Unit 1 · eBGP Multihop

eBGP Multihop

Reach an external peer across another router, diagnose why ordinary eBGP fails, then use loopbacks to keep one session reachable over two links.

Network and prerequisites

R1 in AS 65010 peers with R3 in AS 65030 across transit router R2. The peer addresses are their physical interfaces: 192.0.2.1 and 192.0.2.6. R2 forwards IP packets and runs no BGP.

Interface peers across a transit routerIllustrative topology

Solid lines: physical links. Dashed curve: the logical BGP session between R1 and R3 interface addresses. R2 forwards IP traffic and runs no BGP in this lab.

Know basic eBGP configuration and IPv4 TTL before starting. This first lab uses interface addresses; the later two-link lab uses loopbacks.

Fresh lab routers. Interface names vary by image. Outputs and packet views are illustrative, not recorded.

IP reachability

Add host routes at R1 and R3. R2 already has both link networks connected, so it needs no additional routes for these interface endpoints.

Interfaces and peer routes · R1, R2 and R3

R1

configure terminal
hostname R1
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
ip route 192.0.2.6 255.255.255.255 192.0.2.2
end

R2

configure terminal
hostname R2
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
end

R3

configure terminal
hostname R3
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
ip route 192.0.2.1 255.255.255.255 192.0.2.5
end

Illustrative router output · selected lines

R1# ping 192.0.2.6 source 192.0.2.1
!!!!!
Success rate is 100 percent (5/5)

Illustrative router output · selected lines

R3# ping 192.0.2.1 source 192.0.2.6
!!!!!
Success rate is 100 percent (5/5)

Successful source-specific pings establish IP reachability. They do not prove that the BGP direct-connect and TTL requirements are satisfied.

Direct-connect check

Configure the external neighbors without multihop first.

R1

configure terminal
router bgp 65010
 no bgp default ipv4-unicast
 neighbor 192.0.2.6 remote-as 65030
 address-family ipv4 unicast
  neighbor 192.0.2.6 activate
 exit-address-family
end

R3

configure terminal
router bgp 65030
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65010
 address-family ipv4 unicast
  neighbor 192.0.2.1 activate
 exit-address-family
end

Illustrative router output · selected lines

R1# show ip bgp neighbors 192.0.2.6 | include External
  External BGP neighbor not directly connected.

Illustrative router output · selected lines

R3# show ip bgp neighbors 192.0.2.1 | include External
  External BGP neighbor not directly connected.

The neighbor is reachable but not on a directly connected subnet. The direct-connect check can prevent the connection attempt before a TTL-limited packet is sent.

TTL expiry

Temporarily remove the check to expose the second problem. This is a diagnostic step, not the final configuration.

R1

configure terminal
router bgp 65010
 neighbor 192.0.2.6 disable-connected-check
end

R3

configure terminal
router bgp 65030
 neighbor 192.0.2.1 disable-connected-check
end

Packet view · TCP attempt and TTL expiry

Constructed field excerpts. A real lab capture can use tcp.port == 179 || icmp.type == 11.

At R1 Gi1, outbound:
  IPv4: 192.0.2.1 → 192.0.2.6
  TTL: 1
  TCP: destination port 179, SYN

At R2:
  Forwarding would expire the packet TTL. Packet discarded.
  Possible response: ICMP type 11, code 0 (time exceeded).

The check is disabled, but outgoing eBGP TTL is still 1. R2 cannot forward that packet to R3. Removing the check alone does not solve this routed session.

Configure multihop

Remove the diagnostic setting, then configure multihop at both endpoints. TTL 2 is sufficient: R2 forwards once and R3 receives the packet with TTL 1.

R1

configure terminal
router bgp 65010
 no neighbor 192.0.2.6 disable-connected-check
 neighbor 192.0.2.6 ebgp-multihop 2
end

R3

configure terminal
router bgp 65030
 no neighbor 192.0.2.1 disable-connected-check
 neighbor 192.0.2.1 ebgp-multihop 2
end

The interface addresses are already the intended TCP sources, so no update-source command is needed in this first lab. That command becomes important in the loopback example below.

Verify the session

Illustrative router output · selected lines

R1# show ip bgp neighbors 192.0.2.6
BGP neighbor is 192.0.2.6, remote AS 65030, external link
  BGP state = Established, up for 00:03:10
  External BGP neighbor may be up to 2 hops away.

Illustrative router output · selected lines

R1# show ip bgp summary
Neighbor       V      AS  Up/Down  State/PfxRcd
192.0.2.6      4   65030  00:03:10             0

Illustrative router output · selected lines

R3# show ip bgp summary
Neighbor       V      AS  Up/Down  State/PfxRcd
192.0.2.1      4   65010  00:03:10             0

The neighbor is the remote endpoint, not R2. A numeric prefix count of zero means the session is up with no accepted prefixes; this lab has not originated any networks.

Packet view · after enabling multihop

R1 Gi1 outbound: 192.0.2.1 → 192.0.2.6, TTL 2
R2 Gi2 outbound: 192.0.2.1 → 192.0.2.6, TTL 1

These constructed excerpts show the TTL decrement. Addresses stay the same through transit; Ethernet addressing changes on each link.

The peer session can work while forwarding to other advertised destinations fails. R2 needs appropriate destination routes or another forwarding design for those packets; it does not learn them merely by forwarding the BGP TCP connection.

Final configurations

Final three-router configuration

R1

configure terminal
hostname R1
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
ip route 192.0.2.6 255.255.255.255 192.0.2.2
router bgp 65010
 no bgp default ipv4-unicast
 neighbor 192.0.2.6 remote-as 65030
 neighbor 192.0.2.6 ebgp-multihop 2
 address-family ipv4 unicast
  neighbor 192.0.2.6 activate
 exit-address-family
end

R2

configure terminal
hostname R2
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
end

R3

configure terminal
hostname R3
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
ip route 192.0.2.1 255.255.255.255 192.0.2.5
router bgp 65030
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65010
 neighbor 192.0.2.1 ebgp-multihop 2
 address-family ipv4 unicast
  neighbor 192.0.2.1 activate
 exit-address-family
end

Loopback load sharing

Use a separate two-router topology: R1 in AS 65010 and R2 in AS 65020. Two equal-cost static routes reach each remote loopback. One BGP session uses those loopbacks.

Separate lab: loopback peering over two physical linksIllustrative topology

Solid lines: two physical links between R1 and R2. Dashed curve: one logical loopback BGP session. This is a separate two-router topology.

Complete alternative lab · R1 and R2

R1

configure terminal
hostname R1
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
ip route 10.255.0.2 255.255.255.255 192.0.2.2
ip route 10.255.0.2 255.255.255.255 192.0.2.6
router bgp 65010
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65020
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 10.255.0.2 ebgp-multihop 2
 address-family ipv4 unicast
  neighbor 10.255.0.2 activate
 exit-address-family
end

R2

configure terminal
hostname R2
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
ip route 10.255.0.1 255.255.255.255 192.0.2.1
ip route 10.255.0.1 255.255.255.255 192.0.2.5
router bgp 65020
 no bgp default ipv4-unicast
 neighbor 10.255.0.1 remote-as 65010
 neighbor 10.255.0.1 update-source Loopback0
 neighbor 10.255.0.1 ebgp-multihop 2
 address-family ipv4 unicast
  neighbor 10.255.0.1 activate
 exit-address-family
end

Illustrative router output · selected lines

R1# show ip route static
S    10.255.0.2/32 [1/0] via 192.0.2.2
                   [1/0] via 192.0.2.6

Illustrative router output · selected lines

R2# show ip route static
S    10.255.0.1/32 [1/0] via 192.0.2.1
                   [1/0] via 192.0.2.5

Illustrative router output · selected lines

R1# show ip bgp summary
Neighbor       V      AS  Up/Down  State/PfxRcd
10.255.0.2     4   65020  00:03:10             0

The static routes supply underlay alternatives; update-source makes the neighbor see the expected loopback address. Loopback peering does not add a physical forwarding hop.

Forwarding can distribute different flows over the links, but a single TCP flow may stay on one path. Two routes do not create two BGP sessions or guarantee a 50/50 traffic split. A surviving route may preserve reachability after a link failure; session continuity depends on convergence and timers.

Key Takeaways

An IP route to the peer is required before BGP can establish its TCP connection.
Default eBGP has a direct-connect check and outgoing TTL 1; these are separate constraints.
disable-connected-check removes the adjacency check but does not increase TTL.
ebgp-multihop 2 allows this two-hop session; update-source separately selects a loopback source.
Two underlay routes can support one loopback BGP session; session reachability does not guarantee forwarding to other destinations.

Command references and lab notes

neighbor command reference · Router-symbol attribution.

Command syntax and output vary by release. The two topologies are independent labs; do not merge their configurations.

← External BGP Internal BGP →