QME CommunicationsTelecommunications network configuration reference

BGP transit and peering edge

Platform: Cisco IOS XE 17.9 · Role: internet edge router · Last reviewed 2026-09-22

Role in the network

This router terminates two upstream internet transit circuits and advertises the operator's own aggregate address space to both. It is the boundary between the operator's interior gateway protocol and the global routing table, so it is also the place where every inbound and outbound announcement has to be filtered. The design goal is that a mistake inside the network cannot become a leak into a transit provider, and a mistake or fault at a transit provider cannot exhaust the router's memory.

Addressing and identifiers

All values are from documentation ranges; substitute your own.
Local autonomous system64512 (RFC 6996 private range)
Upstream AAS 64513, peering address 192.0.2.1/30
Upstream BAS 64514, peering address 198.51.100.1/30
Announced aggregate203.0.113.0/24
Router ID203.0.113.254 (Loopback0)

Configuration

! ---------------------------------------------------------------------------
! Router identity. A stable loopback is the BGP router ID and the source for
! all internal sessions; it must be advertised by the IGP before BGP starts.
! ---------------------------------------------------------------------------
interface Loopback0
 description BGP router ID and iBGP source
 ip address 203.0.113.254 255.255.255.255
 ipv6 address 2001:db8:113::ffff/128
!
interface GigabitEthernet0/0/1
 description Transit A - AS64513 - circuit ref TA-0001
 ip address 192.0.2.2 255.255.255.252
 ip verify unicast source reachable-via rx
 no ip redirects
 no ip proxy-arp
 mtu 1500
!
interface GigabitEthernet0/0/2
 description Transit B - AS64514 - circuit ref TB-0002
 ip address 198.51.100.2 255.255.255.252
 ip verify unicast source reachable-via rx
 no ip redirects
 no ip proxy-arp
 mtu 1500
!
! ---------------------------------------------------------------------------
! What we are willing to announce. One aggregate, nothing else, ever.
! ---------------------------------------------------------------------------
ip prefix-list ANNOUNCE-OUT seq 5 permit 203.0.113.0/24
ip prefix-list ANNOUNCE-OUT seq 10 deny 0.0.0.0/0 le 32
!
! ---------------------------------------------------------------------------
! What we are willing to accept. Reject the bogons, reject anything longer
! than /24, reject a default route, accept the rest of the table.
! ---------------------------------------------------------------------------
ip prefix-list TRANSIT-IN seq 5  deny 0.0.0.0/0
ip prefix-list TRANSIT-IN seq 10 deny 0.0.0.0/8 le 32
ip prefix-list TRANSIT-IN seq 15 deny 10.0.0.0/8 le 32
ip prefix-list TRANSIT-IN seq 20 deny 100.64.0.0/10 le 32
ip prefix-list TRANSIT-IN seq 25 deny 127.0.0.0/8 le 32
ip prefix-list TRANSIT-IN seq 30 deny 169.254.0.0/16 le 32
ip prefix-list TRANSIT-IN seq 35 deny 172.16.0.0/12 le 32
ip prefix-list TRANSIT-IN seq 40 deny 192.0.2.0/24 le 32
ip prefix-list TRANSIT-IN seq 45 deny 192.168.0.0/16 le 32
ip prefix-list TRANSIT-IN seq 50 deny 198.18.0.0/15 le 32
ip prefix-list TRANSIT-IN seq 55 deny 198.51.100.0/24 le 32
ip prefix-list TRANSIT-IN seq 60 deny 203.0.113.0/24 le 32
ip prefix-list TRANSIT-IN seq 65 deny 224.0.0.0/4 le 32
ip prefix-list TRANSIT-IN seq 70 deny 240.0.0.0/4 le 32
ip prefix-list TRANSIT-IN seq 75 deny 0.0.0.0/0 ge 25
ip prefix-list TRANSIT-IN seq 80 permit 0.0.0.0/0 le 24
!
! ---------------------------------------------------------------------------
! Policy. Upstream A is primary inbound (higher local preference); outbound we
! make ourselves look one AS hop longer to upstream B so that the internet
! prefers to reach us over A.
! ---------------------------------------------------------------------------
route-map TRANSIT-A-IN permit 10
 match ip address prefix-list TRANSIT-IN
 set local-preference 200
!
route-map TRANSIT-B-IN permit 10
 match ip address prefix-list TRANSIT-IN
 set local-preference 100
!
route-map TRANSIT-A-OUT permit 10
 match ip address prefix-list ANNOUNCE-OUT
!
route-map TRANSIT-B-OUT permit 10
 match ip address prefix-list ANNOUNCE-OUT
 set as-path prepend 64512
!
! ---------------------------------------------------------------------------
! BGP. Note the three protections that matter most in production:
!   * maximum-prefix, so a full-table leak cannot exhaust memory
!   * ttl-security, so a session cannot be spoofed from off-link (RFC 5082)
!   * password, so the adjacency is authenticated (RFC 5925 where available)
! ---------------------------------------------------------------------------
router bgp 64512
 bgp router-id 203.0.113.254
 bgp log-neighbor-changes
 bgp deterministic-med
 bgp bestpath as-path multipath-relax
 no bgp default ipv4-unicast
 timers bgp 10 30
 !
 neighbor TRANSIT peer-group
 neighbor TRANSIT ttl-security hops 1
 neighbor TRANSIT send-community
 !
 neighbor 192.0.2.1 remote-as 64513
 neighbor 192.0.2.1 peer-group TRANSIT
 neighbor 192.0.2.1 description Transit A AS64513
 neighbor 192.0.2.1 password 7 <removed>
 !
 neighbor 198.51.100.1 remote-as 64514
 neighbor 198.51.100.1 peer-group TRANSIT
 neighbor 198.51.100.1 description Transit B AS64514
 neighbor 198.51.100.1 password 7 <removed>
 !
 address-family ipv4 unicast
  network 203.0.113.0 mask 255.255.255.0
  !
  neighbor 192.0.2.1 activate
  neighbor 192.0.2.1 maximum-prefix 1000000 90 restart 15
  neighbor 192.0.2.1 route-map TRANSIT-A-IN in
  neighbor 192.0.2.1 route-map TRANSIT-A-OUT out
  neighbor 192.0.2.1 soft-reconfiguration inbound
  !
  neighbor 198.51.100.1 activate
  neighbor 198.51.100.1 maximum-prefix 1000000 90 restart 15
  neighbor 198.51.100.1 route-map TRANSIT-B-IN in
  neighbor 198.51.100.1 route-map TRANSIT-B-OUT out
  neighbor 198.51.100.1 soft-reconfiguration inbound
 exit-address-family
!
! The aggregate must exist in the routing table for `network` to advertise it.
ip route 203.0.113.0 255.255.255.0 Null0 250 name ANNOUNCE-ANCHOR
!
! ---------------------------------------------------------------------------
! Control plane protection. Routing adjacencies are the only BGP traffic the
! router should accept on TCP 179.
! ---------------------------------------------------------------------------
ip access-list extended CP-BGP
 permit tcp host 192.0.2.1 host 192.0.2.2 eq bgp
 permit tcp host 192.0.2.1 eq bgp host 192.0.2.2
 permit tcp host 198.51.100.1 host 198.51.100.2 eq bgp
 permit tcp host 198.51.100.1 eq bgp host 198.51.100.2
 deny   tcp any any eq bgp
 permit ip any any
!
class-map match-all CM-BGP
 match access-group name CP-BGP
!
policy-map PM-CONTROL-PLANE
 class CM-BGP
  police 512000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input PM-CONTROL-PLANE

Verification

Commands to run after applying, and what a healthy device shows.
CommandExpected result
show bgp ipv4 unicast summary Both neighbours in state Established; a non-zero, roughly equal prefix count from each upstream.
show bgp ipv4 unicast neighbors 192.0.2.1 advertised-routes Exactly one prefix, 203.0.113.0/24. Anything else is a leak; fix the outbound route-map before continuing.
show bgp ipv4 unicast 8.8.8.0/24 Two paths, the one via AS 64513 marked best because of local preference 200.
show bgp ipv4 unicast neighbors 192.0.2.1 | include Prefixes\|maximum Maximum-prefix threshold shown as 1000000 with a 90 percent warning level.
show policy-map control-plane input Conformed packet counter incrementing on class CM-BGP, drop counter static.

Operational notes

Standards

Back to the configuration library