BGP · Convergence and Security

Prefix Independent Convergence

Prepare forwarding alternatives so a shared dependency can change without rewriting every destination independently.

Core and edge failure domains

CE1/R1 reaches CE2/R8 through a provider AS65020. R2/R3 are ingress edges, R4/P1 and R5/P2 are core routers, R6/R7 are egress edges. P2 is also a reflector; higher OSPF costs on its links make P1 the preferred underlay. CE2 originates two host routes.

Lab topologyPhysical links

Solid lines are physical links. Endpoint labels are the last octets of 192.0.2.x/30, first router then second router in the address table. Loopback0 is 10.255.0.N/32 on RN. Logical BGP peers are listed in the configurations.

Link	First endpoint	Second endpoint
R1–R2	GigabitEthernet1 192.0.2.1/30	GigabitEthernet1 192.0.2.2/30
R1–R3	GigabitEthernet2 192.0.2.5/30	GigabitEthernet1 192.0.2.6/30
R2–R4	GigabitEthernet2 192.0.2.9/30	GigabitEthernet1 192.0.2.10/30
R3–R4	GigabitEthernet2 192.0.2.13/30	GigabitEthernet2 192.0.2.14/30
R4–R6	GigabitEthernet3 192.0.2.17/30	GigabitEthernet1 192.0.2.18/30
R4–R7	GigabitEthernet4 192.0.2.21/30	GigabitEthernet1 192.0.2.22/30
R2–R5	GigabitEthernet3 192.0.2.25/30	GigabitEthernet1 192.0.2.26/30
R3–R5	GigabitEthernet3 192.0.2.29/30	GigabitEthernet2 192.0.2.30/30
R5–R6	GigabitEthernet3 192.0.2.33/30	GigabitEthernet2 192.0.2.34/30
R5–R7	GigabitEthernet4 192.0.2.37/30	GigabitEthernet2 192.0.2.38/30
R6–R8	GigabitEthernet3 192.0.2.41/30	GigabitEthernet1 192.0.2.42/30
R7–R8	GigabitEthernet3 192.0.2.45/30	GigabitEthernet2 192.0.2.46/30

Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65020
 neighbor 192.0.2.6 remote-as 65020
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  neighbor 192.0.2.6 activate
  network 10.255.0.1 mask 255.255.255.255
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.9 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip ospf cost 50
 ip address 192.0.2.25 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.2
 network 10.255.0.2 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.9 0.0.0.0 area 0
 network 192.0.2.25 0.0.0.0 area 0
exit
router bgp 65020
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65001
 neighbor 10.255.0.5 remote-as 65020
 neighbor 10.255.0.5 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  neighbor 10.255.0.5 activate
  neighbor 10.255.0.5 next-hop-self
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.13 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip ospf cost 50
 ip address 192.0.2.29 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.3
 network 10.255.0.3 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.13 0.0.0.0 area 0
 network 192.0.2.29 0.0.0.0 area 0
exit
router bgp 65020
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 65001
 neighbor 10.255.0.5 remote-as 65020
 neighbor 10.255.0.5 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
  neighbor 10.255.0.5 activate
  neighbor 10.255.0.5 next-hop-self
 exit-address-family
end

R4

hostname R4
ip cef
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.10 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.14 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.17 255.255.255.252
 no shutdown
exit
interface GigabitEthernet4
 ip address 192.0.2.21 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.4
 network 10.255.0.4 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.10 0.0.0.0 area 0
 network 192.0.2.14 0.0.0.0 area 0
 network 192.0.2.17 0.0.0.0 area 0
 network 192.0.2.21 0.0.0.0 area 0
exit
router bgp 65020
 bgp router-id 10.255.0.4
 no bgp default ipv4-unicast
 neighbor 10.255.0.5 remote-as 65020
 neighbor 10.255.0.5 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.5 activate
 exit-address-family
end

R5

hostname R5
ip cef
interface Loopback0
 ip address 10.255.0.5 255.255.255.255
exit
interface GigabitEthernet1
 ip ospf cost 50
 ip address 192.0.2.26 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip ospf cost 50
 ip address 192.0.2.30 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip ospf cost 50
 ip address 192.0.2.33 255.255.255.252
 no shutdown
exit
interface GigabitEthernet4
 ip ospf cost 50
 ip address 192.0.2.37 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.5
 network 10.255.0.5 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.26 0.0.0.0 area 0
 network 192.0.2.30 0.0.0.0 area 0
 network 192.0.2.33 0.0.0.0 area 0
 network 192.0.2.37 0.0.0.0 area 0
exit
router bgp 65020
 bgp router-id 10.255.0.5
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65020
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 10.255.0.3 remote-as 65020
 neighbor 10.255.0.3 update-source Loopback0
 neighbor 10.255.0.4 remote-as 65020
 neighbor 10.255.0.4 update-source Loopback0
 neighbor 10.255.0.6 remote-as 65020
 neighbor 10.255.0.6 update-source Loopback0
 neighbor 10.255.0.7 remote-as 65020
 neighbor 10.255.0.7 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
  neighbor 10.255.0.2 route-reflector-client
  neighbor 10.255.0.3 activate
  neighbor 10.255.0.3 route-reflector-client
  neighbor 10.255.0.4 activate
  neighbor 10.255.0.4 route-reflector-client
  neighbor 10.255.0.6 activate
  neighbor 10.255.0.6 route-reflector-client
  neighbor 10.255.0.7 activate
  neighbor 10.255.0.7 route-reflector-client
 exit-address-family
end

R6

hostname R6
ip cef
interface Loopback0
 ip address 10.255.0.6 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.18 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip ospf cost 50
 ip address 192.0.2.34 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.41 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.6
 network 10.255.0.6 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.18 0.0.0.0 area 0
 network 192.0.2.34 0.0.0.0 area 0
exit
router bgp 65020
 bgp router-id 10.255.0.6
 no bgp default ipv4-unicast
 neighbor 10.255.0.5 remote-as 65020
 neighbor 10.255.0.5 update-source Loopback0
 neighbor 192.0.2.42 remote-as 65008
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.5 activate
  neighbor 10.255.0.5 next-hop-self
  neighbor 192.0.2.42 activate
 exit-address-family
end

R7

hostname R7
ip cef
interface Loopback0
 ip address 10.255.0.7 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.22 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip ospf cost 50
 ip address 192.0.2.38 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.45 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.7
 network 10.255.0.7 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.22 0.0.0.0 area 0
 network 192.0.2.38 0.0.0.0 area 0
exit
router bgp 65020
 bgp router-id 10.255.0.7
 no bgp default ipv4-unicast
 neighbor 10.255.0.5 remote-as 65020
 neighbor 10.255.0.5 update-source Loopback0
 neighbor 192.0.2.46 remote-as 65008
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.5 activate
  neighbor 10.255.0.5 next-hop-self
  neighbor 192.0.2.46 activate
 exit-address-family
end

R8

hostname R8
ip cef
interface Loopback0
 ip address 10.255.0.8 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.8 255.255.255.255
exit
interface Loopback11
 ip address 198.51.100.88 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.42 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.46 255.255.255.252
 no shutdown
exit
router bgp 65008
 bgp router-id 10.255.0.8
 no bgp default ipv4-unicast
 neighbor 192.0.2.41 remote-as 65020
 neighbor 192.0.2.45 remote-as 65020
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.41 activate
  neighbor 192.0.2.45 activate
  network 198.51.100.8 mask 255.255.255.255
  network 198.51.100.88 mask 255.255.255.255
 exit-address-family
end

Open plain-text configurations

Outputs are illustrative, not recorded router results. Each lab starts from its own baseline. Configuration and feature support vary by image and release; platform-specific examples identify their prerequisites.

PIC Core: keep the same BGP egress

If P1 fails but the selected egress PE remains reachable through P2, BGP NEXT_HOP need not change. Hierarchical forwarding can update the shared recursive underlay object for that egress instead of rewriting each dependent prefix separately. IGP repair, failure detection and supported forwarding indirection are prerequisites; the BGP prefix list alone does not prove PIC Core is active.

R2# show ip route 10.255.0.6
Routing entry for 10.255.0.6/32
  Known via "ospf 1", distance 110
  * 192.0.2.10, via GigabitEthernet2

The primary egress recursion uses P1 in this constructed view. After a P1 loss, the alternate underlay route uses the P2-facing interface.

PIC Edge: change the BGP egress

If the egress PE or its customer-facing path fails, a different BGP next hop may be needed. A backup path must already be known, eligible and installed in the supported backup structure. The reflector’s default single-path export can hide the second egress from ingress routers, so solve path visibility before evaluating fast repair.

Expose and install a backup on a supported image

On R5 advertise two selected paths toward R2; R2 receives both. These commands may require renegotiating that one session. On a platform supporting the documented PIC Edge command, install an eligible alternate into the backup forwarding structure.

router bgp 65020
 address-family ipv4 unicast
  neighbor 10.255.0.2 additional-paths send
  bgp additional-paths select best 2
  neighbor 10.255.0.2 advertise additional-paths best 2
 exit-address-family

R2

router bgp 65020
 address-family ipv4 unicast
  neighbor 10.255.0.5 additional-paths receive
  bgp additional-paths install
 exit-address-family

The install command and hardware support are platform-specific. This example describes a supported command family; it is not a universal PIC enable switch for every router or address family.

Check forwarding before injecting failure

R2# show ip bgp 198.51.100.8/32
BGP routing table entry for 198.51.100.8/32
  65008 via 10.255.0.6, internal, best
  65008 via 10.255.0.7, internal, backup/repair candidate

R2# show ip cef 198.51.100.8 detail
198.51.100.8/32
  recursive via 10.255.0.6
  repair/backup via 10.255.0.7

These normalized excerpts show the required relationship; actual backup/repair labels differ by image. Verify both prefixes share the intended next-hop dependency. A path merely present in BGP but absent from the usable backup forwarding structure is not evidence of PIC Edge readiness.

Measure core and edge failures separately

CE1 advertises 10.255.0.1/32 so CE2 has a return route. Before injecting a fault, verify that route on R8 and test both CE2 prefixes from the explicit CE1 loopback source.

R8# show ip route 10.255.0.1
Routing entry for 10.255.0.1/32
  Known via "bgp 65008", distance 20, metric 0
  * 192.0.2.41, via GigabitEthernet1

R1# ping 198.51.100.8 source 10.255.0.1
Success rate is 100 percent (5/5)

R1# ping 198.51.100.88 source 10.255.0.1
Success rate is 100 percent (5/5)

The excerpts illustrate a working baseline; an equally eligible return path may use R7 instead. Run timestamped traffic to both CE2 prefixes with source 10.255.0.1 throughout each test. First fail P1 while keeping the egress available, then restore it. Next fail an egress path and compare repair with and without a preinstalled alternate. Record packet loss, detection time, underlay events and forwarding changes. These constructed outputs do not establish recovery timing. Restore all interfaces/costs from the baseline after each independent fault.

Key Takeaways

PIC Core repairs underlay reachability to the same BGP egress.
PIC Edge can repair through a different BGP egress.
Path visibility and backup installation are separate prerequisites.
Shared forwarding indirection reduces per-prefix rewrite work.
Actual repair timing requires a supported platform and measured failure test.

Protocol and command references

PIC Edge configuration · Additional-path protocol · Router-symbol attribution.

← Additional Paths BGP Professional Lab →