BGP · Introduction

iBGP Next Hop Self

Make an external route usable inside an AS without carrying the external transit subnet throughout the internal network.

Three-router lab

R1 and R2 share AS 65012; R2 peers externally with R3 in AS 65030. Start from the next-hop behavior in the previous lesson. There is no IGP, default route or static route in this lab.

Internal R1–R2 · external R2–R3Illustrative topology

Solid lines: physical links. R1–R2 runs iBGP using interface addresses; R2–R3 runs eBGP. Loopback0 addresses identify routers and are not advertised in this exercise.

Baseline configuration · no originated prefixes yet

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65012
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65012
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
router bgp 65012
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65012
 neighbor 192.0.2.6 remote-as 65030
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  neighbor 192.0.2.6 activate
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
interface Loopback10
 ip address 203.0.113.3 255.255.255.0
exit
router bgp 65030
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 65012
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
 exit-address-family
end

Outputs are illustrative excerpts, not recorded lab results. Wait for BGP and next-hop tracking to converge after each change.

Advertise and inspect

On R3, originate the connected loopback network.

router bgp 65030
 address-family ipv4 unicast
  network 203.0.113.0 mask 255.255.255.0
 exit-address-family

R2# show ip bgp 203.0.113.0/24
     Network          Next Hop            Metric LocPrf Weight Path
*>   203.0.113.0/24   192.0.2.6            0             0 65030 i

R1# show ip bgp 203.0.113.0/24
     Network          Next Hop            Metric LocPrf Weight Path
i    203.0.113.0/24   192.0.2.6            0    100      0 65030 i

R1# show ip route 192.0.2.6
% Network not in table

R1# show ip route 203.0.113.0
% Network not in table

R2 resolves the next hop on its connected link. R1 receives the same address but has no route for it, so the internal path is not usable or installed. The session can still be Established.

Advertise the next-hop subnet

First, let R1 learn the external-facing subnet from R2. The network statement matches R2’s connected /30.

router bgp 65012
 address-family ipv4 unicast
  network 192.0.2.4 mask 255.255.255.252
 exit-address-family

R1# show ip bgp 192.0.2.4/30
     Network          Next Hop            Metric LocPrf Weight Path
*>i  192.0.2.4/30     192.0.2.2            0    100      0 i

R1# show ip bgp 203.0.113.0/24
     Network          Next Hop            Metric LocPrf Weight Path
*>i  203.0.113.0/24   192.0.2.6            0    100      0 65030 i

R1# show ip route bgp
B    192.0.2.4/30 [200/0] via 192.0.2.2
B    203.0.113.0/24 [200/0] via 192.0.2.6

The destination route retains 192.0.2.6. R1 now resolves it through the extra /30, whose next hop is the directly connected R2. This works, but requires carrying that transit subnet internally.

Use next-hop-self

On R2, remove the first solution, then rewrite the next hop on updates sent to R1. Configure the internal neighbor, not the external R3 neighbor.

router bgp 65012
 address-family ipv4 unicast
  no network 192.0.2.4 mask 255.255.255.252
  neighbor 192.0.2.1 next-hop-self
 exit-address-family

R1# show ip bgp 203.0.113.0/24
     Network          Next Hop            Metric LocPrf Weight Path
*>i  203.0.113.0/24   192.0.2.2            0    100      0 65030 i

R1# show ip route 203.0.113.0
Routing entry for 203.0.113.0/24
  Known via "bgp 65012", distance 200, metric 0
  * 192.0.2.2, via GigabitEthernet1

R1# show ip bgp 192.0.2.4/30
% Network not in table

R1 receives R2’s reachable peering address as NEXT_HOP. The transit /30 is no longer needed on R1. R2 must still have a working path to R3; rewriting an attribute cannot repair a broken external link.

With loopback-sourced iBGP, the rewritten address is normally the local peering loopback, which the receiving router must be able to resolve.

Check the return path

A route on R1 does not prove an end-to-end ping will succeed. A ping sourced from 192.0.2.1 needs R3 to have a return route. Advertise that source subnet on R2.

router bgp 65012
 address-family ipv4 unicast
  network 192.0.2.0 mask 255.255.255.252
 exit-address-family

R3# show ip route 192.0.2.1
Routing entry for 192.0.2.0/30
  Known via "bgp 65030", distance 20, metric 0
  * 192.0.2.5, via GigabitEthernet1

R1# ping 203.0.113.3 source 192.0.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 203.0.113.3, timeout is 2 seconds:
Packet sent with a source address of 192.0.2.1
!!!!!
Success rate is 100 percent (5/5)

Forward traffic goes R1 → R2 → R3; replies use the advertised source subnet. Source choice and return routing are separate from the next-hop-self fix.

Final configurations

Working next-hop-self configuration · includes return-path advertisement

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65012
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65012
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
router bgp 65012
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65012
 neighbor 192.0.2.6 remote-as 65030
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  neighbor 192.0.2.6 activate
  network 192.0.2.0 mask 255.255.255.252
  neighbor 192.0.2.1 next-hop-self
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
interface Loopback10
 ip address 203.0.113.3 255.255.255.0
exit
router bgp 65030
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 65012
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
  network 203.0.113.0 mask 255.255.255.0
 exit-address-family
end

Key Takeaways

An Established session does not make a received route usable when its NEXT_HOP cannot be resolved.
Advertising the external transit subnet can supply the missing next-hop reachability without changing the original attribute.
Configure next-hop-self on the border router toward its internal neighbor to advertise a reachable local peering address.
The border still needs a working route to the external destination; rewriting NEXT_HOP does not create one.
Verify the return path for the actual traffic source separately from the forward route.

Command reference

Next-hop neighbor commands · Router-symbol attribution.

← BGP Next Hop BGP Auto-summary →