# BGP (Border Gateway Protocol)

> Configure BGP on VyOS: autonomous systems, BGP neighbors, route filtering, communities, route maps, and BGP attributes for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/routing/vyos-bgp/


BGP is a routing protocol used to exchange network reachability information between autonomous systems (AS) on the internet.

## Overview

BGP (RFC 4271) is a path-vector protocol and the de facto standard for inter-domain routing.

**Characteristics**:
- Application-layer protocol (TCP port 179)
- Path-vector algorithm (uses the AS path)
- Policy-based routing
- Scalability (the entire internet)
- Slow convergence (stability matters more than speed)

**BGP types**:
- **eBGP** (External BGP) - between different AS
- **iBGP** (Internal BGP) - within a single AS

**Use cases**:
- Connecting to an internet service provider (ISP)
- Multi-homing (multiple ISPs)
- Transit AS
- Enterprise with its own ASN
- Data centers (BGP in the DC)
- Cloud connectivity (AWS, Azure, GCP)

## Autonomous system (AS)

An AS is a group of networks under a single administrative authority with a common routing policy.

### AS Number (ASN)

**Ranges**:
- **1-64511** - public ASNs (require registration with an RIR)
- **64512-65534** - private ASNs (for internal use)
- **65535** - reserved
- **4-byte ASN**: 65536-4294967295 (RFC 6793)

**Obtaining a public ASN**:
- Through a Regional Internet Registry (RIR)
- For Russia: RIPE NCC
- Requires justification of use

### Setting the ASN

```
set protocols bgp system-as 65001
commit
```

A mandatory parameter to start BGP.

## Router ID

A unique identifier for the BGP router (in IPv4 address format).

```
set protocols bgp parameters router-id 10.0.0.1
commit
```

**Router ID selection** (if not set explicitly):
1. Highest loopback interface IP
2. Highest physical interface IP

**Recommendation**: Always configure the router-id explicitly.

## Basic configuration

### eBGP with a single ISP

```
# AS configuration
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP neighbor
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Announce own network
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

commit
save
```

### Verification

```
show ip bgp summary
show ip bgp neighbors
show ip bgp
```

## Neighbor Configuration

### Basic neighbor

IPv4:
```
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
commit
```

IPv6:
```
set protocols bgp neighbor 2001:db8::1 remote-as 65000
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit
```

### Remote AS

**eBGP** (different AS):
```
set protocols bgp system-as 65001
set protocols bgp neighbor 203.0.113.1 remote-as 65000
```

**iBGP** (same AS):
```
set protocols bgp system-as 65001
set protocols bgp neighbor 10.0.0.2 remote-as 65001
```

### Update Source

Use a specific interface/IP for the BGP connection:

```
set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1
commit
```

Useful for iBGP over loopback interfaces.

### eBGP Multihop

For eBGP over neighbors that are not directly connected:

```
set protocols bgp neighbor 203.0.113.10 ebgp-multihop 2
commit
```

The value is the maximum number of hops (by default eBGP works only with directly connected peers).

### Password Authentication

MD5 authentication for the BGP session:

```
set protocols bgp neighbor 203.0.113.1 password 'SecurePassword123!'
commit
```

The password must match on both sides.

### TTL Security

Protection against spoofing attacks:

```
set protocols bgp neighbor 203.0.113.1 ttl-security hops 1
commit
```

Checks the packet TTL (it must be 255 - hops).

### Description

```
set protocols bgp neighbor 203.0.113.1 description 'ISP1 - AS65000'
commit
```

## Peer Groups

Grouping neighbors that share common parameters.

### Creating a peer group

```
set protocols bgp peer-group ISP-PEERS remote-as 65000
set protocols bgp peer-group ISP-PEERS address-family ipv4-unicast
set protocols bgp peer-group ISP-PEERS password 'SharedSecret!'
commit
```

### Adding neighbors to the group

```
set protocols bgp neighbor 203.0.113.1 peer-group ISP-PEERS
set protocols bgp neighbor 203.0.113.2 peer-group ISP-PEERS
commit
```

Neighbors inherit parameters from the peer-group.

### Overriding parameters

```
set protocols bgp neighbor 203.0.113.1 peer-group ISP-PEERS
set protocols bgp neighbor 203.0.113.1 password 'DifferentPassword!'
commit
```

Individual parameters take precedence.

## Address Families

BGP supports various protocols through Multiprotocol Extensions (RFC 4760).

### IPv4 Unicast

```
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
commit
```

Enabled by default for IPv4 neighbors.

### IPv6 Unicast

```
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit
```

### Multiprotocol BGP

Announcing IPv4 over an IPv6 connection:

```
set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit
```

## Network Advertisement

### Network Statement

Announcing a specific network:

```
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
commit
```

**Requirement**: The network must exist in the routing table (via connected, static, or another protocol).

Adding a static route:
```
set protocols static route 192.0.2.0/24 blackhole distance 254
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
commit
```

### Aggregate Address

Summarizing multiple networks:

```
set protocols bgp address-family ipv4-unicast aggregate-address 192.0.2.0/23
commit
```

Announces the summary prefix instead of the more specific ones.

### Summary-only

Announce only the summary prefix:

```
set protocols bgp address-family ipv4-unicast aggregate-address 192.0.2.0/23 summary-only
commit
```

Suppresses the more specific prefixes.

## Route Redistribution

Importing routes from other sources into BGP.

### Redistribution sources

Connected interfaces:
```
set protocols bgp address-family ipv4-unicast redistribute connected
commit
```

Static routes:
```
set protocols bgp address-family ipv4-unicast redistribute static
commit
```

OSPF:
```
set protocols bgp address-family ipv4-unicast redistribute ospf
commit
```

Kernel routes:
```
set protocols bgp address-family ipv4-unicast redistribute kernel
commit
```

### Selective Redistribution

With a route-map for filtering:

```
set protocols bgp address-family ipv4-unicast redistribute connected route-map CONN-TO-BGP
commit
```

## Route Filtering

### Prefix Lists

Creating a prefix-list:

```
set policy prefix-list ALLOW-CUSTOMER rule 10 action permit
set policy prefix-list ALLOW-CUSTOMER rule 10 prefix 192.0.2.0/24

set policy prefix-list ALLOW-CUSTOMER rule 20 action permit
set policy prefix-list ALLOW-CUSTOMER rule 20 prefix 198.51.100.0/24

commit
```

With a prefix length range:

```
set policy prefix-list FILTER-SMALL rule 10 action deny
set policy prefix-list FILTER-SMALL rule 10 prefix 0.0.0.0/0
set policy prefix-list FILTER-SMALL rule 10 le 24

set policy prefix-list FILTER-SMALL rule 20 action permit
set policy prefix-list FILTER-SMALL rule 20 prefix 0.0.0.0/0
set policy prefix-list FILTER-SMALL rule 20 le 32

commit
```

- **le** (less or equal) - maximum prefix length
- **ge** (greater or equal) - minimum prefix length

### Applying a prefix-list to a neighbor

Incoming (import):
```
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list import ALLOW-CUSTOMER
commit
```

Outgoing (export):
```
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list export MY-NETWORKS
commit
```

## Route Maps

More flexible filtering and attribute modification.

### Basic route-map

```
set policy route-map BGP-IN rule 10 action permit
set policy route-map BGP-IN rule 10 match ip address prefix-list ALLOWED-PREFIXES

set policy route-map BGP-IN rule 20 action deny

commit
```

### Modifying attributes

Local Preference:
```
set policy route-map PREFER-ISP1 rule 10 action permit
set policy route-map PREFER-ISP1 rule 10 set local-preference 150
commit
```

MED (Multi-Exit Discriminator):
```
set policy route-map SET-MED rule 10 action permit
set policy route-map SET-MED rule 10 set metric 100
commit
```

AS-path prepend:
```
set policy route-map PREPEND-PATH rule 10 action permit
set policy route-map PREPEND-PATH rule 10 set as-path prepend '65001 65001'
commit
```

Community:
```
set policy route-map TAG-ROUTES rule 10 action permit
set policy route-map TAG-ROUTES rule 10 set community '65001:100'
commit
```

### Applying a route-map

Import:
```
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import BGP-IN
commit
```

Export:
```
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export BGP-OUT
commit
```

## BGP Attributes

### Local Preference

Route preference for iBGP (higher = better).

```
set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast route-map import SET-LOCAL-PREF

set policy route-map SET-LOCAL-PREF rule 10 action permit
set policy route-map SET-LOCAL-PREF rule 10 set local-preference 200

commit
```

Default: 100.

**Use**: Influence outbound traffic selection.

### MED (Multi-Exit Discriminator)

A hint to neighboring AS about the preferred entry point (lower = better).

```
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export SET-MED

set policy route-map SET-MED rule 10 action permit
set policy route-map SET-MED rule 10 set metric 50

commit
```

Default: 0.

**Use**: Influence inbound traffic from a peer.

### AS Path

The list of AS the route has traversed.

Prepend (adding your own AS):
```
set policy route-map PREPEND rule 10 action permit
set policy route-map PREPEND rule 10 set as-path prepend '65001 65001 65001'
commit
```

Used to depreference a route (a longer path = worse).

### Weight

A Cisco-specific attribute (used in VyOS through a route-map).

Setting weight:
```
set policy route-map SET-WEIGHT rule 10 action permit
set policy route-map SET-WEIGHT rule 10 set weight 100
commit
```

Higher = preferred. A local value (not passed to neighbors).

## BGP Communities

Tags for grouping and filtering routes.

### Standard Communities

Format: `AS:VALUE` (32-bit)

Adding a community:
```
set policy route-map TAG rule 10 action permit
set policy route-map TAG rule 10 set community '65001:100'
commit
```

Multiple communities:
```
set policy route-map TAG rule 10 set community '65001:100'
set policy route-map TAG rule 10 set community '65001:200' additive
commit
```

### Well-known Communities

- **no-export** (65535:65281) - do not advertise into eBGP
- **no-advertise** (65535:65282) - do not advertise to anyone
- **local-as** (65535:65283) - do not advertise beyond the confederation

```
set policy route-map NO-EXPORT rule 10 action permit
set policy route-map NO-EXPORT rule 10 set community 'no-export'
commit
```

### Community Lists

Filtering by community:

```
set policy community-list CUSTOMER-A rule 10 action permit
set policy community-list CUSTOMER-A rule 10 regex '65001:1.*'

set policy route-map FILTER-COMMUNITY rule 10 action permit
set policy route-map FILTER-COMMUNITY rule 10 match community community-list CUSTOMER-A

commit
```

### Large Communities

RFC 8092 - format: `AS:VALUE1:VALUE2` (96-bit)

```
set policy route-map TAG-LARGE rule 10 action permit
set policy route-map TAG-LARGE rule 10 set large-community '65001:100:1'
commit
```

## AS Path Filtering

Filtering based on the AS path.

### AS Path List

```
set policy as-path-list ALLOW-DIRECT rule 10 action permit
set policy as-path-list ALLOW-DIRECT rule 10 regex '^65000_'

set policy as-path-list DENY-TRANSIT rule 10 action deny
set policy as-path-list DENY-TRANSIT rule 10 regex '_65123_'

commit
```

Regex patterns:
- `^` - start
- `$` - end
- `_` - separator (space, start, or end)
- `.*` - any characters
- `[0-9]+` - one or more digits

### Applying an AS Path Filter

```
set policy route-map FILTER-AS rule 10 action permit
set policy route-map FILTER-AS rule 10 match as-path as-path-list ALLOW-DIRECT

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import FILTER-AS

commit
```

## iBGP

Internal BGP within a single AS.

### Basic iBGP configuration

**Router 1**:
```
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

set protocols bgp neighbor 10.0.0.2 remote-as 65001
set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1
set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast

commit
```

**Router 2**:
```
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.2

set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.1 update-source 10.0.0.2
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast

commit
```

### iBGP Full Mesh

For N routers, N(N-1)/2 sessions are required.

**Scaling problem**:
- 3 routers = 3 sessions
- 10 routers = 45 sessions
- 100 routers = 4950 sessions

**Solutions**: Route Reflector or Confederation.

## Route Reflector

Reduces the number of iBGP sessions.

### Route Reflector configuration

**Route Reflector (RR)**:
```
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1
set protocols bgp parameters cluster-id 10.0.0.1

# RR clients
set protocols bgp neighbor 10.0.0.10 remote-as 65001
set protocols bgp neighbor 10.0.0.10 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.0.11 remote-as 65001
set protocols bgp neighbor 10.0.0.11 address-family ipv4-unicast route-reflector-client

commit
```

**RR Client**:
```
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.10

set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast

commit
```

Clients do not need a full mesh - only a connection to the RR.

### Multiple Route Reflectors

For redundancy:

```
# Client
set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.2 remote-as 65001
commit
```

Both RRs must have the same cluster-id.

## BGP Confederation

An alternative to Route Reflector - splitting the AS into sub-AS.

### Configuration

**AS 65001 (public AS)**:
- Sub-AS 65001.1 (private)
- Sub-AS 65001.2 (private)

**Router in Sub-AS 65001.1**:
```
set protocols bgp system-as 65101
set protocols bgp parameters router-id 10.0.1.1

set protocols bgp parameters confederation identifier 65001
set protocols bgp parameters confederation peers 65102

# iBGP within the sub-AS
set protocols bgp neighbor 10.0.1.2 remote-as 65101

# eBGP with the other sub-AS
set protocols bgp neighbor 10.0.2.1 remote-as 65102

commit
```

**Router in Sub-AS 65001.2**:
```
set protocols bgp system-as 65102
set protocols bgp parameters router-id 10.0.2.1

set protocols bgp parameters confederation identifier 65001
set protocols bgp parameters confederation peers 65101

set protocols bgp neighbor 10.0.1.1 remote-as 65101

commit
```

## BFD Integration

Bidirectional Forwarding Detection for fast failure detection.

### Enabling BFD

```
set protocols bgp neighbor 203.0.113.1 bfd
commit
```

### Configuring a BFD profile

```
set protocols bfd profile bgp-peers interval transmit 300
set protocols bfd profile bgp-peers interval receive 300
set protocols bfd profile bgp-peers interval multiplier 3

set protocols bgp neighbor 203.0.113.1 bfd profile bgp-peers

commit
```

BFD detects a failure in seconds instead of minutes (BGP keepalive).

## Timers

### Keepalive and Hold Time

```
set protocols bgp neighbor 203.0.113.1 timers keepalive 30
set protocols bgp neighbor 203.0.113.1 timers holdtime 90
commit
```

Defaults:
- Keepalive: 60 seconds
- Hold time: 180 seconds

**Recommendation**: Hold time should be at least three times the keepalive.

### Advertisement Interval

```
set protocols bgp neighbor 203.0.113.1 advertisement-interval 30
commit
```

The minimum interval between update messages.

## Graceful Restart

Allows forwarding to be preserved when the BGP process restarts.

```
set protocols bgp parameters graceful-restart
commit
```

Restart time:
```
set protocols bgp parameters graceful-restart restart-time 120
commit
```

## Configuration examples

### Dual-homed to two ISPs

```
# Local AS
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP1 (primary)
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 description 'ISP1 Primary'
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import ISP1-IN
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export MY-NETWORKS

# ISP2 (backup)
set protocols bgp neighbor 198.51.100.1 remote-as 65002
set protocols bgp neighbor 198.51.100.1 description 'ISP2 Backup'
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map import ISP2-IN
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map export MY-NETWORKS-PREPEND

# Announce networks
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

# Route-maps
set policy route-map ISP1-IN rule 10 action permit
set policy route-map ISP1-IN rule 10 set local-preference 200

set policy route-map ISP2-IN rule 10 action permit
set policy route-map ISP2-IN rule 10 set local-preference 100

set policy route-map MY-NETWORKS rule 10 action permit
set policy route-map MY-NETWORKS rule 10 match ip address prefix-list MY-PREFIXES

set policy route-map MY-NETWORKS-PREPEND rule 10 action permit
set policy route-map MY-NETWORKS-PREPEND rule 10 match ip address prefix-list MY-PREFIXES
set policy route-map MY-NETWORKS-PREPEND rule 10 set as-path prepend '65001 65001'

set policy prefix-list MY-PREFIXES rule 10 action permit
set policy prefix-list MY-PREFIXES rule 10 prefix 192.0.2.0/24

commit
save
```

### iBGP with a Route Reflector

**Route Reflector**:
```
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.255.255.1
set protocols bgp parameters cluster-id 10.255.255.1

# RR Clients
set protocols bgp neighbor 10.0.1.1 remote-as 65001
set protocols bgp neighbor 10.0.1.1 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.1 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.1.2 remote-as 65001
set protocols bgp neighbor 10.0.1.2 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.2 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.1.3 remote-as 65001
set protocols bgp neighbor 10.0.1.3 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.3 address-family ipv4-unicast route-reflector-client

commit
save
```

**Client**:
```
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.1.1

set protocols bgp neighbor 10.255.255.1 remote-as 65001
set protocols bgp neighbor 10.255.255.1 update-source 10.0.1.1
set protocols bgp neighbor 10.255.255.1 address-family ipv4-unicast

commit
save
```

### BGP over IPsec VTI

```
# IPsec VTI
set interfaces vti vti0 address 172.16.0.1/30

# BGP over the VTI
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

set protocols bgp neighbor 172.16.0.2 remote-as 65002
set protocols bgp neighbor 172.16.0.2 address-family ipv4-unicast

set protocols bgp address-family ipv4-unicast network 192.168.1.0/24

commit
save
```

### Enterprise with branch offices

**HQ**:
```
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Branch offices (iBGP)
set protocols bgp neighbor 10.0.1.1 remote-as 65001
set protocols bgp neighbor 10.0.1.1 update-source 10.0.0.1
set protocols bgp neighbor 10.0.1.1 address-family ipv4-unicast

set protocols bgp neighbor 10.0.2.1 remote-as 65001
set protocols bgp neighbor 10.0.2.1 update-source 10.0.0.1
set protocols bgp neighbor 10.0.2.1 address-family ipv4-unicast

# Announce HQ network
set protocols bgp address-family ipv4-unicast network 192.168.1.0/24

# Redistribute connected branches
set protocols bgp address-family ipv4-unicast redistribute connected route-map BRANCHES

set policy route-map BRANCHES rule 10 action permit
set policy route-map BRANCHES rule 10 match interface vti0
set policy route-map BRANCHES rule 10 match interface vti1

commit
save
```

## Operational commands

### BGP Summary

```
show ip bgp summary
```

Output:
```
BGP router identifier 10.0.0.1, local AS number 65001
IPv4 Unicast Summary:
Neighbor        V    AS MsgRcvd MsgSent   Up/Down State/PfxRcd
203.0.113.1     4 65000    1234    1456  01:23:45        12345
```

### BGP Neighbors

```
show ip bgp neighbors
```

Details for a specific neighbor:
```
show ip bgp neighbors 203.0.113.1
```

### BGP Routes

All BGP routes:
```
show ip bgp
```

A specific prefix:
```
show ip bgp 192.0.2.0/24
```

Received routes (before filtering):
```
show ip bgp neighbors 203.0.113.1 received-routes
```

Advertised routes:
```
show ip bgp neighbors 203.0.113.1 advertised-routes
```

### BGP Statistics

```
show ip bgp statistics
```

### Clear BGP Session

Soft reset (without tearing down TCP):
```
clear ip bgp 203.0.113.1 soft
```

Hard reset:
```
clear ip bgp 203.0.113.1
```

All sessions:
```
clear ip bgp *
```

## Troubleshooting

### BGP session does not come up

Check:

1. **TCP connectivity**:
   ```
   ping 203.0.113.1
   telnet 203.0.113.1 179
   ```

2. **Firewall**:
   ```
   set firewall ipv4 input filter rule 100 action accept
   set firewall ipv4 input filter rule 100 destination port 179
   set firewall ipv4 input filter rule 100 protocol tcp
   commit
   ```

3. **ASN matches**:
   ```
   show configuration commands | grep "remote-as"
   ```

4. **Password** (if configured):
   ```
   show ip bgp neighbors 203.0.113.1
   ```

5. **Logs**:
   ```
   show log | grep bgp
   ```

### Routes are not received

Check:

1. **Address family** is enabled:
   ```
   show protocols bgp neighbor 203.0.113.1
   ```

2. **Prefix filters** are not blocking:
   ```
   show ip bgp neighbors 203.0.113.1 received-routes
   ```

3. **Route-maps**:
   ```
   show policy route-map
   ```

### Routes are not advertised

Check:

1. **Network exists in the routing table**:
   ```
   show ip route 192.0.2.0/24
   ```

2. **Outbound filters**:
   ```
   show ip bgp neighbors 203.0.113.1 advertised-routes
   ```

3. **Route-map export**:
   ```
   show configuration commands | grep export
   ```

### Suboptimal routing

Check:

1. **BGP attributes**:
   ```
   show ip bgp 192.0.2.0/24
   ```

2. **Local Preference** (for iBGP)
3. **MED** (from a peer)
4. **AS-path length**

Use route-maps to modify the attributes.

## Best practices

1. **Always configure the router-id** explicitly
2. **Use prefix-lists** for filtering
3. **Password authentication** for eBGP
4. **BFD** for fast failover
5. **Route Reflector** instead of iBGP full mesh (when > 5 routers)
6. **Loopback interfaces** for the iBGP update-source
7. **Maximum-prefix** to protect against route leaks:
   ```
   set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast maximum-prefix 100000
   ```
8. **Document** every neighbor (description)
9. **Monitor** the state of BGP sessions
10. **Graceful restart** for planned maintenance

## Security

### Recommendations

1. **TTL Security**:
   ```
   set protocols bgp neighbor 203.0.113.1 ttl-security hops 1
   ```

2. **Password Authentication**:
   ```
   set protocols bgp neighbor 203.0.113.1 password 'StrongPassword123!'
   ```

3. **Prefix Filtering**:
   - Filter Bogon prefixes
   - Filter your own prefixes on import
   - Announce only your own prefixes

4. **Maximum Prefix Limit**:
   ```
   set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast maximum-prefix 1000
   ```

5. **AS Path Filtering**:
   - Block private AS on eBGP
   - Block unexpected AS paths

6. **Firewall**:
   ```
   set firewall ipv4 input filter rule 100 action accept
   set firewall ipv4 input filter rule 100 source address 203.0.113.1
   set firewall ipv4 input filter rule 100 destination port 179
   set firewall ipv4 input filter rule 100 protocol tcp
   ```

7. **Logging**:
   ```
   set protocols bgp parameters log-neighbor-changes
   ```

8. **RPKI** (Resource Public Key Infrastructure) for origin AS validation

### Bogon Filtering

Block reserved/private IP:

```
set policy prefix-list BOGONS rule 10 action deny
set policy prefix-list BOGONS rule 10 prefix 0.0.0.0/8 le 32
set policy prefix-list BOGONS rule 20 action deny
set policy prefix-list BOGONS rule 20 prefix 10.0.0.0/8 le 32
set policy prefix-list BOGONS rule 30 action deny
set policy prefix-list BOGONS rule 30 prefix 172.16.0.0/12 le 32
set policy prefix-list BOGONS rule 40 action deny
set policy prefix-list BOGONS rule 40 prefix 192.168.0.0/16 le 32
set policy prefix-list BOGONS rule 50 action deny
set policy prefix-list BOGONS rule 50 prefix 224.0.0.0/4 le 32

set policy prefix-list BOGONS rule 100 action permit
set policy prefix-list BOGONS rule 100 prefix 0.0.0.0/0 le 32

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list import BOGONS

commit
```

## Next steps

- [OSPF](/docs/vyos/routing/vyos-ospf/) - for enterprise internal routing
- [Static Routes](/docs/vyos/routing/vyos-static/) - backup for BGP
- [Route-maps](/docs/vyos/policy/) - detailed filtering
- [BFD](/docs/vyos/routing/vyos-bfd/) - fast failure detection
- [VRF](/docs/vyos/vrf/) - routing table isolation