PacketLab
Protocols/BGP/Advanced BGP Features
BGP · Advanced BGP Features

Confederations

Divide one externally visible AS into member ASes, retaining internal reachability and loop prevention.

Distinguish member and external AS numbers

A confederation partitions one AS into smaller iBGP domains. Each member still needs an internal full mesh or route reflection. Between members, confederation eBGP carries a member sequence while preserving several internal-style attributes. External peers see the confederation identifier instead of member numbers.

Five-router network

R1 is external. R2/R4 are member 65024 and R3/R5 are member 65035; externally both appear as confederation 65200. OSPF spans the four internal routers. The R1-facing subnet is advertised passively so preserved next hops remain reachable.

Lab topologyPhysical links
.1 / .2.5 / .6.9 / .10.13 / .14.17 / .18R1AS 65001R2AS 65024R3AS 65035R4AS 65024R5AS 65035
Solid lines are physical links. Endpoint labels are the last octets of 192.0.2.x/30, first router then second router in the address table. Loopback0 is 10.255.0.N/32 on RN. Logical BGP peers are listed in the configurations.
LinkFirst endpointSecond endpoint
R1–R2GigabitEthernet1 192.0.2.1/30GigabitEthernet1 192.0.2.2/30
R2–R3GigabitEthernet2 192.0.2.5/30GigabitEthernet1 192.0.2.6/30
R2–R4GigabitEthernet3 192.0.2.9/30GigabitEthernet1 192.0.2.10/30
R3–R5GigabitEthernet2 192.0.2.13/30GigabitEthernet1 192.0.2.14/30
R4–R5GigabitEthernet2 192.0.2.17/30GigabitEthernet2 192.0.2.18/30
Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65200
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  network 198.51.100.1 mask 255.255.255.255
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.9 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.2
 network 10.255.0.2 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.5 0.0.0.0 area 0
 network 192.0.2.9 0.0.0.0 area 0
 network 192.0.2.2 0.0.0.0 area 0
 passive-interface GigabitEthernet1
exit
router bgp 65024
 bgp router-id 10.255.0.2
 bgp confederation identifier 65200
 bgp confederation peers 65035
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65001
 neighbor 10.255.0.4 remote-as 65024
 neighbor 10.255.0.4 update-source Loopback0
 neighbor 10.255.0.3 remote-as 65035
 neighbor 10.255.0.3 update-source Loopback0
 neighbor 10.255.0.3 ebgp-multihop 2
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  neighbor 10.255.0.4 activate
  neighbor 10.255.0.4 next-hop-self
  neighbor 10.255.0.3 activate
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.13 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.3
 network 10.255.0.3 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.6 0.0.0.0 area 0
 network 192.0.2.13 0.0.0.0 area 0
exit
router bgp 65035
 bgp router-id 10.255.0.3
 bgp confederation identifier 65200
 bgp confederation peers 65024
 no bgp default ipv4-unicast
 neighbor 10.255.0.5 remote-as 65035
 neighbor 10.255.0.5 update-source Loopback0
 neighbor 10.255.0.2 remote-as 65024
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 10.255.0.2 ebgp-multihop 2
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.5 activate
  neighbor 10.255.0.5 next-hop-self
  neighbor 10.255.0.2 activate
 exit-address-family
end

R4

hostname R4
ip cef
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.10 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.17 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.4
 network 10.255.0.4 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.10 0.0.0.0 area 0
 network 192.0.2.17 0.0.0.0 area 0
exit
router bgp 65024
 bgp router-id 10.255.0.4
 bgp confederation identifier 65200
 bgp confederation peers 65035
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65024
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 10.255.0.5 remote-as 65035
 neighbor 10.255.0.5 update-source Loopback0
 neighbor 10.255.0.5 ebgp-multihop 2
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
  neighbor 10.255.0.2 next-hop-self
  neighbor 10.255.0.5 activate
 exit-address-family
end

R5

hostname R5
ip cef
interface Loopback0
 ip address 10.255.0.5 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.14 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.18 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.5
 network 10.255.0.5 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.14 0.0.0.0 area 0
 network 192.0.2.18 0.0.0.0 area 0
exit
router bgp 65035
 bgp router-id 10.255.0.5
 bgp confederation identifier 65200
 bgp confederation peers 65024
 no bgp default ipv4-unicast
 neighbor 10.255.0.3 remote-as 65035
 neighbor 10.255.0.3 update-source Loopback0
 neighbor 10.255.0.4 remote-as 65024
 neighbor 10.255.0.4 update-source Loopback0
 neighbor 10.255.0.4 ebgp-multihop 2
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.3 activate
  neighbor 10.255.0.3 next-hop-self
  neighbor 10.255.0.4 activate
 exit-address-family
end

Open plain-text configurations

Outputs are illustrative, not recorded router results. Each lab starts from its own baseline. Configuration and feature support vary by image and release; platform-specific examples identify their prerequisites.

Read the boundary configuration

router bgp 65024
 bgp confederation identifier 65200
 bgp confederation peers 65035
 neighbor 10.255.0.4 remote-as 65024
 neighbor 10.255.0.4 update-source Loopback0
 neighbor 10.255.0.3 remote-as 65035
 neighbor 10.255.0.3 update-source Loopback0
 neighbor 10.255.0.3 ebgp-multihop 2

This is the R2 excerpt; the complete configurations include activation and the external peer. Identifier and member lists must agree across the confederation. R1 uses remote-as 65200, not 65024.

Compare internal and external views

R3# show ip bgp 198.51.100.1/32
BGP routing table entry for 198.51.100.1/32
  (65024) 65001
    192.0.2.1 from 10.255.0.2
      Origin IGP, metric 0, localpref 100, valid, confed-external, best

Parentheses show AS_CONFED_SEQUENCE. R3 learns the external origin behind a member boundary without exposing 65024 to outside neighbors. The preserved next hop is reachable over the advertised OSPF subnet. At an external export, members are removed and identifier 65200 is prepended.

Check policy and operational scope

LOCAL_PREF can cross member boundaries; ordinary external eBGP rules are not a complete model for confederation sessions. No Export stays within the whole confederation; Local AS stops at the member. Neither mechanism removes the need for forwarding reachability. Changing a running AS into a confederation disrupts sessions and should be treated as a planned migration.

Return to the saved baseline

The full configuration panel is the completed confederation baseline. For an intentionally broken test, remove a member declaration on one router and observe the resulting session rejection; restore it immediately rather than changing the external router’s AS expectation.

R2# show ip bgp summary
BGP router identifier 10.255.0.2, local AS number 65024
Neighbor        V     AS     State/PfxRcd
192.0.2.1       4     65001  1
10.255.0.3      4     65035  0
10.255.0.4      4     65024  0

Numeric prefix counts indicate established sessions; zero routes does not mean a failed peering.

Key Takeaways

  • The confederation identifier is the externally visible AS.
  • Member ASes retain their own internal peering requirements.
  • Member sequences disappear on external export.
  • Preserved next hops still need an IGP route.
  • Member boundaries and the external boundary are different policy scopes.

Confederations Quiz

Six questions · four options each · select one answer per question. Submit all answers to see your score and explanations.

1. Which AS does external R1 expect from R2?
2. Which two routers share member 65024?
3. What do parentheses around 65024 identify?
4. Can No Export cross to another member?
5. Is NEXT_HOP reachability optional?
6. Does each member automatically avoid all full-mesh requirements?
Protocol and command references

Confederations · BGP specification · Router-symbol attribution.

← Route ReflectorsSynchronization →