BGP · Convergence and Security

Additional Paths

Expose alternatives hidden behind a route reflector by negotiating and selecting additional paths.

Two exits behind one reflector

R2 is the reflector for R1, R3, R4 and R5 in AS65123. R6 originates its /32 through both edge routers R4/R5. OSPF carries internal loopbacks, and each edge sets next-hop-self toward R2.

Lab topologyPhysical links

Solid lines are physical links. Endpoint labels are the last octets of 192.0.2.x/30, first router then second router in the address table. Loopback0 is 10.255.0.N/32 on RN. Logical BGP peers are listed in the configurations.

Link	First endpoint	Second endpoint
R1–R2	GigabitEthernet1 192.0.2.1/30	GigabitEthernet1 192.0.2.2/30
R1–R3	GigabitEthernet2 192.0.2.5/30	GigabitEthernet1 192.0.2.6/30
R2–R3	GigabitEthernet2 192.0.2.9/30	GigabitEthernet2 192.0.2.10/30
R2–R4	GigabitEthernet3 192.0.2.13/30	GigabitEthernet1 192.0.2.14/30
R3–R5	GigabitEthernet3 192.0.2.17/30	GigabitEthernet1 192.0.2.18/30
R4–R5	GigabitEthernet2 192.0.2.21/30	GigabitEthernet2 192.0.2.22/30
R4–R6	GigabitEthernet3 192.0.2.25/30	GigabitEthernet1 192.0.2.26/30
R5–R6	GigabitEthernet3 192.0.2.29/30	GigabitEthernet2 192.0.2.30/30

Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.1
 network 10.255.0.1 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.1 0.0.0.0 area 0
 network 192.0.2.5 0.0.0.0 area 0
exit
router bgp 65123
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65123
 neighbor 10.255.0.2 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.9 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.13 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.2
 network 10.255.0.2 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.2 0.0.0.0 area 0
 network 192.0.2.9 0.0.0.0 area 0
 network 192.0.2.13 0.0.0.0 area 0
exit
router bgp 65123
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 10.255.0.1 remote-as 65123
 neighbor 10.255.0.1 update-source Loopback0
 neighbor 10.255.0.3 remote-as 65123
 neighbor 10.255.0.3 update-source Loopback0
 neighbor 10.255.0.4 remote-as 65123
 neighbor 10.255.0.4 update-source Loopback0
 neighbor 10.255.0.5 remote-as 65123
 neighbor 10.255.0.5 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.1 activate
  neighbor 10.255.0.1 route-reflector-client
  neighbor 10.255.0.3 activate
  neighbor 10.255.0.3 route-reflector-client
  neighbor 10.255.0.4 activate
  neighbor 10.255.0.4 route-reflector-client
  neighbor 10.255.0.5 activate
  neighbor 10.255.0.5 route-reflector-client
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.10 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.17 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.3
 network 10.255.0.3 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.6 0.0.0.0 area 0
 network 192.0.2.10 0.0.0.0 area 0
 network 192.0.2.17 0.0.0.0 area 0
exit
router bgp 65123
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65123
 neighbor 10.255.0.2 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
 exit-address-family
end

R4

hostname R4
ip cef
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.14 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.21 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.25 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.4
 network 10.255.0.4 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.14 0.0.0.0 area 0
 network 192.0.2.21 0.0.0.0 area 0
exit
router bgp 65123
 bgp router-id 10.255.0.4
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65123
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 192.0.2.26 remote-as 65006
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
  neighbor 10.255.0.2 next-hop-self
  neighbor 192.0.2.26 activate
 exit-address-family
end

R5

hostname R5
ip cef
interface Loopback0
 ip address 10.255.0.5 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.18 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.22 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.29 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.5
 network 10.255.0.5 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.18 0.0.0.0 area 0
 network 192.0.2.22 0.0.0.0 area 0
exit
router bgp 65123
 bgp router-id 10.255.0.5
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65123
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 192.0.2.30 remote-as 65006
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
  neighbor 10.255.0.2 next-hop-self
  neighbor 192.0.2.30 activate
 exit-address-family
end

R6

hostname R6
ip cef
interface Loopback0
 ip address 10.255.0.6 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.26 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.30 255.255.255.252
 no shutdown
exit
router bgp 65006
 bgp router-id 10.255.0.6
 no bgp default ipv4-unicast
 neighbor 192.0.2.25 remote-as 65123
 neighbor 192.0.2.29 remote-as 65123
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.25 activate
  neighbor 192.0.2.29 activate
  network 10.255.0.6 mask 255.255.255.255
 exit-address-family
end

Open plain-text configurations

Outputs are illustrative, not recorded router results. Each lab starts from its own baseline. Configuration and feature support vary by image and release; platform-specific examples identify their prerequisites.

Observe path hiding and a client’s different perspective

R2# show ip bgp 10.255.0.6/32
BGP routing table entry for 10.255.0.6/32
Paths: (2 available, best #1, table default)
  65006 via 10.255.0.4, valid, internal, best
  65006 via 10.255.0.5, valid, internal

R1# show ip bgp 10.255.0.6/32
BGP routing table entry for 10.255.0.6/32
Paths: (1 available, best #1, table default)
  65006 via 10.255.0.4, valid, internal, best

The reflector knows two exits but normally exports one selected path per prefix. R1 cannot install or precompute an alternative it never receives. A path that is best at R2 can also be less attractive from R1’s underlay location.

Negotiate, select and advertise

These are three independent requirements. On R2, enable sending to R1, select two candidates, and advertise that selection. On R1, enable receiving from R2. Capability changes may require a controlled restart of the affected session to renegotiate; a route refresh alone does not renegotiate OPEN capabilities.

router bgp 65123
 address-family ipv4 unicast
  neighbor 10.255.0.1 additional-paths send
  bgp additional-paths select best 2
  neighbor 10.255.0.1 advertise additional-paths best 2
 exit-address-family

R1

router bgp 65123
 address-family ipv4 unicast
  neighbor 10.255.0.2 additional-paths receive
 exit-address-family

Check both received identifiers

R1# show ip bgp neighbors 10.255.0.2 | begin capabilities
Neighbor capabilities:
  Additional-paths: Receive IPv4 Unicast

R1# show ip bgp 10.255.0.6/32
BGP routing table entry for 10.255.0.6/32
Paths: (2 available, best #1, table default)
  65006 via 10.255.0.4, valid, internal, best
    rx pathid: 1
  65006 via 10.255.0.5, valid, internal
    rx pathid: 2

Path identifiers distinguish advertisements for the same prefix on this session; their numeric values are local to the exchange, not global route IDs. A withdrawal can remove one identified path without implicitly replacing the other.

Choose an appropriate selection policy

Selection	Effect
Best N	Select the best and next-best candidates for the same prefix.
Group-best	Select the best candidates by relevant neighboring-AS grouping for that prefix.
All	Select eligible paths with distinct next hops on this command family.

All consumes more control-plane memory and bandwidth. Add-Path is defined per family and direction and is not inherently limited by the protocol to iBGP; this lesson uses the common reflector use case. It does not automatically enable ECMP or bypass best-path eligibility.

Return to single selected advertisement

router bgp 65123
 address-family ipv4 unicast
  no neighbor 10.255.0.1 advertise additional-paths best 2
  no neighbor 10.255.0.1 additional-paths send
  no bgp additional-paths select best 2
 exit-address-family

R1

router bgp 65123
 address-family ipv4 unicast
  no neighbor 10.255.0.2 additional-paths receive
 exit-address-family

Renegotiate the affected session if required by the image. The client returns to one selected route while R2 can still retain both candidates locally.

Key Takeaways

Add-Path addresses hidden alternatives on one BGP session.
Send/receive negotiation, candidate selection and advertisement are separate.
Path IDs distinguish paths for one prefix on a session.
Advertisement diversity does not automatically install ECMP.
The protocol can support external or internal sessions; platform restrictions vary.

Protocol and command references

Add-Path protocol · Additional-path configuration · Router-symbol attribution.

← Next-Hop Tracking Prefix Independent Convergence →