• Glossary
  • What is BGP (Border Gateway Protocol)?

Security glossary

What is BGP (Border Gateway Protocol)?

BGP (Border Gateway Protocol) is a path-vector routing protocol that exchanges reachability information between autonomous systems on the internet. It runs over TCP between configured peers and selects routes using path attributes and policy rather than a single shortest-path metric.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

BGP (Border Gateway Protocol) is a path-vector routing protocol that enables autonomous systems to exchange reachability information and manage internet routing through policy-based route selection rather than shortest-path metrics. Organizations including internet service providers, cloud providers, and enterprises rely on BGP to announce address prefixes, control traffic flow, and implement multihoming strategies across interconnected networks. Proper BGP management requires careful attention to prefix filters, route origin validation, and session monitoring to prevent outages, route leaks, and traffic misdirection that can result from misconfigurations or policy errors.

  • BGP establishes TCP sessions on port 179 between configured peers in different autonomous systems (external BGP) or within the same network (internal BGP), exchanging UPDATE messages that advertise or withdraw prefixes with path attributes like AS path and next hop.
  • Common BGP failures include route leaks from missing filters that allow unintended prefix re-advertisement, session flapping from hold timer expiry caused by packet loss or MTU problems, and next hop unreachability when external peer addresses are not carried in the interior routing protocol.
  • The BGP decision process evaluates path attributes such as local preference and AS path length in a defined order, and misunderstandings of this attribute hierarchy often lead to unintended path selection where traffic takes longer or more expensive routes than operators expect.

BGP at a glance

AttributeValue
Full nameBorder Gateway Protocol
CategoryNetwork protocol
Defined inRFC 4271 (BGP version 4)
Protocol and portTCP port 179
OSI layerApplication layer, running over TCP
Primary useExchanging routing information between autonomous systems and applying routing policy
Related termsAutonomous system, Anycast, Routing table, RPKI

How BGP works

BGP routers form sessions with configured neighbors, exchange the prefixes they can reach, and each router chooses a best path per prefix based on attributes and local policy.

  1. Establish a TCP session: Two configured peers open a TCP connection on port 179. They may be in different autonomous systems (external BGP) or the same one (internal BGP).
  2. Exchange OPEN messages: Each peer sends its autonomous system number, hold time and capabilities. The peers confirm the parameters are compatible and the session becomes established after KEEPALIVE messages.
  3. Advertise routes: Peers send UPDATE messages that announce prefixes with path attributes such as AS path and next hop, or withdraw prefixes that are no longer reachable.
  4. Select the best path: Each router applies import policy, then runs its decision process over the candidate paths. Attributes such as local preference, AS path length and origin are compared in order.
  5. Install and re-advertise: The chosen path goes into the routing table and may be advertised to other peers according to export policy. Periodic KEEPALIVE messages maintain the session.

BGP sends incremental updates after the initial exchange instead of periodically resending the full table. If a session fails or the hold timer expires, the router withdraws the routes learned from that peer.

Why BGP matters in enterprise networks

BGP is the protocol that ties the internet together. Each network that connects to others, such as internet service providers, cloud providers and large enterprises, is identified by an autonomous system number and uses BGP to announce which address prefixes it can reach. Enterprises also use BGP for multihoming to several providers and for routing in data centers and wide area networks.

Because BGP relies on policy and trust between peers, mistakes spread quickly. A misconfigured filter can cause a route leak, where prefixes are announced to networks that should not receive them, or a hijack, where a network announces prefixes it does not own. Traffic can then be misdirected, dropped or intercepted. Operators reduce this risk with prefix filters, limits on the number of prefixes accepted from a peer, and route origin validation based on the Resource Public Key Infrastructure.

Poor BGP management shows up as outages, asymmetric paths and slow failover. Monitoring session state, prefix counts and path changes helps teams detect problems early, and documenting address ownership and peering policy keeps announcements consistent with what the organization actually holds.

BGP vs OSPF

BGP exchanges routes between autonomous systems using policy, while OSPF is an interior gateway protocol that computes shortest paths inside a single autonomous system. What is OSPF?

AttributeBGPOSPF
Protocol typePath-vector exterior gateway protocolLink-state interior gateway protocol
Typical scopeBetween autonomous systems, and sometimes within large networksWithin one autonomous system
Route selectionPath attributes and administrative policyLowest cumulative cost computed from the link-state database
TransportTCP port 179Runs directly over IP, without TCP or UDP
Neighbor discoveryManually configured peersAutomatic discovery with hello packets

Common BGP issues

A neighbor that cycles between Active and Idle usually points to a failed TCP connection on port 179. Common causes are a firewall or ACL blocking the port, a wrong neighbor address, or a source interface mismatch on the peer.

Without inbound and outbound prefix filters, a multihomed network can re-advertise one provider's routes to another and attract transit traffic it cannot carry. The symptom is saturated links and sudden latency changes after a policy change.

Sessions that drop with a hold timer expired notification often reflect packet loss, CPU starvation or an MTU problem that stalls large UPDATE messages. Each flap withdraws and re-announces prefixes, which causes churn for downstream peers.

A route can appear in the BGP table but never become the best path when its next hop cannot be resolved. This often occurs with internal BGP when the next hop is an external peer address that is not carried in the interior routing protocol.

Traffic may take a longer or more expensive path because attributes such as local preference are evaluated before AS path length. Engineers often expect the shortest AS path to win and misread the decision order.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

BGP FAQ

Related terms

Article

Open Shortest Path First (OSPF)

A routing protocol for IP networks that uses a link state routing algorithm and falls into the group of interior gateway protocols, operating within a single autonomous system.

Learn more
Article

Enhanced Interior Gateway Routing Protocol (EIGRP)

An advanced distance-vector routing protocol that is used on a computer network for automating routing decisions and configuration.

Learn more
Article

Routing Information Protocol

A dynamic routing protocol that uses hop count as a routing metric to find the best path between the source and the destination network.

Learn more
Article

TCP

A protocol that provides reliable, ordered, and error-checked delivery of bytes between applications running on hosts communicating via an IP network; part of the TCP/IP suite.

Learn more
Article

Internet Protocol Address (IP Address)

A numerical label assigned to each device connected to a network that uses IP for communication.

Learn more
Article

CIDR (Classless Inter-Domain Routing)

A method for allocating IP addresses and IP routing introduced by the ITEF 1993 to replace classful networks.

Learn more
Article

Anycast

A traffic routing algorithm used for the speedy delivery of website content that advertises individual IP addresses on multiple nodes.

Learn more
Article

IPv4 (Internet Protocol version 4)

The fourth version of Internet Protocol that uses 32-bit addresses to route most of today’s internet traffic; the global supply of IPv4 addresses is exhausted. Learn More

Learn more
Browse the full glossary