Advanced BGP is three things: scale, protect, control.

Scaling iBGP — Route Reflectors

iBGP split horizon forces a full mesh (N·(N−1)/2 sessions). A Route Reflector breaks the rule deliberately: neighbor x route-reflector-client. Loop safety comes from two extra attributes: Originator_ID and Cluster_List.

Protection — maximum-prefix

neighbor 10.1.1.2 maximum-prefix 1000 80

Warns at 80 %, shuts the session (Idle, PfxCt) beyond it — protection against a neighbor dumping the full table.

Control — the toolkit

• Prefix-lists: match network and mask length; 0.0.0.0/0 le 32 = everything; implicit deny at the end.
• AS-path regex: ^65001 direct neighbour, 65001$ originator, _65001_ transit, ^$ locally originated.
• Communities: tag routes (65001:100); No_Export / No_Advertise; remember send-community is not on by default.
• Route-maps: if/then with implicit deny-all at the end; case-sensitive names.

Don’t transit the internet

Without filters (e.g. only advertise what matches ^$ outbound), your AS becomes transit for someone else’s traffic. Soft re-apply filter changes with clear ip bgp * soft in.