Refreshment, covers only the first eight, which is why you learn the list.
Proving Which Step Won
With two paths for one prefix, the detail output names the winner and the step:
R2# show ip bgp 198.51.100.0
BGP routing table entry for 198.51.100.0/24, version 9
Paths: (2 available, best #2, table default)
65002
1.1.1.1 (metric 11) from 1.1.1.1 (1.1.1.1)
Origin IGP, metric 0, localpref 100, valid, internal
65003 65002
3.3.3.3 (metric 11) from 3.3.3.3 (3.3.3.3)
Origin IGP, metric 0, localpref 200, valid, internal, bestRead it top down against the list. Weight is not printed on either path, so step 1 ties. Step 2 does not: localpref 200 beats 100 and the comparison stops there. The path marked best carries the longer AS_PATH, and step 4 is never reached.
When a candidate tells me the shortest AS path should have won, I ask them to read the localpref column out loud. In production that is rarely an error either, it is usually somebody's route map doing what it was written to do.
One blueprint note: ENARSI 1.11.b still lists synchronization, disabled by default since Cisco IOS 12.2(8)T. The command is still accepted on IOS and IOS XE, but you will never need it. Learn the concept, never type it.
Train BGP With CISNET
Our CCNP ENARSI bootcamp teaches this module live with a CCIE certified lead instructor: 30 hours across 9 Saturday sessions for CAD $799, on a multi-router GNS3 topology with MPLS and BGP plus EVE-NG labs, so you read this output on your own broken sessions. Not cleared the core exam? Start with CCNP ENCOR.
Frequently Asked Questions
What is BGP and what is it used for?
BGP, the Border Gateway Protocol, is the path vector routing protocol that exchanges reachability between autonomous systems, and it is what stitches the internet together. It runs over TCP port 179, carries prefixes with attributes such as AS_PATH, LOCAL_PREF and MED rather than a single metric, and selects a path by walking thirteen ordered tiebreakers. Enterprises run it for multihoming to two or more providers and inside MPLS VPNs.
Why is my BGP neighbor stuck in Active?
Active means BGP is retrying the TCP connection and has not completed it, so the fault is below BGP, not in policy. Check that the peer address is reachable, that update-source matches the address the far end expects, that ebgp-multihop is present if the eBGP peers are not directly connected, that nothing is dropping TCP 179, and that any MD5 password matches. In show ip bgp summary such a neighbor shows a state name in State/PfxRcd instead of a prefix count.
What does inaccessible mean next to the next hop in show ip bgp?
It means the local router has no route to the BGP next hop, so the path is never selected and the prefix never installs. It happens most often on iBGP, because a route learned from an eBGP peer keeps the external next hop when passed to an internal peer. Fix it on the advertising router with neighbor <ip-address> next-hop-self toward the internal neighbor, or advertise the external link into the IGP.
Does BGP use TCP or UDP?
BGP uses TCP, on port 179. RFC 4271 section 3 gives the reason: TCP already provides retransmission, acknowledgement and sequencing, so BGP implements none of its own. It is the only routing protocol that runs over TCP. RIP uses UDP port 520, OSPF rides on IP protocol 89 and EIGRP on protocol 88.
What is the difference between eBGP and iBGP?
The session type comes from comparing ASNs: if the ASN in neighbor remote-as matches the ASN in router bgp the peer is internal, otherwise external. eBGP prepends the local ASN to AS_PATH, rewrites NEXT_HOP, uses a TTL of 1 so peers must be directly connected unless ebgp-multihop is set, and has an administrative distance of 20. iBGP changes neither attribute, uses TTL 255, and sits at 200.
Why does iBGP require a full mesh?
RFC 4271 section 9.2 forbids re-advertising to other internal peers anything learned from an internal peer, unless the speaker is a route reflector. With AS_PATH unmodified inside an autonomous system there is no loop detection signal, so the protocol bans re-advertisement. Every iBGP speaker must therefore peer with every other, which is n*(n-1)/2 sessions.
What is the order of the BGP best path selection algorithm?
Cisco's algorithm has thirteen steps, checked until one produces a winner: highest weight, highest local preference, locally originated, shortest AS_PATH, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric to the next hop, multipath, oldest external path, lowest router ID, shortest cluster list, lowest neighbor address.
What is the default administrative distance of BGP?
There is no single value: external BGP is 20, internal BGP is 200. Because 20 beats OSPF at 110 and internal EIGRP at 90, an eBGP learned prefix displaces the IGP copy, while internal BGP at 200 loses to every IGP. That asymmetry causes most feedback problems in route redistribution.
Is BGP on the CCNP ENCOR exam or the ENARSI exam?
Both, at different depths. ENCOR 350-401 v1.2 covers BGP only at topic 3.2.c, eBGP between directly connected neighbors. ENARSI 300-410 v1.1 covers it at topic 1.11, where the verb is troubleshoot and the scope adds internal BGP, authentication, path preference and route reflectors.
