What Is the Border Gateway Protocol?

The Border Gateway Protocol, usually abbreviated BGP, is the routing protocol that exchanges network reachability information between autonomous systems on the internet. An autonomous system is a network or group of networks under a single administrative routing policy, identified by a globally assigned number, and the protocol's task is to let tens of thousands of such systems agree on how to reach every advertised block of address space. The current version is specified in RFC 4271, A Border Gateway Protocol 4, which replaced earlier revisions and added support for classless inter-domain routing. It runs over TCP on port 179, which relieves it of implementing its own reliable transport.

The protocol is a path vector protocol rather than a link state or distance vector one. Rather than advertising a metric, a speaker advertises the full sequence of autonomous systems that a route has traversed. That AS_PATH attribute serves two purposes: it allows loop detection, since a speaker rejects any route already containing its own number, and it exposes enough of the topology for operators to write policy about which neighbors they will accept routes from and pass routes to.

Session Establishment and Path Selection

Two speakers form a session by opening a TCP connection, exchanging OPEN messages that negotiate capabilities, and then sending UPDATE messages that advertise or withdraw prefixes. KEEPALIVE messages maintain the session and NOTIFICATION messages tear it down on error. Each UPDATE carries path attributes: AS_PATH, NEXT_HOP, ORIGIN, LOCAL_PREF, MULTI_EXIT_DISC, and community values used as policy tags. When several routes to the same prefix exist, the best path algorithm applies a fixed sequence of tiebreakers, beginning with highest local preference, then shortest AS_PATH, then origin type, then lowest multi-exit discriminator, before falling back to interior gateway protocol cost and router identifier. Because local preference is set by local policy and ranks first, business relationships between providers, customers, and peers dominate route selection more than any measure of path quality.

External and Internal Sessions

A session between speakers in different autonomous systems is external BGP, and a session between speakers inside the same one is internal BGP. The two behave differently: routes learned from an internal peer are not re-advertised to other internal peers, which would otherwise require a full mesh of sessions among all routers. Route reflectors and confederations exist to reduce that mesh to a manageable number of adjacencies in large carrier networks. Multiprotocol extensions carry address families beyond IPv4 unicast, including IPv6, VPN routes, and Ethernet VPN signaling, which is why the protocol also underpins provider VPN services and data center fabrics.

Routing Security

The protocol was designed for a research network among trusted operators and includes no mechanism to verify that an advertisement is legitimate. A speaker that announces a prefix it does not hold can attract and blackhole or intercept that traffic, an event known as a route hijack, and misconfiguration produces the same effect accidentally. The Resource Public Key Infrastructure addresses part of this by binding address blocks to autonomous system numbers in signed Route Origin Authorizations, which routers check through route origin validation as specified in RFC 6811, BGP Prefix Origin Validation. Measurement work on the classification and false alarm behavior of invalid prefixes under origin validation documents how much of the observed invalid traffic reflects stale or misconfigured authorizations rather than attacks. Path validation through BGPsec remains far less deployed.

Applications

The Border Gateway Protocol is used in a range of settings, including:

• Internet exchange points and transit provider interconnection
• Multihomed enterprise networks with more than one upstream provider
• Content delivery networks and anycast service deployment
• Provider-provisioned Layer 3 VPNs and Ethernet VPN services
• Data center fabrics running BGP as an interior routing protocol
• Traffic engineering, distributed denial of service mitigation, and remote blackholing