BGP · Neighbor Adjacency

BGP Active vs Passive

Separate the side that starts TCP from the BGP session state. Once connected, both routers can send and receive routing updates.

Two-router lab

R1 and R2 use interface-based eBGP. Begin with the default transport connection mode on both routers.

R1–R2 · directly connected eBGPIllustrative topology

Solid line: physical link. Interface addresses are also BGP session endpoints. Loopback0 supplies a fixed router ID; it is not the transport source.

Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65010
 bgp router-id 10.255.0.1
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65020
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router bgp 65020
 bgp router-id 10.255.0.2
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65010
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
 exit-address-family
end

Outputs and packet decodes are illustrative, not recorded lab results. Keepalive/hold settings in these labs are explicitly 30/90 seconds. Reset each independent fault scenario to its stated baseline before testing.

Identify the initiator

A TCP initiator opens a connection from an ephemeral source port to the peer’s listening port 179. Either side can initiate by default. In this example, R2 initiated the connection.

R1# show ip bgp neighbors 192.0.2.2 | include host|port
Local host: 192.0.2.1, Local port: 179
Foreign host: 192.0.2.2, Foreign port: 50001

R2# show ip bgp neighbors 192.0.2.1 | include host|port
Local host: 192.0.2.2, Local port: 50001
Foreign host: 192.0.2.1, Foreign port: 179

R2 is the active TCP opener; R1 accepted it passively. These roles do not mean that either peer is stuck in the FSM state Active.

R1# show tcp brief all
TCB       Local Address       Foreign Address       (state)
7A10B200  192.0.2.1.179       192.0.2.2.50001        ESTAB

The TCP endpoints confirm the same connection. Router identifiers are carried in OPEN and help resolve simultaneous connection collisions; do not assume the router-ID comparison alone predicts the initiator of every session.

Read the handshake

Illustrative packet exchange · R2 initiates

R2 192.0.2.2:50001 → R1 192.0.2.1:179   TCP SYN
R1 192.0.2.1:179   → R2 192.0.2.2:50001 TCP SYN, ACK
R2 192.0.2.2:50001 → R1 192.0.2.1:179   TCP ACK
R2 → R1  BGP OPEN: AS 65020, ID 10.255.0.2, hold 90
R1 → R2  BGP OPEN: AS 65010, ID 10.255.0.1, hold 90
R1 ↔ R2  BGP KEEPALIVE; session becomes Established

The original SYN identifies the initiator more directly than later BGP packets. Firewall policy must allow the selected connection direction and its return traffic; a source port of 179 is possible on replies.

Choose a passive peer

Make R2 listen only, leaving R1 at its default transport mode. Apply this on R2 under the BGP process, then reset only this lab neighbor so that a new TCP connection demonstrates the setting.

router bgp 65020
 neighbor 192.0.2.1 transport connection-mode passive

R1# clear ip bgp 192.0.2.2

The hard reset interrupts this neighbor. After R1 reconnects, the endpoint roles reverse:

R1# show ip bgp neighbors 192.0.2.2 | include host|port
Local host: 192.0.2.1, Local port: 51002
Foreign host: 192.0.2.2, Foreign port: 179

R2# show ip bgp neighbors 192.0.2.1 | include host|port
Local host: 192.0.2.2, Local port: 179
Foreign host: 192.0.2.1, Foreign port: 51002

R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4  65020      12      12      1   0    0 00:02:00 0

This controls who starts transport; it does not restrict the direction of BGP UPDATE messages. Verify support and command placement for the router image.

Both sides passive

Now also make R1 passive, while R2 remains passive, and reset the existing lab session. Neither router initiates a new connection.

router bgp 65010
 neighbor 192.0.2.2 transport connection-mode passive

R1# clear ip bgp 192.0.2.2

R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4  65020       0       0      1   0    0 never    Active

The exact waiting state can vary by implementation. The important evidence is that no initial SYN is sent by either peer and no new session forms. Keep at least one side able to initiate.

Restore the original default behavior on both routers:

R1

router bgp 65010
 no neighbor 192.0.2.2 transport connection-mode

R2

router bgp 65020
 no neighbor 192.0.2.1 transport connection-mode

R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4  65020      12      12      1   0    0 00:02:00 0

After reconnection, the session again reaches Established. The baseline configurations at the top are the restored configuration.

Key Takeaways

The TCP initiator connects from an ephemeral port to the peer’s listening port 179.
Active/passive TCP roles are different from the FSM state named Active.
A passive transport setting prevents local initiation; at least one peer must be able to initiate.
Once Established, both peers can send UPDATEs regardless of which side opened TCP.
Check endpoint ports and the initial SYN rather than assuming router IDs always predict the opener.

Protocol and command references

BGP protocol and finite state machine · Neighbor command reference · Router-symbol attribution.

← BGP Neighbor Adjacency States BGP Messages →