CCIE Enterprise Infrastructure · BGP
BGP — CCIE Enterprise Infrastructure
Explore the complete learning path from BGP fundamentals to advanced design and troubleshooting.
- Chapters
- 21
- Topics
- 236
- Lab groups
- 13
- Labs
- 47
Stage 01
Foundations & Core BGP
What BGP is, how sessions form, and how prefixes get into the table.
5 chapters · 58 topics · 7 labs
- What BGP solves: inter-domain reachability vs. intra-domain shortest path
- Path vector vs. distance vector vs. link state
- The Autonomous System as a policy boundary
- Public and private AS ranges, 16-bit and 32-bit
- AS 0, reserved and documentation ASNs
- asplain, asdot, asdot+ notation
- Why BGP has no metric
- Why BGP converges slowly by design
- eBGP vs. iBGP: what actually differs
- AS_PATH loop prevention in eBGP and split-horizon loop prevention in iBGP
- Where BGP is used beyond the Internet
- Lab Chapter 3 Lab
- Lab Chapter 2 Lab
Foundation labs
- Lab eBGP and iBGP baseline
- TCP port 179 and what BGP inherits from TCP
- The finite state machine: Idle, Connect, Active, OpenSent, OpenConfirm, Established
- Active state as a symptom, not a healthy state
- The four message types: OPEN, UPDATE, KEEPALIVE, NOTIFICATION
- OPEN message fields and mismatch behavior
- Hold time and keepalive negotiation
- Router ID selection and manual override
- Duplicate router ID failure modes
- eBGP TTL behavior and ebgp-multihop
- GTSM / ttl-security and why it excludes multihop
- update-source and peering on loopbacks
- disable-connected-check
- Peer groups and peer templates
- Update groups and how peer grouping affects update generation
- Dynamic neighbors and listen ranges
- MD5 authentication and TCP-AO
- Common session failures and how to isolate them
Foundation labs
- Lab Peering on loopbacks, multihop, and authentication
- The network command and its exact-match requirement
- Mask mismatch failures
- auto-summary and its legacy effect
- Redistribution into BGP
- ORIGIN code consequences: IGP vs. Incomplete
- The Null0 static plus network pattern
- default-information originate vs. neighbor default-originate
- Conditional default origination with a route-map
- Prefix in the RIB but not in the BGP table
- Prefix in the BGP table but not advertised
Foundation labs
- Lab Advertising routes four ways and comparing the results
- Adj-RIB-In, Loc-RIB, Adj-RIB-Out
- Reading show bgp ipv4 unicast field by field
- Status codes: valid, best, internal, RIB-failure, suppressed, stale, dampened
- Origin codes
- RIB failure: what it means and when it matters
- Administrative distance: eBGP 20, iBGP 200
- The AD 20 hazard against IGP routes
- show bgp neighbors advertised-routes and received-routes
- Why received-routes needs soft reconfiguration or route refresh
- Table version numbers
Foundation labs
- Lab Reading and interpreting the BGP table
- Default next-hop: eBGP rewrites, iBGP preserves
- Why iBGP prefixes are unusable without IGP reachability to the next hop
- next-hop-self and what it does not cover
- Recursive next-hop resolution
- Recursion through a default route and the resulting blackhole
- Third-party next-hop on multi-access segments
- next-hop-unchanged
- Next-hop address tracking
- Scan-based vs. event-driven next-hop processing
- Diagnosing a prefix that is valid but not best
Foundation labs
- Lab Next-hop and recursion failures
Stage 02
Attributes, Path Selection & Policy
The attributes BGP carries, how it picks a path, and how you steer that choice.
4 chapters · 57 topics · 12 labs
- Well-known mandatory, well-known discretionary, optional transitive, optional non-transitive
- What a transit AS does with an unknown attribute
- ORIGIN
- AS_PATH and its segment types
- AS_SET and AS_CONFED_SET, including deprecation status
- NEXT_HOP
- LOCAL_PREF and changing the AS-wide default
- MED, its comparison scope, always-compare-med, deterministic-med
- WEIGHT and why it is not an attribute
- ATOMIC_AGGREGATE and AGGREGATOR
- ORIGINATOR_ID and CLUSTER_LIST
- Standard, extended, and large communities
- AIGP
- Cost community and link bandwidth
- Site of Origin
- Attribute error handling: session reset, treat-as-withdraw, attribute discard
Attribute and path-selection labs
- Lab Attribute propagation across AS boundaries
- Next-hop reachability as the precondition
- Weight
- Local preference
- Locally originated paths
- AS-path length, including confederation and AS_SET counting rules
- Origin type
- MED
- eBGP over iBGP
- IGP metric to the next hop
- Hot-potato and cold-potato routing as design outcomes of the IGP-metric step
- Oldest eBGP path
- Lowest router ID
- Shortest cluster list
- Lowest neighbor address
- bestpath as-path ignore and compare-routerid
- Persistent route oscillation
Attribute and path-selection labs
- Lab Best-path decided at each step
- Lab Weight, local preference, MED, and AS-path in combination
- Lab Hot-potato vs. cold-potato outcomes
- distribute-list, prefix-list, filter-list, route-map
- Prefix-lists with ge and le
- Route-map sequence order, permit and deny, implicit deny
- Match and set clauses
- Route-map continue
- Inbound and outbound order of operations
- Where weight and local preference are applied
- Route refresh vs. soft reconfiguration inbound
- maximum-prefix: warning-only, restart, threshold
- Outbound Route Filtering
- Conditional advertisement with exist-map and non-exist-map
- Verifying policy from the peer's perspective
Policy labs
- Lab Prefix-list, filter-list, and route-map filtering
- Lab Inbound and outbound policy on the same session
- Lab Route refresh and soft reconfiguration
- Lab Conditional advertisement
- Lab Outbound Route Filtering and maximum-prefix
- What a community is and what it does not do
- Community format and new-format
- send-community
- NO_EXPORT, NO_ADVERTISE, LOCAL_AS, INTERNET
- GRACEFUL_SHUTDOWN and BLACKHOLE
- Additive vs. replacing communities
- Standard and expanded community lists
- Matching communities with regular expressions
- set comm-list delete
- Extended communities: Route Target and Route Origin
- Large communities and the 4-byte ASN motivation
- Community-based traffic engineering
- Designing a community scheme for a provider
Community labs
- Lab Standard, extended, and large communities
- Lab Community-based traffic engineering
- Lab Designing and consuming a provider community scheme
Stage 03
Scaling & Architecture
Aggregation, AS-path control, and the structures that make iBGP scale.
5 chapters · 50 topics · 7 labs
- aggregate-address and the component route requirement
- summary-only and suppression
- as-set
- suppress-map, unsuppress-map, advertise-map, attribute-map
- Attributes lost by an aggregate
- ATOMIC_AGGREGATE and AGGREGATOR on the aggregate
- Aggregate flapping caused by as-set
- Aggregation vs. network plus Null0
Aggregation labs
- Lab Aggregation with and without as-set
- Lab Suppression and selective unsuppression
- Lab Component flap behavior
- AS-path prepending, inbound and outbound
- Why prepending loses to local preference
- local-as with no-prepend, replace-as, dual-as
- allowas-in
- as-override
- remove-private-as, all and replace-as
- AS-path access lists
- Regex syntax: anchors, underscore, wildcards, alternation
- Locally originated, direct neighbor, origin AS, transit AS, one hop away
- show bgp regexp and filter-list verification
- The iBGP full-mesh requirement and why it exists
- Full-mesh scaling limits
- Route reflector, client, non-client
- The three reflection rules
- ORIGINATOR_ID and CLUSTER_LIST loop prevention
- Cluster ID design
- Multiple cluster IDs
- Hierarchical route reflection
- Redundant route reflectors and failure behavior
- Route reflectors and next-hop handling
- Path hiding
- Add-Path
- Route-reflector design: placement, redundancy, and cluster topology
- Route servers and client-to-client reflection
Scaling labs
- Lab Route reflection, cluster design, and redundancy
- Lab Path hiding and Add-Path
- Sub-AS decomposition
- Confederation identifier vs. confederation peers
- AS_CONFED_SEQUENCE and external invisibility
- Which attributes behave as iBGP across sub-AS boundaries
- Next-hop handling across sub-AS boundaries
- AS-path length and confederation segments
- Confederations combined with route reflection
- Confederations vs. route reflection: choosing
- Verifying what the external peer sees
- Why BGP installs a single path
- maximum-paths for eBGP
- maximum-paths ibgp
- The equal-attribute requirement
- bestpath as-path multipath-relax
- eiBGP multipath
- Unequal-cost load sharing with link bandwidth
- CEF per-destination vs. per-packet
- Multipath vs. Add-Path
Scaling labs
- Lab Multipath and load sharing
Stage 04
Advanced BGP
Multiprotocol extensions, convergence behaviour, and securing the protocol.
3 chapters · 33 topics · 7 labs
- Capability advertisement and mismatch behavior
- Multiprotocol extensions
- The AFI/SAFI matrix
- The address-family configuration model
- neighbor activate
- bgp default ipv4-unicast
- One session carrying multiple address families
- MP-BGP for IPv6
- IPv6 peering over IPv4 transport, and IPv6 transport with link-local peering
- 4-byte ASN capability, AS_TRANS, and interop
- Route refresh and enhanced route refresh
Address family labs
- Lab MP-BGP for IPv6
- Lab Multiple address families on one session
- Lab 4-byte ASN interop
- What BGP convergence means at scale
- Timer tuning and fast-external-fallover
- Minimum advertisement interval
- Next-hop tracking as the primary convergence lever
- BFD for BGP, single-hop and multihop
- BGP PIC Core and PIC Edge
- Graceful Restart
- NSF awareness vs. NSF capability
- NSR and SSO
- Graceful shutdown and graceful maintenance
- Slow peer detection
- Route flap damping and why default parameters are wrong
Convergence labs
- Lab Measuring failover: default, tuned timers, BFD, PIC
- Lab Graceful Restart and NSR behavior
- Threat model: hijacks, leaks, session attacks, resource exhaustion
- Session protection: MD5, TCP-AO, GTSM, ACLs, CoPP
- maximum-prefix as a blast-radius control
- Edge prefix filtering as a security control, not just policy
- RPKI, ROAs, and origin validation states
- Acting on invalid, valid, and not-found
- Route leaks and BGP Roles / OTC
- Remotely Triggered Black Hole, destination and source based
- uRPF
- Bogon filtering and IRR-based prefix filters
Internet edge labs
- Lab RPKI origin validation
- Lab RTBH trigger and propagation
Stage 05
Design, Services & Troubleshooting
Putting BGP to work at the edge, in VPNs and overlays — then fixing it.
4 chapters · 38 topics · 11 labs
- Single-homed, dual-homed, single-multihomed, dual-multihomed
- Full table vs. partial table vs. default only
- Outbound traffic engineering
- Inbound traffic engineering
- Preventing your AS from becoming transit
- Community-based multihoming
- Provider-independent vs. provider-aggregatable addressing
- Enterprise Internet and WAN edge design end to end
Internet edge labs
- Lab Dual-ISP edge end to end
- Lab Inbound and outbound traffic engineering
- VRF and VRF-Lite
- VRF-aware BGP
- Route Distinguisher vs. Route Target
- VPNv4 and VPNv6 address families
- PE-CE routing with BGP
- Import and export policies
- as-override, allowas-in, and Site of Origin at the PE-CE edge
- Route leaking between VRFs and the global table
MPLS L3VPN labs
- Lab PE-CE BGP
- Lab Route Distinguisher and Route Target manipulation
- Lab as-override, allowas-in, and Site of Origin
- Lab VPNv4 troubleshooting
- BGP over DMVPN phases 1, 2, and 3
- BGP and NHRP interaction
- BGP in Cisco SD-WAN and OMP redistribution
- BGP as the SD-Access fabric border handoff
- MP-BGP EVPN for VXLAN: L2 VNI, L3 VNI, ARP suppression
- A repeatable method: session, table, best-path, policy, RIB, FIB
- Neighbor adjacency troubleshooting
- Route advertisement troubleshooting
- Route installation troubleshooting
- Path selection troubleshooting
- Route reflector troubleshooting
- Confederation troubleshooting
- Community troubleshooting
- AS-path and regex troubleshooting
- Aggregation troubleshooting
- VPNv4 troubleshooting
- Redistribution loops between BGP and the IGP
- The debug set and conditional debugging
- Packet captures of OPEN and UPDATE messages
- Logging neighbor changes
- Reading a full-table router: memory, convergence, scale limits
- Looking glasses, RouteViews, and RIPE RIS
Troubleshooting labs
- Lab Session failures, one fault each
- Lab Advertisement and installation failures
- Lab Path-selection puzzles
- Lab Route reflector and confederation faults
- Lab Community and AS-path faults
BGP Mastery
The end of the taught course. What remains is putting it together under exam conditions.
21 chapters · 236 topics · 47 labs
- Lab Two-hour BGP mock lab
- Lab Four-hour CCIE-style BGP mock lab
- Lab Full-scenario capstone: IGP underlay, iBGP with route reflection, dual eBGP, policy, communities, aggregation, injected faults