Most BGP enterprise networks are one misconfiguration away from a full routing meltdown.
Not because engineers don't know BGP. Because the design decisions that prevent failures are invisible — until it all goes down at 2 AM.
Four pillars. One resilient design.
- 1. PREFIX FILTERS TRUST NOTHING BY DEFAULT
BGP accepts what peers announce. Without explicit filters, a misconfigured neighbor injects unauthorized prefixes into your routing table. Route leaks have taken down ISPs and cloud providers. Enterprises are not immune.
INBOUND — Accept only prefixes you explicitly expect. Reject everything else. OUTBOUND — Block internal routes from leaking to external peers. MAX-PREFIX — If a peer sends 50,000 routes instead of 200, tear the session down.
- 2. BFD BECAUSE 90 SECONDS IS UNACCEPTABLE
Default BGP hold timers are 90 seconds. In an enterprise, 90 seconds of blackholing is unacceptable.
BFD detects forwarding failures in milliseconds and triggers immediate session teardown. Convergence drops from 90 seconds to under one second.
Enable on all iBGP and critical eBGP sessions. Set intervals between 300ms and 1000ms. Avoid overly aggressive timers — BFD can flap on high-CPU devices.
- 3. ROUTE REFLECTOR REDUNDANCY NO SILENT COLLAPSE
A single Route Reflector is a single point of failure. When it goes down, every client loses iBGP reachability. Physical links stay up. The routing table collapses — no alert, no warning.
TWO MINIMUM — Separate chassis, separate power feeds, separate fault domains. BOTH PEER ALL CLIENTS — If one RR fails, the other takes over instantly. SEPARATE CLUSTER IDs — Prevent loops while keeping independent operation. MONITOR — A silent session drop is invisible until traffic fails. Alert on it.
4. LOCAL_PREF — YOUR OUTBOUND TRAFFIC LEVER
Multiple exits mean BGP must choose. LOCAL_PREF decides. Propagated to all iBGP peers, evaluated before AS_PATH. Higher value wins. Default is 100.
PRIMARY / BACKUP — LOCAL_PREF 200 on primary, 100 on backup. Failover is automatic. TRAFFIC ENGINEERING — Route latency-sensitive apps through low-latency paths. Bulk transfers through high-bandwidth links. AT SCALE — Apply via route-maps tied to BGP communities for consistent policy across every router.
LOCAL_PREF never leaves your AS. Full outbound control, zero upstream provider changes.
Prefix filters stop unauthorized routes at the door. BFD reacts in milliseconds before hold timers expire. Redundant RRs eliminate the silent iBGP collapse. LOCAL_PREF gives you complete outbound traffic control.
This is the baseline for any enterprise network carrying production traffic.
Which of these four is missing from yours?