Troubleshooting BGP Neighbor Stuck in Active State
During a BGP troubleshooting session, an administrator sees that the BGP neighbor state is 'Active'. Which three conditions could cause this state? (Choose THREE.)
Quick Answer
The answer is a firewall blocking TCP port 179, an incorrect neighbor IP address, or an ASN mismatch. These three conditions cause the BGP neighbor to remain in the Active state because this state indicates that the router is actively trying to initiate a TCP connection to the neighbor but has not yet succeeded. In BGP operation, the Active state follows the Connect state and persists when the three-way TCP handshake fails, which can happen if the destination IP is unreachable, the autonomous system number in the OPEN message does not match, or a firewall drops the TCP SYN packet on port 179. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of BGP state machine transitions and common misconfigurations, often appearing as a multi-select scenario where a trap answer is "BGP hold timer expired"—that actually causes the Idle state, not Active. Remember the mnemonic "AIM": Active means IP, ASN, or firewall Misconfiguration.
⚠ Common exam trap
Many exam-takers confuse 'Active' with 'Idle' or 'Connect' states, mistakenly thinking that a firewall block or misconfiguration would cause 'Idle' instead of 'Active', but 'Active' specifically indicates the router is retrying TCP connection attempts after a failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The remote AS number is misconfigured
A misconfigured remote AS number causes the BGP neighbor to remain in the 'Active' state. BGP uses the remote AS number to validate the OPEN message; if the AS number in the OPEN message does not match the configured remote AS, the session is rejected, and the neighbor stays in Active, repeatedly attempting to establish a TCP connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The remote AS number is misconfigured
Why this is correct
ASN mismatch causes the remote end to reject the open message, leading to Active state.
- ✗
The BGP update timer is too short
Why it's wrong here
Update timers affect route advertisement, not neighbor state.
- ✓
The neighbor IP address is incorrectly configured
Why this is correct
If the IP is wrong, TCP cannot connect.
- ✗
The maximum-prefix limit has been exceeded
Why it's wrong here
Exceeding max-prefix causes the session to go to Idle, not Active.
- ✓
A firewall is blocking TCP port 179
Why this is correct
Blocking port 179 prevents TCP establishment.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is troubleshooting a BGP session that fails to establish with a neighbor at 10.0.1.1. Running 'diagnose ip router bgp all' shows the neighbor state as 'Idle'. Which TWO commands should the administrator run NEXT to diagnose the issue?
medium- ✓ A.show full-configuration router bgp
- ✓ B.execute ping 10.0.1.1
- C.diagnose ip router bgp all
- D.diagnose sys session filter dport 179
- E.get router info bgp summary
Why A: 'show full-configuration router bgp' displays the complete BGP configuration, including all neighbor settings, network statements, and route-maps. This allows the administrator to verify that the neighbor at 10.0.1.1 is correctly configured with the proper remote-as, update-source, and any optional parameters that might prevent the session from leaving the Idle state. Option B is correct because a BGP session stuck in Idle often indicates a Layer 3 connectivity issue; pinging the neighbor confirms whether the destination is reachable, which is a fundamental prerequisite for TCP port 179 to establish.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.