mail

Where basic BGP is about neighbors and exchanging routes, advanced BGP is about scalability and granular control. The three pillars: scaling (route reflectors, aggregation), protection (maximum prefix) and policy control (prefix-lists, route-maps, regex, communities, PBR).

1. Scaling iBGP – Route Reflectors

The challenge: split horizon & full mesh. In iBGP, a route learned from an iBGP neighbor must not be forwarded to another iBGP neighbor. Consequence: every router needs a direct session with every other router (full mesh). Sessions grow as N×(N−1)/2 – 20 routers = 190 sessions: unsustainable.

The solution – Route Reflector (RR): a router configured to bypass split horizon in a controlled way.

Loop prevention (critical): two attributes are added to reflected routes:

router bgp 65001
 neighbor 10.1.1.2 remote-as 65001
 neighbor 10.1.1.2 route-reflector-client

2. Route aggregation

Purpose: shrink the global routing table by merging many specifics (/24) into one aggregate (/16) – saves memory and CPU.

router bgp 65001
 address-family ipv4
 aggregate-address 172.16.0.0 255.255.0.0 summary-only as-set
! summary-only suppresses the specifics, as-set preserves the AS-path

3. Protection: maximum prefix

Protects the router from a misconfigured neighbor or attack sending an overwhelming number of routes (e.g. the full internet table) → memory exhaustion and crashes.

router bgp 65001
 neighbor 10.1.1.2 maximum-prefix 1000 80
! shut the session above 1000 routes, warn at 80 % (800 routes)

Result: exceeding the limit shuts the session, the neighbor goes to Idle (PfxCt). Reopening needs manual intervention or the restart parameter.

4. Filtering toolbox

IP prefix-lists (precision)

Unlike ACLs, prefix-lists match on both network and mask length. Read top-down, first match wins, implicit deny-all at the bottom.

Regular expressions (AS-path filtering)

Token Meaning Example Explanation
^ Start of string ^65001 Starts with 65001 (direct neighbor)
$ End of string 65001$ Ends with 65001 (origin)
_ Space/comma _65001_ Through 65001 (transit)
^$ Empty string ^$ Locally originated route (own AS)

5. Manipulation: route-maps & communities

Route-maps

If-then logic: a match condition plus a set action. Implicit deny-all at the end. permit 10: matches, performs the action and allows the route; deny 10: matches and drops the route (filtering).

Communities (tags)

Logically group routes across the network with a 32-bit tag, format AS:value (e.g. 65001:100).

6. Policy Based Routing (PBR)

Normal routing looks only at the destination IP; PBR routes based on the source IP. Implemented with a route-map applied on the inbound interface. Use case: send guest Wi-Fi over the cheap internet link and corporate data over the dedicated MPLS line, same destination.

Recipe: (1) create an ACL matching the source traffic, (2) route-map with match ACL + set ip next-hop, (3) enable: ip policy route-map NAME.

7. Combined scenario (best practice)

Goal: block unwanted networks, tag important routes, and never act as a transit AS.

! 1. Prefix-list filtering (deny a specific network)
ip prefix-list BLOCK_BAD seq 5 deny 10.10.10.0/24
ip prefix-list BLOCK_BAD seq 10 permit 0.0.0.0/0 le 32

! 2. AS-path list (only routes ORIGINATING at the neighbor)
ip as-path access-list 1 permit _65002$

! 3. Inbound route-map
route-map INBOUND_POLICY permit 10
 match ip address prefix-list BLOCK_BAD
 match as-path 1
 set local-preference 200
 set community 65001:99
!
route-map INBOUND_POLICY permit 20
! empty permit allows remaining traffic with defaults

! 4. Apply on the neighbor
router bgp 65001
 neighbor 10.1.1.2 remote-as 65002
 neighbor 10.1.1.2 route-map INBOUND_POLICY in
 neighbor 10.1.1.2 send-community

! 5. Aggregation with loop protection
 aggregate-address 192.168.0.0 255.255.0.0 summary-only as-set

Gotchas ⚠️

Tagged ,