Last updated: 23 October 2026. Routing-table figures are from the weekly CIDR Report (3 October 2026). Configuration examples use Cisco IOS / IOS XE syntax.
Border Gateway Protocol (BGP) is the routing protocol that holds the internet together. The internet is made of tens of thousands of independent networks, called autonomous systems (AS), run by ISPs, cloud providers, banks, universities and large companies. BGP is how these networks tell each other which IP addresses they can reach, and how each one chooses the best path to every destination. A useful analogy: if each AS is a city, BGP is the national road atlas that every city shares and keeps updated.
BGP at a glance
| Type | Path-vector exterior gateway protocol (EGP) |
| Current version | BGP-4, defined in RFC 4271; supports CIDR and route aggregation |
| Transport | TCP port 179 (reliable delivery, so no periodic full updates) |
| Neighbours | Configured manually (“peers”); not discovered automatically |
| Administrative distance (Cisco) | eBGP 20, iBGP 200 |
| Loop prevention | AS_PATH: a router rejects routes that already contain its own AS number |
| Size of the internet table | About 1.08 million IPv4 prefixes from about 79,000 ASes (October 2026) |
IGP versus EGP
| Interior gateway protocol (IGP) | Exterior gateway protocol (EGP) |
|---|---|
| Routes inside one autonomous system | Routes between autonomous systems |
| Examples: OSPF, EIGRP, IS-IS, RIP | BGP (the only EGP in use today) |
| Chooses the fastest or lowest-cost path | Chooses paths based on policy: business relationships, cost and preference |
Autonomous systems and AS numbers
An autonomous system is a group of networks under one administration with a single routing policy towards the internet. Inside, it may run one or more IGPs; to the outside world it appears as one entity identified by an AS number (ASN).
- Who assigns them: IANA allocates ASNs to the five Regional Internet Registries. In the Asia-Pacific region that is APNIC; in India, organisations can also obtain ASNs through IRINN, the National Internet Registry.
- 2-byte and 4-byte ASNs: the original 16-bit field allowed only 65,536 numbers. 4-byte ASNs (RFC 6793) raised this to about 4.29 billion, and registries now commonly assign them.
- Private ASNs (RFC 6996): 64512–65534 and 4200000000–4294967294. Like private IP addresses, they are for internal use, for example between a customer and its single ISP or inside a data centre, and must not appear on the public internet.
How BGP works
Two BGP routers (“speakers”) become neighbours or peers by opening a TCP session on port 179. They then exchange their full routing information once, followed only by incremental updates when something changes, plus small keepalive messages.
| Message | Purpose |
|---|---|
| OPEN | Starts the session and exchanges AS number, hold time and router ID |
| UPDATE | Advertises new routes or withdraws old ones |
| KEEPALIVE | Keeps the session alive (by default every 60 s on Cisco, with a 180 s hold time) |
| NOTIFICATION | Reports an error and closes the session |
A session moves through the states Idle → Connect → Active → OpenSent → OpenConfirm → Established. Peers exchange routes only in the Established state. A neighbour stuck in Active usually means the TCP session cannot be built: check reachability, the neighbour address, the AS number and any firewall or ACL blocking TCP 179.
eBGP and iBGP
- eBGP runs between routers in different ASes, typically directly connected (for example your router and your ISP’s).
- iBGP runs between routers in the same AS to share routes learned from outside. iBGP routers do not pass iBGP-learned routes to other iBGP peers, so they need a full mesh, or route reflectors in larger networks.
How BGP chooses the best path
When a router learns several paths to the same prefix, it compares their path attributes in order. A simplified version of the Cisco order:
- Highest weight (Cisco-specific, local to the router)
- Highest LOCAL_PREF (shared within the AS; used to choose the exit point)
- Routes originated by this router
- Shortest AS_PATH
- Lowest origin type (IGP before incomplete)
- Lowest MED (a neighbour’s hint about which entry point to use)
- eBGP paths before iBGP paths
- Lowest IGP metric to the next hop, then tie-breakers such as the oldest path and the lowest router ID
This is why BGP is a policy protocol: network engineers influence traffic by setting local preference for outbound traffic, and AS-path prepending or MED for inbound traffic.
Basic eBGP configuration (Cisco)
A company (private AS 65001 in this lab example) peers with its ISP (AS 65002) and advertises its own /24. The example uses documentation addresses:
Router(config)# router bgp 65001
Router(config-router)# bgp router-id 1.1.1.1
Router(config-router)# bgp log-neighbor-changes
Router(config-router)# neighbor 203.0.113.2 remote-as 65002
Router(config-router)# neighbor 203.0.113.2 description ISP-A
Router(config-router)# neighbor 203.0.113.2 password Str0ng-Secret
Router(config-router)# network 198.51.100.0 mask 255.255.255.0
Router(config-router)# exit
! The network statement only advertises a prefix that already exists in the routing table:
Router(config)# ip route 198.51.100.0 255.255.255.0 Null0Router# show ip bgp summary ! neighbours, state and prefixes received
Router# show ip bgp ! the BGP table; ">" marks the best path
Router# show ip bgp neighbors 203.0.113.2 advertised-routes
Router# show ip route bgp ! BGP routes installed in the routing tableBGP security: hijacks, leaks and RPKI
BGP relies on trust: by default, a router believes what its neighbours announce. Mistakes or attacks can therefore redirect traffic for large parts of the internet. A well-known example is the 2008 incident in which Pakistan Telecom’s announcement of a more specific YouTube prefix leaked to the internet and took YouTube offline for hours. Today, operators protect BGP with:
- RPKI route origin validation (ROV): cryptographically signed records (ROAs) state which AS may originate a prefix, and invalid announcements are dropped.
- Prefix filters and maximum-prefix limits on every eBGP session, so a customer can only announce its own address space.
- Session protection: TCP authentication (MD5 or TCP-AO) and the TTL security check (GTSM).
- MANRS (Mutually Agreed Norms for Routing Security), an industry initiative that sets these as baseline practices.
If your organisation has its own IP addresses, create ROAs for them in your RIR’s portal (for India, APNIC MyAPNIC or IRINN) so others can validate your routes.
Frequently asked questions
Do I need BGP for my business network?
Usually not. A single internet connection only needs a default route. BGP becomes useful when you connect to two or more ISPs with your own IP addresses (multihoming), or connect to cloud providers through dedicated links.
Why does BGP converge slowly?
BGP favours stability over speed: it carries over a million routes, uses long timers and dampens flapping routes. Features such as BFD (Bidirectional Forwarding Detection) can speed up failure detection.
Do data centres use BGP internally?
Yes. Many large data centres use eBGP as the only routing protocol in leaf-spine networks, and BGP EVPN is common for VXLAN overlays.
Sources
- RFC 4271: A Border Gateway Protocol 4 (BGP-4)
- RFC 6793: BGP support for four-octet AS numbers
- RFC 6996: AS reservation for private use
- CIDR Report, 3 October 2026 (NANOG list)
- MANRS: Mutually Agreed Norms for Routing Security
Need help with network security? We review router and firewall configurations, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.
