# BGP Basics and Neighbor Relationships

> Chapter 7 of the Courseiva ENARSI curriculum — https://courseiva.com/learn/enarsi/bgp-basics-and-neighbor-relationships

**Official objective:** 3.6 — Configure and verify BGP neighbor relationships and basic operation

## Introduction

How do you make two routers from different companies or different parts of the internet talk to each other as if they are trusted neighbours? That is the problem BGP neighbour relationships solve, and it matters deeply for the 300-410 exam because without functioning neighbour relationships, no routing updates can flow and your entire enterprise network goes silent.

## The Airport Customs and Immigration Desk Analogy

The airport customs and immigration desk is the exact place where a traveller from one country formally announces their arrival and establishes a relationship with the host nation. 

 Every autonomous system on the internet, just like every country, operates under its own set of internal rules. When a packet of data needs to travel from one autonomous system to another, it cannot just wander over the border. It must be announced and accepted through a formal process, exactly like a traveller presenting a passport at immigration. The Border Gateway Protocol, or BGP, is that customs and immigration official. 

 The BGP neighbour relationship begins when two routers, each sitting at the edge of their own autonomous system, decide to talk to each other. They open a TCP connection on port 179 — think of this as the traveller walking up to the immigration window. They exchange OPEN messages, which contain their AS numbers (their country of origin) and other capabilities. If both sides agree on the basic parameters, they send a KEEPALIVE message, which is the immigration officer’s stamp that says “Welcome, you are now a recognised neighbour.” From that moment, they can exchange routing information, like a traveller telling the customs officer where they plan to go and what they are carrying. If at any point the traveller stops responding, the officer closes the window—the BGP session is torn down until the traveller tries again.

## Core explanation

BGP stands for Border Gateway Protocol. It is the protocol that makes the internet work by allowing networks — called autonomous systems (AS) — to exchange routing information. An autonomous system is a collection of routers under a single administrative control, like your company’s entire internal network. Each AS gets a unique number, an AS number (ASN), which identifies it to the outside world. 

 Before two BGP routers can exchange any routing information, they must first become neighbours. This is also called forming a BGP peer relationship. The two routers establish a TCP connection on port 179. TCP (Transmission Control Protocol) is a reliable, connection-oriented protocol — it ensures that every message sent is received and acknowledged. This is a fundamental difference from many other routing protocols, which use UDP or their own transport. BGP is built on TCP, making it reliable by design. 

 The process of forming a neighbour relationship has four states that matter for the exam: Idle, Connect, OpenSent, and OpenConfirm. 

 - Idle: The router is doing nothing. It refuses all incoming BGP connections. This is the starting state. 
 - Connect: The router is actively trying to open a TCP connection to the neighbour. If it succeeds, it moves to OpenSent. If it fails, it goes to Active. 
 - OpenSent: The router has sent an OPEN message and is waiting for an OPEN message from the neighbour. The OPEN message contains the AS number, the BGP version, the router ID, and hold time. 
 - OpenConfirm: The router has received a valid OPEN message and has sent a KEEPALIVE message. It now waits for a KEEPALIVE from the neighbour. 
 - Established: Both sides have sent and received KEEPALIVE messages. The BGP session is up, and the neighbours can now exchange UPDATE messages containing routing information. 

 For a BGP neighbour relationship to become Established, several conditions must match exactly. The most common reason for failure is a mismatch in the AS number. If your router is configured with AS 65001 and the neighbour router is configured with AS 65002, they will both send OPEN messages, see the mismatch, and send a NOTIFICATION message to tear down the session. They go back to Idle. 

 Another critical parameter is the router ID. The BGP router ID is a 32-bit number, usually the highest loopback IP address, that uniquely identifies the router within the AS. If two routers in the same AS have the same router ID, BGP will not establish a neighbour relationship. It will log an error. 

 The hold time is also important. Each router advertises a hold time in its OPEN message. The actual hold time used for the session is the smaller of the two advertised values. If no KEEPALIVE or UPDATE message is received within the hold time, the session is considered dead, and BGP tears down the session. This is how BGP detects that a neighbour has gone offline. 

 BGP neighbour relationships can be either internal (iBGP) or external (eBGP). eBGP is used between different autonomous systems — think of it as international diplomacy. iBGP is used within the same autonomous system — think of it as internal state government communication. The key difference is the behaviour of the next-hop attribute and the administrative distance. For eBGP, the administrative distance is 20; for iBGP, it is 200. This means the router prefers eBGP routes over iBGP routes when both are available. 

 To configure a BGP neighbour on a Cisco router, you use the `neighbor` command under the BGP router configuration mode. For example: `neighbor 10.1.1.2 remote-as 65002`. This tells the router to try to form a BGP session with the router at IP address 10.1.1.2, and this neighbour belongs to AS 65002. If you omit the `remote-as` or type the wrong AS number, the session will never come up. 

 Verification is done using `show ip bgp summary` and `show ip bgp neighbors`. `show ip bgp summary` gives you a quick overview: the neighbour IP, the AS number, the number of messages received and sent, the uptime of the session, and the state. If the state says "Idle" or "Active", something is wrong. `show ip bgp neighbors` gives you detailed information, including the hold timer, keepalive timer, and the exact reason for any session flaps.

## Real-world context

Consider a medium-sized company with two offices: one in London and one in New York. Each office has its own internet connection from a different internet service provider (ISP). The London office uses ISP A with AS 65001, and the New York office uses ISP B with AS 65002. The company wants to ensure that if one internet link goes down, traffic can still flow via the other link. 

 The network engineer in London configures a BGP session between the company’s router and ISP A’s router. The engineer assigns the company’s router the AS number 65100 (a private AS number used for internal organisation). The ISP A router has AS 65001. The engineer enters the configuration: `neighbor 192.0.2.1 remote-as 65001`. The engineer also configures the neighbour on the New York side with ISP B: `neighbor 198.51.100.1 remote-as 65002`. 

 Now the engineer must also ensure the two company routers in London and New York can talk to each other. They are in the same company (same AS 65100), so they need an iBGP session between them. The engineer configures `neighbor 10.0.0.2 remote-as 65100` on the London router, pointing to the New York router’s loopback IP address. 

 The engineer then runs `show ip bgp summary` to check the neighbour states. Immediately, the London-to-ISP-A session shows "Active". The engineer checks the firewall — port 179 (TCP) is blocked. After opening the port, the session goes to "Established". Now the London router learns the routes to the internet from ISP A. It also learns routes from the New York router via iBGP, but those routes still have the next-hop set to the ISP B router, which is not directly connected. This is called the next-hop reachability problem, common in iBGP. The engineer must configure `neighbor 10.0.0.2 next-hop-self` on the London router, which tells BGP to change the next-hop to the London router’s own IP when advertising routes to the New York router. 

 The engineer also monitors the session hold timers. The default hold time is 180 seconds, with keepalive messages sent every 60 seconds. If the engineer notices that the session drops every few hours, they check `show ip bgp neighbors` for the "BGP state transitions" counter. A high number of transitions indicates an unstable session, often caused by a flapping link or mismatched hold times. The engineer can increase the hold time to 300 seconds and the keepalive interval to 100 seconds using `neighbor 10.0.0.2 timers 100 300`. 

 After two days, the ISP B link in New York fails. The iBGP session between London and New York detects the failure because the hold timer expires without receiving a KEEPALIVE. The London router withdraws the routes learned from New York. Traffic that was flowing through the New York link now automatically uses the London link because BGP has converged. This is the value of BGP neighbour relationships in a real, multi-homed enterprise network.

## Exam focus

The 300-410 exam tests BGP neighbour relationships heavily. Expect at least 3-5 questions on this topic alone. The examiners love to test the BGP states and what causes transitions between them. Specifically, they test the difference between Idle and Active states. If the router is persistently in the Active state, it means it is trying to open a TCP connection but failing (usually because the neighbour is unreachable or a firewall is blocking port 179). If the router is stuck in Idle, it usually means the neighbour configuration is missing or the router has no route to the neighbour. 

 - Trap pattern 1: They give you a show command output that shows the BGP state as "Idle (No Route)". The correct answer is that the router does not have an IP route to the neighbour's IP address. 
 - Trap pattern 2: They ask what happens when the hold time expires. The session is torn down with a NOTIFICATION message, not just a silent drop. 
 - Trap pattern 3: They test the default administrative distance for eBGP (20) and iBGP (200). If a question gives you two routes to the same destination, one from eBGP and one from iBGP, the eBGP route wins. 
 - Trap pattern 4: They ask what causes a BGP session to reset. Options include configuration changes like changing the remote-as, the router ID, or the update source. Any of these triggers a session reset. 
 - Trap pattern 5: They test the `neighbor update-source` command. If you are peering using a loopback interface, you must set the update-source to that loopback. Otherwise, the router uses the outgoing interface IP, which can cause session failure on multi-homed routers. 

 Key definitions to memorise for the exam: 
 - BGP state Idle: initial state, no connection attempt. 
 - BGP state Connect: TCP handshake in progress. 
 - BGP state Active: TCP handshake failed, router is listening for the neighbour to initiate. 
 - BGP state OpenSent: OPEN message sent, waiting for reply. 
 - BGP state OpenConfirm: OPEN received, KEEPALIVE sent, waiting for KEEPALIVE. 
 - BGP state Established: fully operational session. 
 - eBGP admin distance: 20. 
 - iBGP admin distance: 200. 
 - BGP port: 179 (TCP). 
 - Hold time default: 180 seconds. 
 - Keepalive time default: 60 seconds. 

 The exam also tests that BGP neighbour relationships must be explicitly configured — there is no auto-discovery like in OSPF or EIGRP. Every neighbour must be manually declared with the `neighbor` command. This is a common point of confusion because candidates assume BGP works like interior gateway protocols.

## Step by step

1. **Configure the BGP router process** — Enter global configuration mode and type `router bgp <AS-number>` to start the BGP process. This defines the autonomous system to which this router belongs. Without this, no neighbour relationships can be formed.
2. **Define the BGP neighbour** — Use `neighbor <IP-address> remote-as <AS-number>` to specify the peer router. The IP address is the interface used to reach the peer, and the remote-as is the AS number of that peer. If the remote-as is the same as the router's own AS, it becomes an iBGP session; if different, it is eBGP.
3. **Specify the update source (optional but critical for iBGP)** — Use `neighbor <IP-address> update-source <interface>` to set the source IP for the TCP connection. This is essential when peering across multiple hops using a loopback interface, as it ensures the session stays up even if a physical interface goes down.
4. **Verify the neighbour state** — Run `show ip bgp summary` to see the state of each neighbour. Look for the 'State/PfxRcd' column. An 'Established' state with a number in the PfxRcd column means the session is up and routes have been received. 'Idle' or 'Active' indicate problems.
5. **Troubleshoot a flapping session** — Use `show ip bgp neighbors <IP-address>` to view detailed session information. Check the 'BGP state transitions' counter. If it is high, examine the hold timer, keepalive timer, and the 'Last reset' reason. Common fixes include adjusting timers with `neighbor <IP-address> timers <keepalive> <hold>` or checking firewall rules for port 179.
6. **Advertise a network into BGP** — Use `network <network-number> mask <subnet-mask>` under the BGP router configuration to inject a route. The network must exist in the routing table, or BGP will not advertise it. This step is necessary so the neighbour can learn about your routes.

## Comparisons

### eBGP vs iBGP

**eBGP:**
- Used between different autonomous systems
- Administrative distance is 20
- Default next-hop is the neighbour's interface IP

**iBGP:**
- Used within the same autonomous system
- Administrative distance is 200
- Requires full mesh or route reflectors to avoid loops

### BGP Idle State vs BGP Active State

**BGP Idle State:**
- Router is not attempting any connection
- Often caused by missing neighbour configuration
- No TCP packets are sent

**BGP Active State:**
- Router has tried and failed to connect
- Router is listening for incoming connection from neighbour
- Indicates a TCP connectivity problem

### BGP OPEN Message vs BGP KEEPALIVE Message

**BGP OPEN Message:**
- Sent once at session start
- Contains AS number, hold time, router ID
- Required to negotiate session parameters

**BGP KEEPALIVE Message:**
- Sent periodically after session is established
- Does not contain routing data
- Used to verify the neighbour is still alive

### Static Routing vs BGP Dynamic Routing

**Static Routing:**
- Manually configured routes by an administrator
- Does not adapt to network changes automatically
- Suitable for small, simple networks

**BGP Dynamic Routing:**
- Automatically learns routes from neighbours
- Adapts to link failures and topology changes
- Suitable for large or complex networks like the internet

## Diagram

_This flowchart shows the five BGP states a router goes through when establishing a neighbour relationship with another router in a different autonomous system._

```mermaid
flowchart TD
    A[Router1 AS 65001] -->|TCP Port 179| B[Router2 AS 65002]
    A --> C[Idle State]
    C -->|TCP SYN| D[Connect State]
    D -->|TCP SYN-ACK| E[OpenSent State]
    E -->|OPEN msg| F[OpenConfirm State]
    F -->|KEEPALIVE msg| G[Established State]
    G -->|UPDATE msg| H[Route Exchange]
```

## Common misconceptions

- **Misconception:** BGP neighbours are discovered automatically like OSPF neighbours. **Reality:** BGP neighbours must be explicitly configured using the neighbor command. There is no hello multicast or autodiscovery. (Candidates often confuse BGP with interior gateway protocols (IGPs) like OSPF and EIGRP, which automatically discover neighbours through hello packets.)
- **Misconception:** The BGP hold time must match exactly on both sides for the session to form. **Reality:** The hold time is negotiated; the smaller of the two advertised hold times is used. The session will form even if the hold times differ. (Candidates read that many BGP parameters (like AS number) must match exactly, and incorrectly assume the same for the hold time.)
- **Misconception:** iBGP requires all routers to be directly connected to form a neighbour relationship. **Reality:** iBGP neighbours do not need to be directly connected. They can be multiple hops away, but you must ensure the TCP connection is reachable (often using a loopback interface). (People think of eBGP where single-hop connections are typical, and incorrectly apply that logic to iBGP.)
- **Misconception:** Once a BGP session is in the 'Established' state, it will stay up forever unless the link goes down. **Reality:** The session will also be torn down if a configuration change (like changing the remote-as or router ID) is applied, or if the hold timer expires due to missing keepalives. (Candidates forget that BGP reacts to configuration changes immediately, unlike some other protocols that can do graceful restart.)
- **Misconception:** BGP uses UDP for transport because it is faster. **Reality:** BGP uses TCP port 179 for reliable delivery of messages. This ensures that routing updates are not lost. (Many routing protocols use UDP or IP directly, so beginners assume BGP does the same for performance reasons.)

## Key takeaways

- BGP neighbour relationships must be manually configured with the neighbor command; there is no automatic discovery.
- The BGP session establishment process follows the states: Idle, Connect, OpenSent, OpenConfirm, and Established.
- The hold time is negotiated to the smaller of the two advertised values; it does not need to be identical.
- eBGP uses an administrative distance of 20, making it more preferred than iBGP (which is 200) for the same route.
- BGP uses TCP port 179, not UDP, for reliable transmission of messages.
- A BGP session will reset if any mandatory configuration parameter (AS number, router ID, update-source) is changed.
- Stuck in Active state usually indicates a TCP connectivity issue, such as a firewall blocking port 179.
- iBGP peers do not need to be directly connected, but they must have IP reachability, often via loopback interfaces.

## FAQ

**Why is my BGP neighbour stuck in the Active state?**

The router is trying to open a TCP connection but cannot reach the neighbour. Check IP connectivity, ensure port 179 is not blocked by a firewall, and verify that the neighbour IP is correct and reachable.

**Do I need to configure both sides of a BGP neighbour relationship?**

Yes, BGP neighbour relationships are unidirectional by configuration. Both routers must have a neighbor statement pointing to each other for the session to establish.

**What is the difference between iBGP and eBGP under 300-410?**

eBGP runs between different autonomous systems and has an administrative distance of 20. iBGP runs within the same AS and has an administrative distance of 200. iBGP also requires a full mesh or route reflectors to avoid loops.

**Can I form a BGP neighbour relationship across the internet?**

Yes, eBGP sessions commonly run across the internet, but you must ensure the neighbour IP is reachable through the public internet and that firewalls permit TCP port 179.

**What happens if I change the remote-as on an existing neighbour?**

The BGP session will immediately reset. The router will tear down the session with a NOTIFICATION message and attempt to re-establish with the new AS number.

**How do I check the BGP session uptime?**

Use the `show ip bgp summary` command. The Uptime column shows how long the session has been in the Established state. A zero or very low value indicates the session recently reset.

**Why does my BGP session keep flapping?**

Common causes include mismatched hold timers, unstable physical links, firewall rules dropping keepalive packets, or route flapping in the network. Check the 'Last reset' reason in `show ip bgp neighbors`.

## Check your understanding

1. **What is the default BGP hold time in seconds?**

   Answer: The default BGP hold time is 180 seconds.

2. **Which TCP port does BGP use to establish neighbour relationships?**

   Answer: BGP uses TCP port 179.

3. **What is the administrative distance of eBGP routes?**

   Answer: The administrative distance of eBGP routes is 20.

4. **What command shows the state of all BGP neighbours?**

   Answer: The command `show ip bgp summary` shows the state of all BGP neighbours.

5. **What state does a BGP session enter when the router cannot reach the neighbour to start a TCP connection?**

   Answer: The session enters the Active state, indicating the router is listening and waiting for the neighbour to initiate the connection.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/enarsi/bgp-basics-and-neighbor-relationships