# BGP Route Selection and Policy

> Chapter 8 of the Courseiva ENARSI curriculum — https://courseiva.com/learn/enarsi/bgp-route-selection-and-policy

**Official objective:** 3.7 — Configure and verify BGP path selection and route policies

## Introduction

Exam objective 3.7 — Configure and verify BGP path selection and route policies — is one of the most heavily tested areas in the 300-410 exam, and it solves a fundamental problem: how does the internet decide which path millions of data packets should take when there are dozens of possible routes? Without a strict decision process, your YouTube video might reroute through a slow satellite link, or a bank transfer could vanish into a routing loop. This chapter will arm you with the exact decision tree that every BGP-speaking router uses, so you can predict, control, and troubleshoot how traffic flows across an enterprise network.

## The Airport Hub-and-Spoke Analogy

Have you ever booked a flight that takes you from London to New York via a layover in Reykjavik, only to wonder why it takes that route instead of a direct one? The answer lies in how airlines decide which path your journey takes, and the same logic drives BGP route selection. Imagine you are a postcard travelling through a global postal system. Each postcard has a final destination, but the postal workers at every sorting office must choose which truck or plane to put it on next. They do not just pick randomly. They consult a rulebook that lists criteria: first, prefer a route that is 'internal' to your own country's postal service over an 'external' one from a partner service. Second, prefer the shortest path through sorting offices. Third, prefer a route from the most trusted postal partner. Fourth, if two routes are equal, flip a coin using a tie-breaker like the oldest established route. In BGP, each router is that postal worker, the rulebook is the BGP path selection algorithm, and the postcard is a data packet. The algorithm has a strict order of checks, from the highest priority (like preferring your own company's path) down to tie-breakers (like choosing the route learned first). This prevents chaos and ensures data finds the most efficient, policy-compliant path across the internet, just as your luggage eventually finds its way to the correct baggage carousel.

## Core explanation

BGP, which stands for Border Gateway Protocol, is the postal service of the internet. It is the protocol that networks use to exchange information about how to reach destinations. When you visit a website, your request travels across multiple networks (often owned by different companies like ISPs or cloud providers). Each network has a router that speaks BGP, and those routers tell each other, 'I know how to get to 1.2.3.0/24 (a block of IP addresses), and here is my route to it.' But when a router hears multiple routes to the same destination from different neighbours, it must pick one. That is where the BGP path selection algorithm comes in.

The algorithm is a list of checks performed in a strict order. Once a check eliminates all but one route, that route is chosen and the remaining checks are skipped. The full list has over a dozen steps, but for the 300-410 exam, you need to memorise the top ten. Let us break them down.

First, the router will always prefer a path with the highest Weight. Weight is a Cisco proprietary attribute — meaning it only works on Cisco routers — and it is local to that router. You set it to tell the router, 'I trust this path more than any other.' It is checked first, so a high Weight overrides everything else.

If Weight is equal, the router moves to Local Preference. This is the second priority. Local Preference is a value you set on routes that enter your AS (Autonomous System — your network, which is a single organisation's collection of routers under one administrative control). It influences how traffic leaves your network towards the outside world. A higher Local Preference means that route is more attractive for outbound traffic.

Third, the router prefers a route that it originated itself (via a network statement or redistribution) over routes learned from neighbours. This ensures that a router always trusts its own local routes most.

Fourth, it prefers routes with a shorter AS Path length. The AS Path is a list of all the Autonomous Systems a route has passed through. A shorter path means fewer hops between organisations, which usually means a faster, more reliable route.

Fifth, it checks the Origin code. There are three types: IGP (i) means the route was originated inside the AS via a BGP network statement, EGP (e) is a legacy method, and Incomplete (?) means the route was redistributed from another protocol. BGP prefers IGP over EGP, and EGP over Incomplete.

Sixth, the router prefers a route with a lower Multi-Exit Discriminator (MED). MED is a hint sent from one AS to another saying, 'I prefer you enter my network through this particular link.' A lower MED is better.

Seventh, it prefers eBGP (external BGP, routes learned from a different AS) over iBGP (internal BGP, routes learned from within the same AS). This is because eBGP routes are typically more direct.

Eighth, it prefers the route with the lowest IGP metric to the next-hop IP address. The next hop is the IP address of the next router the traffic should be sent to. If you have two routes with the same next hop, the router picks the one that is closer (in terms of interior routing protocol cost) to that next hop.

Ninth, if all else is equal, the router prefers the route that was learned first (the oldest route). This is a tie-breaker that provides stability — it does not flap between equal paths.

Tenth, and finally, it prefers a route from the neighbour with the lowest Router ID (a unique number identifying the BGP speaker). This is the ultimate tie-breaker.

These ten steps are the core of BGP route selection. However, the exciting part is that you can manipulate these steps using route policies. A route policy is a set of rules that change BGP attributes (like Weight, Local Preference, or MED) before a route is considered or advertised. For example, you might write a route-map (a Cisco tool for conditional policy application) that sets a high Local Preference for routes coming from a preferred business partner, ensuring traffic always uses that link unless it is down. You can also filter routes using prefix-lists or AS-path access-lists to deny certain routes entirely.

Why does this matter? In real networks, you often have multiple connections to the internet (multihoming). Without BGP path selection and policy, traffic might use your expensive satellite link instead of your cheap fibre link. By understanding and configuring the algorithm, you control how traffic flows, save money, and ensure reliability.

## Real-world context

Picture yourself as a network engineer at a mid-sized company called 'Acme Corp' with offices in London, Manchester, and Birmingham. Acme Corp has two internet connections: one from a premium ISP called FastNet (costing £5,000 per month) and one from a budget ISP called CheapNet (costing £500 per month). Both ISPs provide a full BGP feed — meaning they advertise all internet routes to Acme's router. Additionally, Acme has a VPN connection to a cloud provider like AWS for hosting their customer-facing application. Your job is to ensure that:

- All outbound traffic from Acme's employees to the internet uses the CheapNet link because it is cheaper.
- All inbound traffic from the internet to Acme's public web servers (hosted on-premises) uses the FastNet link because it has better latency.
- Traffic to AWS should always use the VPN (which is more secure) instead of going over the public internet.

Step by step, you would:

1. Configure a route-map on Acme's router to set a lower Local Preference (say 50) for all routes learned from CheapNet, and a higher Local Preference (say 150) for routes learned from FastNet. Since BGP prefers higher Local Preference, outbound traffic will naturally use FastNet. But wait — the requirement is opposite: we want outbound traffic to use CheapNet. So you flip it: set higher Local Preference on CheapNet routes. This ensures that when employees access a website, the router picks the route from CheapNet.

2. For inbound traffic, you control which path external users take to reach Acme's public IPs. You do this by manipulating the AS Path length. You can configure your router to prepend your AS number multiple times when advertising routes to FastNet, making the AS Path appear longer to external routers. For example, instead of advertising 'AS 65000', you advertise 'AS 65000 65000 65000'. BGP prefers shorter AS Paths, so external routers will prefer the route via CheapNet (which you did not prepend). But the requirement is to use FastNet for inbound traffic. So you prepend on the CheapNet advertisements instead, making CheapNet look further away.

3. For the AWS traffic, you configure a prefix-list that matches the AWS IP ranges. You then create a route-map that sets a very high Local Preference (e.g., 200) for routes learned from the VPN neighbour. Since Local Preference is checked early, all traffic to AWS will go through the VPN, even if an internet route also exists.

4. Verify your policies by using 'show ip bgp' commands to inspect the BGP table, checking that the selected route has the correct attributes. You also use 'traceroute' from an employee's machine to a test IP to confirm the path.

This is a routine task for enterprise network engineers. It saves money, improves performance, and ensures security. The 300-410 exam tests your ability to design and troubleshoot these exact scenarios, often in multiple-choice or simulation formats where you must identify why a policy is not working.

## Exam focus

The 300-410 ENARSI exam devotes significant weight to BGP path selection and policy. Based on the official exam blueprint and common patterns, here is what you must master.

First, the order of the BGP path selection algorithm is everything. Cisco expects you to know the top eight criteria in exact sequence: Weight, Local Preference, Originate, AS Path, Origin, MED, eBGP over iBGP, and IGP metric to next hop. You will get questions like, 'Which attribute is checked first?' or 'Which attribute overrides all others?' The trap is that they often list an attribute in the wrong order in a multiple-choice question. For example, they might offer 'Local Preference' as a higher priority than 'Weight'. You must know that Weight is Cisco-proprietary and checked first.

Second, they love testing the concept of 'AS Path prepending' and 'MED'. A typical question: 'An engineer wants to influence inbound traffic to prefer Link A over Link B. Which two actions could achieve this?' The correct answers are 'Prepend the AS path on routes advertised out of Link B' or 'Set a higher MED on routes advertised out of Link B'. They will include traps like 'Set a higher Local Preference' (which affects outbound, not inbound) or 'Increase the IGP metric' (which affects route selection but not BGP decisions directly).

Third, route maps and prefix lists are heavily tested. Questions will show you a partial configuration of a route-map and ask what effect it has. Common traps: a route-map without a 'permit' or 'deny' statement defaults to 'deny'. A prefix-list with a 'ge' (greater-than-or-equal) or 'le' (less-than-or-equal) modifier can filter subnets in ways that surprise beginners. For example, 'ip prefix-list TEST seq 5 deny 10.0.0.0/8 le 32' denies all subnets that are within the 10.0.0.0/8 range that are /32 or smaller — essentially all subnets.

Fourth, you must understand the difference between 'set' and 'match' clauses in route-maps. The 'match' clause identifies which routes the policy applies to (e.g., match ip address prefix-list X). The 'set' clause modifies the route (e.g., set local-preference 200). A common exam scenario gives you a route-map that uses 'set metric' (which sets MED) and asks what it does to inbound vs outbound traffic.

Fifth, be prepared for questions on 'next-hop-self' and 'route reflectors'. These are policy tools. Next-hop-self tells your iBGP peers to use your router as the next hop for routes you advertise, rather than the original external next hop. This is crucial when your iBGP peers do not have a direct route to the external next hop.

Finally, know the difference between 'network' statement and 'redistribute' in BGP. The 'network' statement injects a route into BGP if it exists in the routing table. A common trap question is: 'Why is the route not appearing in the BGP table even though the network statement is configured?' Answer: the route is not present in the IP routing table. Beginners forget that the network statement does not create the route — it only advertises an existing one.

To prepare, memorise the attribute order using a mnemonic like 'WLLO AME I' (Weight, Local Preference, Locally Originated, AS Path, MED, eBGP vs iBGP, IGP metric). Practise simulating a BGP table with 'show ip bgp' outputs in Cisco Packet Tracer or GNS3 to see how changes to attributes affect the chosen path.

## Step by step

1. **Identify the Destination and Candidate Routes** — A BGP router receives multiple advertisements for the same destination prefix (e.g., 10.10.10.0/24) from different neighbours. It places all these candidate routes into its BGP table. Before any selection happens, the router removes any routes that are invalid (e.g., the next-hop is unreachable). Only valid routes proceed to the algorithm.
2. **Compare the Highest Weight** — The router checks the Weight attribute for each route. Weight is a Cisco proprietary value set locally on the router. The route with the highest Weight wins immediately, and the algorithm stops. To manipulate this, you configure a route-map to 'set weight 200' on a specific neighbour's routes.
3. **Compare the Highest Local Preference** — If Weight is equal or not set, the router compares Local Preference. If you set a higher Local Preference on routes from one neighbour (e.g., 150 vs 100), that route will be chosen for outbound traffic. This attribute is propagated to all iBGP peers in your AS.
4. **Compare AS Path Length** — If Local Preference is equal, the router counts the number of AS numbers in the AS Path. The route with the fewest AS numbers is preferred. To influence this, you can prepend your own AS number multiple times when advertising to a neighbour, artificially lengthening the path.
5. **Compare Multi-Exit Discriminator (MED)** — After the above checks, if routes are still tied, the router compares MED. MED is a value sent from a neighbouring AS to indicate the preferred entry point into their network. A lower MED is better. You can set this using 'set metric' in a route-map. Note: MED is only compared when the routes come from the same neighbouring AS.
6. **Apply Tie-Breaking: eBGP over iBGP and Lowest Router ID** — If all attributes are still equal, the router prefers external BGP (eBGP) routes over internal BGP (iBGP) routes. If both are eBGP or both are iBGP, the router picks the route from the neighbour with the lowest Router ID (a unique number for each BGP speaker). This ensures a deterministic final choice.

## Comparisons

### Weight vs Local Preference

**Weight:**
- Cisco proprietary, only exists on Cisco routers
- Local to the router, not shared with peers
- Checked first in the BGP path selection algorithm

**Local Preference:**
- Industry standard attribute, works across vendors
- Propagated to all iBGP peers in the AS
- Checked second in the algorithm, after Weight

### AS Path Prepending vs MED (Multi-Exit Discriminator)

**AS Path Prepending:**
- Artificially lengthens the AS Path by adding your AS number multiple times
- Affects inbound traffic by making a route look longer
- Can be applied to any route, regardless of the neighbouring AS

**MED (Multi-Exit Discriminator):**
- A numeric metric attached to a route, lower is better
- Only compared when routes come from the same neighbouring AS
- A hint to the neighbouring AS about which link to use to enter your network

### eBGP (External BGP) vs iBGP (Internal BGP)

**eBGP (External BGP):**
- Routes exchanged between different Autonomous Systems
- Default administrative distance is 20
- Requires that the neighbour be directly connected or reachable via a route

**iBGP (Internal BGP):**
- Routes exchanged within the same Autonomous System
- Default administrative distance is 200
- Requires full mesh or route reflectors to propagate routes

### Network Statement vs Redistribute Command

**Network Statement:**
- Only advertises a prefix that exactly matches a route in the routing table
- Does not modify the route's attributes
- Requires the route to be present in the routing table (connected, static, or from another protocol)

**Redistribute Command:**
- Imports routes from another routing protocol (e.g., OSPF, EIGRP) into BGP
- Can inject multiple routes at once
- May require a route-map to set attributes or filter routes

## Diagram

_This flowchart shows the BGP path selection algorithm's decision steps in order, from Weight to Router ID, with each check eliminating routes until one is chosen._

```mermaid
flowchart TD
    A[Multiple BGP Routes for Same Destination] --> B{Weight?}
    B -->|Highest Weight Wins| C[Select Route A]
    B -->|Equal| D{Local Preference?}
    D -->|Highest LP Wins| C
    D -->|Equal| E{Locally Originated?}
    E -->|Yes| C
    E -->|No| F{AS Path Length?}
    F -->|Shortest Wins| C
    F -->|Equal| G{Origin Code?}
    G -->|IGP>EGP>Incomplete| C
    G -->|Equal| H{MED?}
    H -->|Lowest Wins| C
    H -->|Equal| I{eBGP vs iBGP?}
    I -->|eBGP Preferred| C
    I -->|Same Type| J{IGP Metric to Next-Hop?}
    J -->|Lowest Wins| C
    J -->|Equal| K{Route Age?}
    K -->|Oldest Wins| C
    K -->|Equal| L{Lowest Router ID}
    L -->|Wins| C
```

## Common misconceptions

- **Misconception:** The BGP path selection algorithm is the same as the OSPF or EIGRP metric calculation, and you can just compare a single metric like cost or bandwidth. **Reality:** BGP does not use a single metric. It uses a multi-step algorithm that checks over ten different attributes in a strict order, and the algorithm stops once one attribute differentiates the routes. OSPF uses cost, EIGRP uses a composite metric — BGP is completely different. (Beginners often come from learning interior routing protocols first, and assume all routing protocols use a simple metric comparison. BGP is a policy-based protocol, not a metric-based one.)
- **Misconception:** Setting a high Local Preference on a route will make your network prefer that route for inbound traffic coming from the internet. **Reality:** Local Preference is used to influence outbound traffic from your AS. It tells your routers which exit path to prefer when sending traffic to external destinations. To influence inbound traffic, you must manipulate AS Path, MED, or use community strings. (The words 'preference' and 'local' are confusing. Beginners think 'local preference' means 'prefer this local route,' but its actual role is to choose the best exit path for outbound traffic within your own network.)
- **Misconception:** Weight and Local Preference are the same thing because both are used to prefer one path over another. **Reality:** Weight is a Cisco proprietary attribute that is local to a single router and checked first. Local Preference is an industry-standard attribute that is propagated throughout the entire AS and checked second. They serve different scopes. (Both attributes 'prefer' routes, so beginners assume they are interchangeable. The exam specifically tests the order and scope difference.)
- **Misconception:** If you configure a route-map to deny a route, the route is still considered in the path selection process but with a lower priority. **Reality:** A 'deny' in a route-map causes the route to be filtered out completely. It is not considered at all. It is removed from the BGP table or not advertised, depending on where the route-map is applied. (The term 'deny' in access-lists means 'block.' In route-maps, it also means 'block' — but beginners mistakenly think it means 'downgrade.')
- **Misconception:** The 'network' command in BGP will create the route in the routing table if it does not already exist. **Reality:** The 'network' command only advertises a route that already exists in the IP routing table. If the route is not present (e.g., because the interface is down), the network command does nothing. (The word 'network' sounds like it should build the route, similar to how OSPF's 'network' command activates the interface. BGP is passive — it only announces what is already there.)

## Key takeaways

- The BGP path selection algorithm checks attributes in a strict order: Weight (highest wins), Local Preference (highest wins), Originate (self-originated preferred), AS Path (shortest wins), Origin (IGP preferred), MED (lowest wins), eBGP over iBGP, IGP metric to next-hop (lowest wins).
- Weight is a Cisco proprietary attribute that is local to the router and overrides all other attributes, making it a powerful tool for per-router traffic engineering.
- Local Preference influences outbound traffic from your AS and is propagated to all routers inside your AS via iBGP updates.
- AS Path prepending adds your AS number multiple times to a route advertisement to make the route appear longer, which discourages other ASes from using it for inbound traffic.
- Multi-Exit Discriminator (MED) is a hint sent between different ASes to influence inbound traffic — a lower MED is preferred.
- Route-maps are the primary tool for implementing BGP policy: they use 'match' clauses to select routes and 'set' clauses to modify attributes before routes are accepted or advertised.
- BGP next-hop-self is a command used in iBGP to change the next-hop IP address to the router's own IP, ensuring iBGP peers can reach the next hop without needing an external route.
- The 'network' command in BGP does not install a route into the routing table; it only advertises a route that already exists in the routing table.
- BGP prefers eBGP routes over iBGP routes because eBGP routes are typically more direct and have passed through fewer administrative domains.
- The ultimate tie-breaker in BGP path selection is preferring the route from the neighbour with the lowest Router ID, which ensures a deterministic choice when all other attributes are equal.

## FAQ

**What is the difference between Weight and Local Preference in BGP?**

Weight is a Cisco-only attribute that is local to a single router and is checked first. Local Preference is an industry standard that is propagated throughout your entire AS and is checked second. Weight overrides Local Preference.

**How do I force inbound traffic to use a specific link in BGP?**

You manipulate inbound traffic by making your route advertisements less attractive on the unwanted link. Common methods are AS Path prepending (adding your AS number multiple times) or setting a higher MED on routes sent out of the unwanted link.

**Why is the BGP route not showing up even though I configured a network statement?**

The network statement only advertises a route that already exists in the IP routing table. If the route is not in the routing table (e.g., the connected interface is down), the network statement will not make the route appear in BGP.

**What does 'next-hop-self' do in BGP?**

When you configure 'neighbor X.X.X.X next-hop-self' under BGP, the router changes the next-hop IP address of routes it advertises to that neighbour to its own IP address. This ensures that iBGP peers can reach the next hop without needing a direct route to the original external next hop.

**Can I use MED to influence how traffic leaves my network?**

No, MED is used to influence inbound traffic — it tells other ASes which entrance to use into your network. To influence outbound traffic, you use Local Preference or Weight.

**What is the order of the first ten BGP path selection criteria?**

The order is: 1. Highest Weight, 2. Highest Local Preference, 3. Prefer locally originated routes, 4. Shortest AS Path, 5. Lowest Origin code (IGP is best), 6. Lowest MED, 7. eBGP over iBGP, 8. Lowest IGP metric to next-hop, 9. Route age (oldest route), 10. Lowest Router ID.

## Check your understanding

1. **Which BGP attribute is checked first in the path selection algorithm, and is it Cisco proprietary?**

   Answer: Weight is checked first and is Cisco proprietary.

2. **An engineer wants to influence outbound traffic from their AS to prefer Link A over Link B. Which attribute should they modify, and should they set it higher or lower on Link A?**

   Answer: They should modify Local Preference, setting it higher (e.g., 200) on routes learned via Link A.

3. **What is the purpose of AS Path prepending, and does it affect inbound or outbound traffic?**

   Answer: AS Path prepending makes a route appear longer to external routers, discouraging them from using that path for inbound traffic.

4. **Why would a route not appear in the BGP table even though a 'network 192.168.1.0 mask 255.255.255.0' command is configured?**

   Answer: The route 192.168.1.0/24 must already exist in the IP routing table for the network command to advertise it.

5. **What is the ultimate tie-breaker in the BGP path selection algorithm when all other attributes are equal?**

   Answer: The router prefers the route from the neighbour with the lowest Router ID.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/enarsi/bgp-route-selection-and-policy