BGP peer configuration — IP pools, peers, and communities

BGP peer configuration is the core of MetalLB’s production setup. This lesson walks the configuration pieces, multi-pool and multi-peer scenarios, BGP communities, and the discipline.

The three configuration pieces

flowchart LR
    A[IPAddressPool] -->|range of IPs| C[BGPAdvertisement]
    B[BGPPeer] -->|router, ASN| C
    C -->|advertises IPs| D[Router]

The three pieces:

• IPAddressPool. The range of IPs that can be assigned to LoadBalancer Services.
• BGPPeer. The router’s connection details (IP, ASN, timers, BFD).
• BGPAdvertisement. Binds pools to peers; declares which communities to attach.

A simple configuration

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: prod-pool
  namespace: metallb-system
spec:
  addresses:
    - 192.168.100.0/24
---
apiVersion: metallb.io/v1beta2
kind: BGPPeer
metadata:
  name: prod-router
  namespace: metallb-system
spec:
  peerAddress: 192.168.1.1
  peerASN: 64512
  myASN: 64513
---
apiVersion: metallb.io/v1beta1
kind: BGPAdvertisement
metadata:
  name: prod-advert
  namespace: metallb-system
spec:
  ipAddressPools:
    - prod-pool
  peers:
    - prod-router
  communities:
    - 64513:100

A single pool, single peer, single community.

Multi-pool for multi-environment

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: prod-pool
spec:
  addresses:
    - 192.168.100.0/24
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: dev-pool
spec:
  addresses:
    - 192.168.200.0/24
---
apiVersion: metallb.io/v1beta1
kind: BGPAdvertisement
metadata:
  name: prod-advert
spec:
  ipAddressPools:
    - prod-pool
  peers:
    - prod-router
  communities:
    - 64513:100
---
apiVersion: metallb.io/v1beta1
kind: BGPAdvertisement
metadata:
  name: dev-advert
spec:
  ipAddressPools:
    - dev-pool
  peers:
    - dev-router
  communities:
    - 64513:200

Two pools, two peers, two communities. Production and development traffic are advertised to different routers with different communities.

Multi-peer for redundancy

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: prod-pool
spec:
  addresses:
    - 192.168.100.0/24
---
apiVersion: metallb.io/v1beta2
kind: BGPPeer
metadata:
  name: router-1
spec:
  peerAddress: 192.168.1.1
  peerASN: 64512
  myASN: 64513
---
apiVersion: metallb.io/v1beta2
kind: BGPPeer
metadata:
  name: router-2
spec:
  peerAddress: 192.168.2.1
  peerASN: 64514
  myASN: 64513
---
apiVersion: metallb.io/v1beta1
kind: BGPAdvertisement
metadata:
  name: prod-advert
spec:
  ipAddressPools:
    - prod-pool
  peers:
    - router-1
    - router-2

A single pool advertised to two routers. Both routers learn the routes; either router can forward traffic. If router-1 fails, router-2 continues.

BGP communities

flowchart LR
    A[MetalLB advertises IP] --> B["With community 64513:100"]
    B --> C[Router receives]
    C --> D{Match community?}
    D -->|64513:100| E[Apply policy A]
    D -->|64513:200| F[Apply policy B]
    D -->|No match| G[Default policy]

BGP communities tag routes for routing policy:

• 64513:100 — production pool.
• 64513:200 — development pool.
• 64513:300 — backup pool.

The router’s route map matches on community and applies different policies (local-preference, MED, prepending).

The operational trade-offs

flowchart LR
    A["Single pool, single peer"] --> B[+ Simple]
    A --> C[- Single point of failure]
    D["Multi-pool, multi-peer"] --> E["+ HA, multi-env"]
    E --> F[- Operational complexity]

The trade-offs:

Single pool, single peer:

• Pros: Simple.
• Cons: Single point of failure.

Multi-pool, multi-peer:

• Pros: HA; multi-environment; multi-tenant.
• Cons: Operational complexity; more configuration to maintain.

Quiz

The operational discipline

BGP peer configuration rests on five non-negotiable elements:

• IP pool boundaries. Document which pool is production, which is development.
• Peer configuration. Document each peer’s IP, ASN, timers, BFD.
• Communities for routing policy. Use communities to tag routes; match on the router side.
• Multi-peer for HA. At least two routers for production.
• Verify BGP sessions. After every change.

BGP peer configuration is production networking. The discipline is to document every piece and verify every change.