BGP configuration foundations

A BGP configuration is a model of intent. The local ASN says which policy domain owns the router. The router ID provides a stable identity for path decisions. A network statement says that a specific prefix should be originated. Redistribution says that a class of routes from another source should be admitted into BGP.

The commands are simple; the operational consequences are not. A network statement can advertise a prefix that is not actually in the RIB, and redistribution can advertise a large set of connected or static routes that the operator never intended to expose. This lesson builds a small, auditable foundation and teaches the operator to choose the narrowest mechanism that matches the policy.

The process and its identity

The current VyOS 1.5 LTS command sets the local process ASN with system-as:

configure
set protocols bgp system-as 65000
set protocols bgp parameters router-id 192.0.2.1
commit
save

The older course shorthand is written with the ASN in the protocol node:

set protocols bgp 65000

Use system-as in a live 1.5 LTS change. The shorthand is useful when comparing old FRR output or reading a generated configuration, but mixing trees is a source of confusion. After commit, verify both the active configuration and the runtime process:

show configuration commands
run show bgp summary

flowchart LR
  P["VyOS candidate<br/>system-as and router-id"] --> C["Commit engine"]
  C --> R["FRR rendered configuration"]
  R --> B["bgpd process"]
  B --> Z["zebra handoff"]
  Z --> F["Kernel FIB"]
  B --> O["Operational summary"]
  O --> Q["Question: which route is live?"]

Router ID is an independent identity

The router ID is a 32-bit value represented like an IPv4 address. It identifies a BGP speaker and is used in OPEN messages, best-path tie-breaking, route reflection, and route-origin evidence. It is not the ASN and it is not required to be the interface address used for the session.

A deliberate ID such as 192.0.2.1 is easier to explain than a value selected implicitly from the highest interface address. A stable ID also makes monitoring and incident comparisons more predictable. When a router has multiple VRFs, plan the IDs so they do not collide in the operational evidence even if the same private ASN is used in separate routing contexts.

Address-family context

The current VyOS tree places many IPv4 and IPv6 operations under address-family. A network statement is therefore not a loose global line in the configuration. It belongs to the family that will carry the NLRI:

set protocols bgp address-family ipv4-unicast network 198.51.100.0/24

For IPv6, the family and prefix are different:

set protocols bgp address-family ipv6-unicast network 2001:db8:100::/48

A neighbor is also associated with the address family in which the session is expected to exchange routes. A successful IPv4 session does not prove that IPv6 unicast is active, and a route present in the global IPv4 RIB does not prove that an IPv6 peer can see it.

Network statement versus redistribution

A network statement names a prefix. Redistribution names a source protocol or route class. They answer different questions:

The important nuance is the difference between configuring a network statement and verifying that the prefix exists in the RIB. On VyOS 1.5 LTS, the documented network command can originate the configured prefix even when it is not present in the routing table. If the design requires the prefix to exist before advertisement, enable:

set protocols bgp parameters network-import-check

That check is a safety control, not a magic correction. It makes an unreachable network statement visible as absent instead of advertising a route the router cannot reach. The operator should still verify the result in the BGP table and FIB.

A small configuration baseline

A single-homed site can begin with a narrow IPv4 origin and a peer:

configure
set protocols bgp system-as 65000
set protocols bgp parameters router-id 192.0.2.1
set protocols bgp address-family ipv4-unicast network 198.51.100.0/24
set protocols bgp address-family ipv4-unicast redistribute static route-map ONLY-SITE
set protocols bgp neighbor 192.0.2.2 remote-as 65100
set protocols bgp parameters log-neighbor-changes
commit
save

The route map itself must be defined before it can be referenced in the BGP policy. Its deny and permit sequence is part of the change record. A configuration with a missing route map may fail validation; a permissive route map may pass and create a route leak.

Validation ladder

Start with the process and identity:

show bgp summary
show configuration commands | match protocols

Then inspect the exact origin:

show bgp ipv4 unicast 198.51.100.0/24
show ip route 198.51.100.0/24

A healthy result shows the expected local ASN, the configured router ID, the intended neighbor in Established, the prefix as a valid local path, and a usable next hop. If the prefix is visible in BGP but not the FIB, check network-import-check, route policy, administrative distance, and next-hop reachability.

Production failure modes

• No BGP process exists. The local system-as or the address-family tree is missing, or the configuration was not committed.
• A network statement exists but the route is not in the RIB. The prefix may have been removed, the interface may be down, or a route map may be denying it. Enable or inspect network-import-check according to the design.
• Redistribution exports an unexpected prefix. The route map is too broad, the source protocol changed, or the outbound policy is not attached to the intended peer.
• The router ID is not the intended identity. FRR selected an implicit address or the operator changed the ID without updating the documentation.
• The wrong address family is active. The peer summary is healthy for IPv4, but the expected IPv6 prefix is absent from the neighbor view.
• The route is originated but not installed. A policy, next-hop, or FIB decision is preventing the final transition.

Rollback

For a candidate change, discard removes the uncommitted tree. For a committed origin change, remove the exact network statement or redistribution source and commit again:

configure
delete protocols bgp address-family ipv4-unicast network 198.51.100.0/24
commit
save

For a broad configuration change, use the last known-good revision. Verify the withdrawal on the neighbor, not just the absence of a local command. The peer summary should return to its expected prefix count.

Cross-course references

XXIII-VyOS-BGPFund covers AS numbers, eBGP and iBGP, path attributes, the RIB, and best path. XXV-VyOS-BGPAdvertise develops network and redistribution policy in greater depth. XXVI-VyOS-BGPAttributes explains the attributes attached to local origins, and XXXI-VyOS-BGPTroubleshoot covers route-not-installed diagnosis. The Linux course provides the RIB and FIB context beneath FRR.

Quiz