- What BGP Actually Does
CCIE Enterprise Infrastructure · BGP
BGP — CCIE Enterprise Infrastructure
The complete BGP learning path for CCIE Enterprise Infrastructure: how sessions form, how prefixes are chosen and shaped, how the protocol scales with route reflection and confederations, and how it is designed, secured and repaired in production.
- Chapters
- 21
- Topics
- 225
- Lab groups
- 1
- Labs
- 0
Stage 01
Foundations & Core BGP
What BGP is, how a session forms, how prefixes enter the table, and how the next hop is resolved.
- TCP port 179 and what BGP inherits from TCP
- The finite state machine: Idle, Connect, Active, OpenSent, OpenConfirm, Established
- Active state as a symptom, not a healthy state
- The four message types: OPEN, UPDATE, KEEPALIVE, NOTIFICATION
- OPEN message fields and mismatch behavior
- Hold time and keepalive negotiation
- Router ID selection and manual override
- Duplicate router ID failure modes
- eBGP TTL behavior and ebgp-multihop
- GTSM / ttl-security and why it excludes multihop
- update-source and peering on loopbacks
- disable-connected-check
- Peer groups and peer templates
- Update groups and how peer grouping affects update generation
- Dynamic neighbors and listen ranges
- MD5 authentication and TCP-AO
- Common session failures and how to isolate them
- The network command and its exact-match requirement
- Mask mismatch failures
- auto-summary and its legacy effect
- Redistribution into BGP
- ORIGIN code consequences: IGP vs. Incomplete
- The Null0 static plus network pattern
- default-information originate vs. neighbor default-originate
- Conditional default origination with a route-map
- Prefix in the RIB but not in the BGP table
- Prefix in the BGP table but not advertised
- Adj-RIB-In, Loc-RIB, Adj-RIB-Out
- Reading show bgp ipv4 unicast field by field
- Status codes: valid, best, internal, RIB-failure, suppressed, stale, dampened
- Origin codes
- RIB failure: what it means and when it matters
- Administrative distance: eBGP 20, iBGP 200
- The AD 20 hazard against IGP routes
- show bgp neighbors advertised-routes and received-routes
- Why received-routes needs soft reconfiguration or route refresh
- Table version numbers
- Default next-hop: eBGP rewrites, iBGP preserves
- Why iBGP prefixes are unusable without IGP reachability to the next hop
- next-hop-self and what it does not cover
- Recursive next-hop resolution
- Recursion through a default route and the resulting blackhole
- Third-party next-hop on multi-access segments
- next-hop-unchanged
- Next-hop address tracking
- Scan-based vs. event-driven next-hop processing
- Diagnosing a prefix that is valid but not best
Stage 02
Attributes, Path Selection & Policy
The attributes BGP carries, the algorithm that picks one path, and the policy tools that bend the outcome.
- Well-known mandatory, well-known discretionary, optional transitive, optional non-transitive
- What a transit AS does with an unknown attribute
- ORIGIN
- AS_PATH and its segment types
- AS_SET and AS_CONFED_SET, including deprecation status
- NEXT_HOP
- LOCAL_PREF and changing the AS-wide default
- MED, its comparison scope, always-compare-med, deterministic-med
- WEIGHT and why it is not an attribute
- ATOMIC_AGGREGATE and AGGREGATOR
- ORIGINATOR_ID and CLUSTER_LIST
- Standard, extended, and large communities
- AIGP
- Cost community and link bandwidth
- Site of Origin
- Attribute error handling: session reset, treat-as-withdraw, attribute discard
- Next-hop reachability as the precondition
- Weight
- Local preference
- Locally originated paths
- AS-path length, including confederation and AS_SET counting rules
- Origin type
- MED
- eBGP over iBGP
- IGP metric to the next hop
- Hot-potato and cold-potato routing as design outcomes of the IGP-metric step
- Oldest eBGP path
- Lowest router ID
- Shortest cluster list
- Lowest neighbor address
- bestpath as-path ignore and compare-routerid
- Persistent route oscillation
- distribute-list, prefix-list, filter-list, route-map
- Prefix-lists with ge and le
- Route-map sequence order, permit and deny, implicit deny
- Match and set clauses
- Route-map continue
- Inbound and outbound order of operations
- Where weight and local preference are applied
- Route refresh vs. soft reconfiguration inbound
- maximum-prefix: warning-only, restart, threshold
- Outbound Route Filtering
- Conditional advertisement with exist-map and non-exist-map
- What a community is and what it does not do
- Community format and new-format
- send-community
- NO_EXPORT, NO_ADVERTISE, LOCAL_AS, INTERNET
- GRACEFUL_SHUTDOWN and BLACKHOLE
- Additive vs. replacing communities
- Standard and expanded community lists
- Matching communities with regular expressions
- set comm-list delete
- Extended communities: Route Target and Route Origin
- Large communities and the 4-byte ASN motivation
- Community-based traffic engineering
- Designing a community scheme for a provider
Stage 03
Scaling & Architecture
Summarising the table, shaping the AS path, and the two ways BGP escapes the iBGP full mesh.
- aggregate-address and the component route requirement
- summary-only and suppression
- as-set
- suppress-map, unsuppress-map, advertise-map, attribute-map
- Attributes lost by an aggregate
- ATOMIC_AGGREGATE and AGGREGATOR on the aggregate
- Aggregate flapping caused by as-set
- Aggregation vs. network plus Null0
- AS-path prepending, inbound and outbound
- Why prepending loses to local preference
- local-as with no-prepend, replace-as, dual-as
- allowas-in
- as-override
- remove-private-as, all and replace-as
- AS-path access lists
- Regex syntax: anchors, underscore, wildcards, alternation
- Locally originated, direct neighbor, origin AS, transit AS, one hop away
- show bgp regexp and filter-list verification
- The iBGP full-mesh requirement and why it exists
- Full-mesh scaling limits
- Route reflector, client, non-client
- The three reflection rules
- ORIGINATOR_ID and CLUSTER_LIST loop prevention
- Cluster ID design
- Multiple cluster IDs
- Hierarchical route reflection
- Redundant route reflectors and failure behavior
- Route reflectors and next-hop handling
- Path hiding
- Add-Path
- Route-reflector design: placement, redundancy, and cluster topology
- Route servers and client-to-client reflection
- Sub-AS decomposition
- Confederation identifier vs. confederation peers
- AS_CONFED_SEQUENCE and external invisibility
- Which attributes behave as iBGP across sub-AS boundaries
- Next-hop handling across sub-AS boundaries
- AS-path length and confederation segments
- Confederations combined with route reflection
- Confederations vs. route reflection: choosing
- Verifying what the external peer sees
- Why BGP installs a single path
- maximum-paths for eBGP
- maximum-paths ibgp
- The equal-attribute requirement
- bestpath as-path multipath-relax
- eiBGP multipath
- Unequal-cost load sharing with link bandwidth
- CEF per-destination vs. per-packet
- Multipath vs. Add-Path
Stage 04
Advanced BGP
Carrying more than IPv4, failing over faster than the default timers, and keeping the protocol from being abused.
- Capability advertisement and mismatch behavior
- Multiprotocol extensions
- The AFI/SAFI matrix
- The address-family configuration model
- neighbor activate
- bgp default ipv4-unicast
- One session carrying multiple address families
- MP-BGP for IPv6
- IPv6 peering over IPv4 transport, and IPv6 transport with link-local peering
- 4-byte ASN capability, AS_TRANS, and interop
- Route refresh and enhanced route refresh
- What BGP convergence means at scale
- Timer tuning and fast-external-fallover
- Minimum advertisement interval
- Next-hop tracking as the primary convergence lever
- BFD for BGP, single-hop and multihop
- BGP PIC Core and PIC Edge
- Graceful Restart
- NSF awareness vs. NSF capability
- NSR and SSO
- Graceful shutdown and graceful maintenance
- Slow peer detection
- Route flap damping and why default parameters are wrong
- Threat model: hijacks, leaks, session attacks, resource exhaustion
- Session protection: MD5, TCP-AO, GTSM, ACLs, CoPP
- maximum-prefix as a blast-radius control
- Edge prefix filtering as a security control, not just policy
- RPKI, ROAs, and origin validation states
- Acting on invalid, valid, and not-found
- Route leaks and BGP Roles / OTC
- Remotely Triggered Black Hole, destination and source based
- uRPF
- Bogon filtering and IRR-based prefix filters
Stage 05
Design, Services & Troubleshooting
Putting BGP to work at the Internet edge, as the control plane of an L3VPN and an overlay, and repairing it in order when it breaks.
- Single-homed, dual-homed, single-multihomed, dual-multihomed
- Full table vs. partial table vs. default only
- Outbound traffic engineering
- Inbound traffic engineering
- Preventing your AS from becoming transit
- Community-based multihoming
- Provider-independent vs. provider-aggregatable addressing
- Enterprise Internet and WAN edge design end to end
- VRF and VRF-Lite
- VRF-aware BGP
- Route Distinguisher vs. Route Target
- VPNv4 and VPNv6 address families
- PE-CE routing with BGP
- Import and export policies
- as-override, allowas-in, and Site of Origin at the PE-CE edge
- Route leaking between VRFs and the global table
- BGP over DMVPN phases 1, 2, and 3
- BGP and NHRP interaction
- BGP in Cisco SD-WAN and OMP redistribution
- BGP as the SD-Access fabric border handoff
- MP-BGP EVPN for VXLAN: L2 VNI, L3 VNI, ARP suppression
- A repeatable method: session, table, best-path, policy, RIB, FIB
- Neighbor adjacency troubleshooting
- Route advertisement troubleshooting
- Route installation troubleshooting
- Path selection troubleshooting
- Route reflector troubleshooting
- Confederation troubleshooting
- Community troubleshooting
- AS-path and regex troubleshooting
- Aggregation troubleshooting
- VPNv4 troubleshooting
- Redistribution loops between BGP and the IGP
- The debug set and conditional debugging
- Packet captures of OPEN and UPDATE messages
- Logging neighbor changes
- Reading a full-table router: memory, convergence, scale limits
- Looking glasses, RouteViews, and RIPE RIS
BGP Mastery
The end of the taught course. What remains is putting it together under exam conditions.
21 chapters · 225 topics · 0 labs