# BGP Fundamentals and Route Selection

> Chapter 3 of the Courseiva CISCO-CCNP-SERVICE-PROVIDER curriculum — https://courseiva.com/learn/cisco-ccnp-service-provider/bgp-fundamentals-and-route-selection

**Official objective:** spcor-networking — Describe BGP operations, attributes, and route selection process

## Introduction

The SPCOR 350-501 exam objective 'Describe BGP operations, attributes, and route selection process' is about understanding how the internet's postal service decides where to send your data. Without BGP, the internet would be a chaotic mess of disconnected networks. Mastering this topic is essential because every service provider engineer must troubleshoot and optimise how traffic moves between networks.

## The City Delivery Network Analogy

A City Logistics Coordinator is the person responsible for making sure packages from different delivery companies get to the right neighbourhoods in a big city. This role doesn't drive a truck. Instead, they sit in a central office and study maps, traffic reports, and delivery notices from other cities. When a package arrives from another city, the coordinator decides which local delivery company should take it to the final street, based on who is closest, who has the cheapest rates, and which roads are open. The coordinator keeps a big board of all possible routes and updates it every time a road closes or a new bridge opens. Sometimes two packages are headed to slightly different parts of the same neighbourhood, and the coordinator chooses the best path for each one individually. If a package has a 'priority' sticker and a 'fragile' sticker, the coordinator picks a route that is both fast and smooth, even if it costs a bit more. The coordinator also talks to coordinators in other cities, swapping information about which roads are blocked. This whole system ensures that every package reaches its destination efficiently, even when traffic conditions change by the minute. In the same way, a BGP router collects path information from neighbouring routers and selects the best route for each data packet based on rules called attributes, ensuring data flows reliably across the global internet.

## Core explanation

BGP stands for Border Gateway Protocol. It is the postal service of the internet. When you send an email, watch a video, or load a website, your data is broken into packets and sent across multiple different networks. These networks are called Autonomous Systems (AS). An Autonomous System is a collection of routers under the control of a single organisation, like an internet service provider (ISP) or a large company. BGP is the protocol that allows these different Autonomous Systems to exchange routing information so that packets can find their way from your computer to a server on the other side of the world.

Let us start with the basics. A router is a specialised computer that forwards packets between networks. Each router has a routing table, which is like a list of directions. BGP helps build that routing table by telling a router about the paths to different destination networks. Every network on the internet has a unique identifier called an IP prefix, which is a block of IP addresses. When a BGP router learns about a new IP prefix from a neighbour, it adds that information to its BGP table, which is a more detailed list of all possible paths.

BGP has two main flavours: Internal BGP (iBGP) and External BGP (eBGP). eBGP is used between different Autonomous Systems, like two ISPs exchanging routes. iBGP is used within the same Autonomous System, to make sure all routers inside that AS have consistent routing information. This distinction is important because eBGP and iBGP have different rules about how they pass on routes.

Now, how does BGP decide which path to use when there are multiple possible routes? This is called the BGP route selection process. BGP does not just pick the shortest path in miles. Instead, it uses a list of attributes, which are like scores or properties attached to each route. The most important attribute is the Weight. Weight is a Cisco-specific attribute that is local to a single router. A higher weight makes a route more preferred. Next is Local Preference, which is a value shared across all routers in the same AS. A higher Local Preference means the route is preferred for traffic leaving the AS. After that, the router looks at whether the route was learned via eBGP or iBGP. eBGP routes are generally preferred over iBGP routes. Then comes the AS Path length. This is a list of all the AS numbers a route has passed through. A shorter AS Path is preferred. The Origin attribute tells how BGP learned about the route (IGP, EGP, or incomplete). IGP is preferred over EGP, and EGP is preferred over incomplete. Finally, the router looks at the Multi-Exit Discriminator (MED) value, which is a hint from one AS to another about which entry point to use. The lowest MED is preferred. If all these are equal, BGP falls back to tie-breaking rules like preferring the route from the router with the lowest Router ID.

Why does BGP need all these attributes? Because the internet is not a single network. It is a collection of thousands of networks with different business agreements. Some ISPs pay others for transit. Some exchange traffic for free in peering arrangements. BGP attributes allow network operators to implement these business policies. For example, an ISP might set a higher Local Preference for a route that comes through a cheaper transit provider, making that path preferred for most traffic.

BGP also uses a state machine with several states: Idle, Connect, Active, OpenSent, OpenConfirm, and Established. A BGP session goes through these states as it tries to connect to a neighbour. If the session is stuck in one state, that indicates a problem, like a misconfigured IP address or a firewall blocking the connection.

BGP replaced older protocols like EGP (Exterior Gateway Protocol) because EGP could not handle the complex topology and policy requirements of the modern internet. BGP is scalable, flexible, and supports features like route aggregation and policy-based routing, which are essential for service providers.

In summary, BGP is the protocol that makes the internet work as a single, globally connected network. It allows different organisations to exchange routing information while keeping full control over how their traffic flows.

## Real-world context

An IT professional working for a medium-sized internet service provider (ISP) uses BGP every day to manage how customer traffic reaches the wider internet. Let us walk through a typical scenario.

One morning, the network operations centre (NOC) receives an alert that some customers in London are experiencing slow internet speeds when accessing a popular video streaming service. The engineer, Sarah, begins to investigate. She logs into the main border router, which is the router that connects the ISP's network to the rest of the internet. Sarah uses a command called 'show ip bgp' to examine the BGP table for the destination IP prefix belonging to the streaming service. She sees that there are two paths to that prefix: one through a transit provider called GlobalConnect and one through a peering agreement with another ISP, RegionalNet.

Sarah checks the BGP attributes for each path. She notices that the route through GlobalConnect has a longer AS Path length (meaning it traverses more intermediate networks) and a lower Local Preference. The route through RegionalNet has a higher Local Preference because the ISP has a free peering agreement with them. Sarah suspects that the problem is with the RegionalNet peering link. She checks the interface statistics for that link and sees a high error rate. This is causing packet loss, which slows down the streaming service.

Sarah decides to temporarily change the BGP attributes to steer traffic away from the problematic link. She adjusts the Local Preference on the router so that the GlobalConnect route becomes the preferred path for this particular prefix. This is a quick fix that restores performance for customers. The next day, Sarah coordinates with the RegionalNet engineers to fix the hardware issue on the peering link. Once the link is stable, she removes her temporary configuration change, and traffic flows back to the preferred path.

Another common task is implementing a new peering agreement. When the ISP signs a peering agreement with a content delivery network (CDN), like a video streaming site, the engineer must configure BGP to accept the CDN's routes and advertise the ISP's customer routes to the CDN. This involves configuring a BGP session with the CDN's router, setting the correct AS number, and applying route maps to filter which prefixes are exchanged. A route map is a set of rules that match certain prefixes and then change their attributes. For example, the engineer might set a MED value on routes sent to the CDN to indicate which of the ISP's multiple connection points is preferred.

Real-world BGP work also involves troubleshooting. Common problems include:
- A BGP session that fails to establish (stuck in Active state).
- Routes that are not being advertised due to filtering.
- Suboptimal routing due to incorrect attribute settings.
- BGP table size causing high CPU usage on routers.

The engineer uses tools like ping, traceroute, and BGP-specific commands to diagnose these issues. They also use network monitoring systems that alert them when BGP session state changes. Understanding BGP fundamentals is crucial because a misconfiguration can affect thousands of customers or even cause a global internet outage.

## Exam focus

The 350-501 exam tests BGP Fundamentals and Route Selection in several specific ways. First, you must memorise the order of BGP path selection. Cisco's official list of steps is exactly what appears on the exam. The order is:

- Weight (highest preferred)
- Local Preference (highest preferred)
- Originate locally (prefer locally originated routes)
- AS Path length (shortest preferred)
- Origin type (IGP preferred over EGP, EGP preferred over incomplete)
- Multi-Exit Discriminator (MED) (lowest preferred)
- eBGP over iBGP
- IGP metric to the next hop
- Router ID (lowest preferred)

The exam loves to test your knowledge of which attribute is considered first. A common question asks: 'Which BGP attribute is evaluated first in the route selection process?' The answer is Weight. Another trap is that some attributes are not always compared. For example, MED is only compared between routes from the same neighbouring AS. The exam will present a scenario where two routes have identical AS Path length but different MED values from different ASes. The correct answer is that MED is not compared because the AS Path is different.

Next, the exam tests your understanding of BGP states. You need to know the six states (Idle, Connect, Active, OpenSent, OpenConfirm, Established) and what causes a session to be stuck in each state. A classic trap is that when a router cannot reach its neighbour, the session flips between Connect and Active. The exam may show you a show command output and ask which state the session is in.

The exam also covers BGP message types. There are four messages: OPEN, KEEPALIVE, UPDATE, and NOTIFICATION. OPEN is sent when a session is first established. KEEPALIVE is sent periodically to keep the session alive. UPDATE carries routing information (prefixes and attributes). NOTIFICATION indicates an error. Questions may ask which message is used to withdraw a route (UPDATE).

Another key area is BGP attributes. You must know which attributes are well-known mandatory, well-known discretionary, optional transitive, and optional non-transitive. For example, AS Path and Next Hop are well-known mandatory. Local Preference is well-known discretionary. MED is optional non-transitive. The exam tests whether MED is passed to other ASes (it is not, because it is non-transitive).

Finally, the exam tests BGP scalability features like route reflectors and confederations. You need to know that a route reflector reduces the number of iBGP sessions required in a network. A common question asks: 'What is the purpose of a route reflector in BGP?' The answer is to reduce the number of iBGP peering sessions.

Common traps include confusing weight and local preference (weight is local to a router, local preference is shared across an AS). Also, beginners often think that the AS Path is the most important attribute, but it comes after weight and local preference. Study the full list until you can recite it in your sleep.

## Step by step

1. **Establish BGP Session** — Two routers configure a BGP neighbour relationship using the 'neighbor' command. The routers send OPEN messages to agree on parameters like the AS number and hold time. This step creates a TCP connection on port 179.
2. **Exchange Routes with UPDATE Messages** — Once the session is established, routers send UPDATE messages containing IP prefixes and their associated attributes like AS Path and Next Hop. This step populates the BGP table with reachable destinations.
3. **Apply inbound Route Maps** — Before routes are installed into the BGP table, inbound route maps can modify attributes or filter out specific prefixes. For example, a route map might set a higher Local Preference on routes from a preferred peer.
4. **Run Path Selection Algorithm** — When multiple routes exist for the same prefix, the router compares attributes in the defined order (Weight, Local Preference, etc.) to select the best route. The best route is installed in the routing table.
5. **Advertise Best Routes to Neighbours** — The router sends only its best routes to eBGP neighbours, following rules that prevent loops (like not advertising routes back to the AS from which they were learned). This step ensures global reachability.
6. **Maintain Session with KEEPALIVE Messages** — Routers periodically exchange KEEPALIVE messages to confirm the session is still healthy. If keepalives stop arriving within the hold time, the session is torn down and routes from that neighbour are removed.

## Comparisons

### eBGP (External BGP) vs iBGP (Internal BGP)

**eBGP (External BGP):**
- Runs between different Autonomous Systems (AS)
- Requires the neighbour to be directly connected unless using multihop
- Best path selection prefers eBGP routes over iBGP routes

**iBGP (Internal BGP):**
- Runs within the same Autonomous System
- Requires a full mesh or route reflector to propagate routes
- Routes learned via iBGP are not re-advertised to other iBGP peers by default

### Weight (Cisco Proprietary) vs Local Preference

**Weight (Cisco Proprietary):**
- Local to a single router, not advertised to neighbours
- Range is 0 to 65535; higher value is preferred
- First attribute checked in the route selection process

**Local Preference:**
- Shared across all routers in the same AS via iBGP
- Range is 0 to 4294967295; higher value is preferred
- Second attribute checked, after weight

### AS Path Attribute vs MED (Multi-Exit Discriminator)

**AS Path Attribute:**
- A well-known mandatory attribute included in every UPDATE
- Shorter path is preferred
- Used to prevent routing loops by detecting its own AS number

**MED (Multi-Exit Discriminator):**
- An optional non-transitive attribute not passed to other ASes
- Lower value is preferred
- Compared only when routes come from the same neighbouring AS

## Diagram

_BGP neighbours across different Autonomous Systems and within the same AS._

```mermaid
flowchart TD
    A[Router A AS100] -- eBGP --> B[Router B AS200]
    B -- iBGP --> C[Router C AS200]
    B -- iBGP --> D[Router D AS200]
    C -- eBGP --> E[Router E AS300]
    D -- eBGP --> F[Router F AS400]
    E -- iBGP --> G[Router G AS300]
    F -- iBGP --> H[Router H AS400]
```

## Common misconceptions

- **Misconception:** BGP always picks the shortest physical path. **Reality:** BGP picks the path based on a series of attributes, not physical distance. A longer path in miles can be preferred if it has a higher weight or local preference. (People naturally assume shortest distance means fastest route, but BGP is designed to enforce business policies, not minimise travel distance.)
- **Misconception:** The AS Path attribute is the most important factor in BGP route selection. **Reality:** Weight and Local Preference are evaluated before AS Path. AS Path is only considered third in the order of operations. (Beginners see 'path selection' and assume the path itself is the top priority, but Cisco's design puts local policy attributes first.)
- **Misconception:** BGP is used only by huge internet service providers, not small companies. **Reality:** Small companies with multiple internet connections also use BGP to load balance traffic and provide failover. Any organisation with a public AS number can use BGP. (The protocol's complexity intimidates beginners, so they think it is reserved for large telcos, but many mid-sized businesses use it for multi-homing.)
- **Misconception:** Once a BGP session is established, it stays up forever until someone shuts it down. **Reality:** BGP sessions can go down due to network failures, misconfigured filters, or keepalive timeouts. Routers constantly monitor session health. (New learners think of BGP as static, but it has timers and state machines that actively manage session stability.)
- **Misconception:** MED is compared across all routes regardless of which AS they came from. **Reality:** MED is only compared between routes that come from the same neighbouring AS. MED from different ASes are not comparable. (The acronym 'Multi-Exit Discriminator' hints at comparing multiple entry points from the same neighbour, but beginners miss the 'same AS' rule.)

## Key takeaways

- BGP is the routing protocol that exchanges network reachability information between different Autonomous Systems on the internet.
- The BGP route selection process evaluates attributes in a strict order, starting with highest Weight and then highest Local Preference.
- Weight is a Cisco-specific attribute that is local to a single router and is the first tie-breaker in path selection.
- Local Preference is used to influence outbound traffic from an entire Autonomous System and is shared via iBGP.
- AS Path length is the number of Autonomous Systems a route has passed through; shorter paths are preferred but only after Weight and Local Preference.
- MED (Multi-Exit Discriminator) is a hint to an external AS about which link to use for inbound traffic, and it is only compared if the routes come from the same neighbouring AS.
- BGP uses four message types: OPEN, KEEPALIVE, UPDATE, and NOTIFICATION for establishing and maintaining connections.
- A BGP session goes through six states: Idle, Connect, Active, OpenSent, OpenConfirm, and Established.

## FAQ

**What is the difference between iBGP and eBGP?**

eBGP runs between different Autonomous Systems (e.g., your ISP and another ISP), while iBGP runs within the same AS. eBGP routes have a shorter hop count and are preferred over iBGP routes in path selection.

**Why does BGP use TCP port 179?**

BGP uses TCP for reliable transport, ensuring that routing information is delivered without errors. The well-known port 179 is used by routers to establish and maintain BGP sessions.

**What happens if a BGP session goes down?**

When a BGP session goes down, all routes learned from that neighbour are removed from the BGP table. The router may then select alternative paths or lose reachability to certain prefixes.

**What is a route reflector in BGP?**

A route reflector is a router that can advertise iBGP learned routes to other iBGP neighbours, reducing the number of required iBGP sessions in a full mesh design. It helps scalability in large networks.

**How do I check the BGP table on a Cisco router?**

Use the command 'show ip bgp' to view the BGP table. For more details about a specific prefix, use 'show ip bgp <prefix>'. These commands show attributes and the best path.

**What is the 'next hop' attribute in BGP?**

The Next Hop attribute tells a router the IP address to which packets should be forwarded to reach a particular prefix. For eBGP, the next hop is usually the IP of the neighbour router.

## Check your understanding

1. **Which BGP attribute is checked first in the route selection process?**

   Answer: Weight. A higher weight is preferred over a lower weight.

2. **What does the MED attribute influence?**

   Answer: MED influences inbound traffic by telling an external AS which entry point to prefer; lower MED is better but only compared between routes from the same AS.

3. **How are eBGP routes preferred over iBGP routes?**

   Answer: In the route selection process, after comparing AS Path length, origin, and MED, eBGP routes are preferred over iBGP routes.

4. **What is the purpose of the BGP KEEPALIVE message?**

   Answer: The KEEPALIVE message is sent periodically to maintain the BGP session and ensure the neighbour is still reachable.

5. **Why is a full mesh of iBGP sessions required within an AS?**

   Answer: A full mesh ensures that all routers in the AS learn all iBGP routes, because iBGP routes are not re-advertised to other iBGP peers by default (split horizon rule).

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/cisco-ccnp-service-provider/bgp-fundamentals-and-route-selection