PacketLab
Protocols/BGP/Neighbor Adjacency
BGP · Neighbor Adjacency

Troubleshooting BGP Neighbor Adjacency

Find the first failing layer: interface, peer reachability, TCP, transport source or OPEN validation. Change one cause and verify the result.

Interface issues

Start with the directly connected eBGP baseline. Each later section is an independent lab; do not leave old neighbors or faults in place.

R1–R2 · directly connected eBGPIllustrative topology
AS 65010AS 65020192.0.2.0/30Gi1 · .1Gi1 · .2R1Lo0: 10.255.0.1/32R2Lo0: 10.255.0.2/32
Solid line: physical link. Interface addresses are also BGP session endpoints. Loopback0 supplies a fixed router ID; it is not the transport source.
Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65010
 bgp router-id 10.255.0.1
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65020
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router bgp 65020
 bgp router-id 10.255.0.2
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65010
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
 exit-address-family
end
Outputs and packet decodes are illustrative, not recorded lab results. Keepalive/hold settings in these labs are explicitly 30/90 seconds. Reset each independent fault scenario to its stated baseline before testing.
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4  65020       0       0      1   0    0 never    Active
R1# ping 192.0.2.2 source 192.0.2.1
Sending 5, 100-byte ICMP Echos to 192.0.2.2:
.....
Success rate is 0 percent (0/5)

R2# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet1       192.0.2.2       YES manual administratively down down
Loopback0              10.255.0.2      YES manual up                    up

Here the remote interface is administratively disabled. On R2:

interface GigabitEthernet1
 no shutdown
R2# show ip interface brief
Interface              IP-Address      OK? Method Status Protocol
GigabitEthernet1       192.0.2.2       YES manual up     up
Loopback0              10.255.0.2      YES manual up     up
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4  65020      12      12      1   0    0 00:02:00 0

If interfaces are up but reachability still fails, check the subnet masks, VLAN/ARP path and the actual neighbor address before changing BGP timers.

eBGP loopback requirements

Keep the same physical network but replace the interface neighbors with reciprocal Loopback0 neighbors in separate ASes. Initially omit the routes, source setting and multihop setting. The three requirements are independent.

R1# show ip route 10.255.0.2
% Network not in table

1. Supply bidirectional reachability

On R1 and R2 respectively:

ip route 10.255.0.2 255.255.255.255 192.0.2.2
ip route 10.255.0.1 255.255.255.255 192.0.2.1
R1# ping 10.255.0.2 source Loopback0
Packet sent with a source address of 10.255.0.1
!!!!!
Success rate is 100 percent (5/5)

2. Permit the non-direct eBGP endpoint

On R1 configure the first neighbor; on R2 configure the second. Multihop also bypasses the ordinary directly connected eBGP check on this command family. For these adjacent devices it is not evidence of a physical transit router.

router bgp 65010
 neighbor 10.255.0.2 ebgp-multihop 2
router bgp 65020
 neighbor 10.255.0.1 ebgp-multihop 2

3. Match the configured source

Without update-source, an outgoing connection can use the physical interface address, which does not match the peer’s configured loopback neighbor. Apply the source on both routers:

router bgp 65010
 neighbor 10.255.0.2 update-source Loopback0
router bgp 65020
 neighbor 10.255.0.1 update-source Loopback0
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
10.255.0.2      4  65020      12      12      1   0    0 00:02:00 0
R1# show ip bgp neighbors 10.255.0.2 | include host|port
Local host: 10.255.0.1, Local port: 52001
Foreign host: 10.255.0.2, Foreign port: 179
Complete working eBGP loopback configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
ip route 10.255.0.2 255.255.255.255 192.0.2.2
router bgp 65010
 bgp router-id 10.255.0.1
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65020
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 10.255.0.2 ebgp-multihop 2
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
ip route 10.255.0.1 255.255.255.255 192.0.2.1
router bgp 65020
 bgp router-id 10.255.0.2
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 10.255.0.1 remote-as 65010
 neighbor 10.255.0.1 update-source Loopback0
 neighbor 10.255.0.1 ebgp-multihop 2
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.1 activate
 exit-address-family
end

TCP port filtering

Use a fresh interface-based iBGP pair in AS 65010 for this independent fault.

R1–R2 · iBGP in AS 65010Illustrative topology
AS 65010192.0.2.0/30Gi1 · .1Gi1 · .2R1Lo0: 10.255.0.1/32R2Lo0: 10.255.0.2/32
Solid line: physical link. Interface addresses are also BGP session endpoints. Loopback0 supplies a fixed router ID; it is not the transport source.
Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65010
 bgp router-id 10.255.0.1
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65010
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router bgp 65010
 bgp router-id 10.255.0.2
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65010
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
 exit-address-family
end
Outputs and packet decodes are illustrative, not recorded lab results. Keepalive/hold settings in these labs are explicitly 30/90 seconds. Reset each independent fault scenario to its stated baseline before testing.
R1# ping 192.0.2.2 source 192.0.2.1
!!!!!
Success rate is 100 percent (5/5)

R2# show ip interface GigabitEthernet1 | include access list
  Inbound access list is PEER-FILTER
  Outgoing access list is not set

R2# show ip access-lists PEER-FILTER
Extended IP access list PEER-FILTER
  10 deny tcp any eq bgp any (8 matches)
  20 deny tcp any any eq bgp (12 matches)
  30 permit ip any any (20 matches)

The ping tests ICMP, not TCP 179. The applied ACL blocks both possible BGP connection directions. Insert precise permits before the existing denies on R2; retain unrelated policy.

ip access-list extended PEER-FILTER
 5 permit tcp host 192.0.2.1 host 192.0.2.2 eq 179
 6 permit tcp host 192.0.2.1 eq 179 host 192.0.2.2
exit
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4  65010      12      12      1   0    0 00:02:00 0
R2# show ip access-lists PEER-FILTER
Extended IP access list PEER-FILTER
  5 permit tcp host 192.0.2.1 host 192.0.2.2 eq bgp (9 matches)
  6 permit tcp host 192.0.2.1 eq bgp host 192.0.2.2
  10 deny tcp any eq bgp any (8 matches)
  20 deny tcp any any eq bgp (12 matches)
  30 permit ip any any (20 matches)

This example assumes the ACL is already bound inbound on R2’s Gi1, as shown. An intervening firewall or control-plane policy can cause the same symptoms even if the interface ACL is clear.

iBGP update source

In another fresh AS 65010 lab, configure each router’s neighbor as the other Loopback0 address. First supply OSPF reachability for the physical link and both loopbacks; then source BGP from those same loopbacks.

R1

router ospf 1
 network 10.255.0.1 0.0.0.0 area 0
 network 192.0.2.0 0.0.0.3 area 0
 passive-interface Loopback0

R2

router ospf 1
 network 10.255.0.2 0.0.0.0 area 0
 network 192.0.2.0 0.0.0.3 area 0
 passive-interface Loopback0
R1# show ip route 10.255.0.2
Routing entry for 10.255.0.2/32
  Known via "ospf 1", distance 110, metric 2, type intra area
  * 192.0.2.2, via GigabitEthernet1
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
10.255.0.2      4  65010       0       0      1   0    0 never    Active

A reachable destination does not guarantee the source matches the remote neighbor definition. Apply update-source on both sides:

router bgp 65010
 neighbor 10.255.0.2 update-source Loopback0
router bgp 65010
 neighbor 10.255.0.1 update-source Loopback0
R1# show ip bgp summary
BGP router identifier 10.255.0.1, local AS number 65010
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
10.255.0.2      4  65010      12      12      1   0    0 00:02:00 0

iBGP does not need ebgp-multihop. The OSPF metric shown assumes ordinary lab interface costs.

Complete working iBGP loopback configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.1
 network 10.255.0.1 0.0.0.0 area 0
 network 192.0.2.0 0.0.0.3 area 0
 passive-interface Loopback0
exit
router bgp 65010
 bgp router-id 10.255.0.1
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65010
 neighbor 10.255.0.2 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.2
 network 10.255.0.2 0.0.0.0 area 0
 network 192.0.2.0 0.0.0.3 area 0
 passive-interface Loopback0
exit
router bgp 65010
 bgp router-id 10.255.0.2
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 10.255.0.1 remote-as 65010
 neighbor 10.255.0.1 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.1 activate
 exit-address-family
end

Final checks

EvidenceNext check
Idle / Connect / ActiveInterface, route to exact peer, expected source, TCP 179, transport mode.
OPEN rejection / resetExpected remote AS, negotiated parameters and the last NOTIFICATION.
Password mismatchBoth peers must use the same configured TCP authentication; failure may occur before OPEN.
Established with zero prefixesMove to route advertisement troubleshooting, not another TCP fix.
Repeated established-session resetsInspect hold expiry, link loss, packet loss and MTU/transport evidence.

Use the last reset reason and packet evidence to narrow the cause. A state name or failed ping alone cannot identify every fault.

Key Takeaways

  • Start with interfaces and reachability to the exact neighbor address before changing protocol settings.
  • A successful ICMP ping does not prove TCP port 179 is permitted.
  • Loopback eBGP needs reachable endpoints, matching source addresses and suitable connected-check/TTL behavior.
  • Loopback iBGP needs underlying reachability and matching update-source, but not ebgp-multihop.
  • Use the last reset reason and OPEN error evidence to separate transport faults from protocol validation faults.

Adjacency Troubleshooting Quiz

Six questions · four options each · select one answer per question. Submit all answers to see your score and explanations.

1. The remote interface is administratively down. What is the first targeted fix?
2. Ping succeeds but the ACL denies TCP with source or destination port 179. What can happen?
3. Both loopbacks are reachable, but outgoing TCP uses an unconfigured physical-source neighbor. What is missing?
4. Does ordinary iBGP require ebgp-multihop for loopback peers?
5. What is the safer targeted ACL repair shown here?
6. A numeric zero in State/PfxRcd should send you toward which next investigation?
Protocol and command references

BGP protocol and finite state machine · Neighbor command reference · Basic BGP configuration · Router-symbol attribution.

← BGP MessagesTroubleshooting BGP Route Advertisement →