Stream of Knowledge: Day 19

RETICUX BGP Mastery — Day 019 — eBGP over iBGP: Why External Routes Win After MED

at September 13, 2026

Learning objective

Explain and prove the eBGP-over-iBGP decision point, including when it is reached and why it does not mean “eBGP is always better.”

eBGP over iBGP: Why External Routes Win After MED

1. Opening — the decision point that is easy to misread

BGP best-path selection is sequential. A router does not assign a single universal “route score” and then pick the smallest or largest number. It evaluates eligible paths through an ordered decision process. The first meaningful difference can end the comparison; later attributes may never be examined.

That matters operationally because engineers often see two routes and jump directly to AS_PATH length. By the time AS_PATH is reached, several earlier decisions may already have eliminated one candidate. Conversely, when two routes remain equal through MED, later implementation-specific or topology-dependent decisions become decisive.

This day isolates one such decision point so that the result can be proven rather than inferred from a route table alone.

2. Standards behavior versus Cisco behavior

RFC 4271 defines BGP's route selection framework but deliberately leaves implementation-specific selection details to implementations. Cisco IOS XE documents an ordered decision process containing Cisco-local and BGP attributes.

The engineering rule is therefore: use RFC text to understand protocol semantics, and Cisco documentation to verify the actual IOS XE decision order and configuration knobs. Do not copy an algorithm from a different vendor and assume Cisco behaves identically.

This distinction becomes particularly important for router ID, multipath, best-external and route-reflector features.

3. Scenario

R1 in AS 65100 receives the same /24 through an eBGP peer on R2 and an iBGP path from another internal router. Earlier attributes are held equal. The lab then changes only the session type presented to the decision process so the reader can observe the eBGP-over-iBGP step rather than treating it as a slogan.

The lab uses documentation-safe addressing and private lab ASNs. No production prefixes, credentials or real operator identifiers are used.

4. Topology

                         AS 65100
                 +---------------------+
                 |       R1 / Core     |
                 |   BGP decision point|
                 +----------+----------+
                            | iBGP
                            |
                         +--+--+
                         | R2  |
                         +--+--+
                            |
                 +----------+----------+
                 |                     |
              eBGP                  eBGP
                 |                     |
              +--+--+               +--+--+
              | ISP-A|               | ISP-B|
              |65110 |               |65120 |
              +-----+               +-----+

Prefix under test: 203.0.113.0/24

5. Prerequisites

IOS XE 17.18.x target image or equivalent supported IOS XE 17.x lab image.
Reachable loopbacks/interfaces before BGP policy is tested.
IPv4 unicast address family enabled.
Private/documentation-safe ASNs and prefixes.
show ip bgp, show ip bgp summary, and show ip route available.
NTP or a stable lab clock is recommended for incident timestamps.

6. Baseline configuration

router bgp 65100
 address-family ipv4 unicast
  neighbor 10.0.12.2 remote-as 65100
  neighbor 10.0.12.2 activate
  neighbor 10.0.21.2 remote-as 65110
  neighbor 10.0.21.2 activate
 exit-address-family

The configuration above is intentionally scoped to the learning objective. It should not be described as a universal production template.

7. Verification before modification

Use show ip bgp 203.0.113.0 and inspect the path markers and attributes. Confirm the eBGP candidate is the selected path only after earlier attributes are equal. Verify show ip route 203.0.113.0 for installation.

Record the baseline best path before changing the single variable under test. The evidence must show both the BGP table and the installed IP route when forwarding behavior is part of the objective.

8. Controlled modification

Remove the local preference/AS_PATH/MED differences that would otherwise decide the route first. Then present equal candidates where one is eBGP and one is iBGP. The eBGP path should win at the eBGP-over-iBGP decision point.

Change only the variable under investigation. Do not simultaneously alter LOCAL_PREF, MED, AS_PATH, next-hop reachability and multipath settings; doing so destroys causal clarity.

9. Fault injection

Illustrative lab — not a real incident.

Illustrative lab — not a real incident. Apply a higher LOCAL_PREF to the iBGP path while leaving the eBGP path unchanged. The expected symptom is that the iBGP path remains best, proving that eBGP preference is not an absolute first-place rule; it occurs only after earlier criteria tie.

The purpose of the fault is to create a recognizable symptom while preserving enough evidence to identify the exact decision point.

10. Troubleshooting

Use this evidence chain:

Confirm the affected prefix.
Confirm both candidate paths are present.
Compare attributes in decision order.
Confirm the next hop is recursively reachable.
Identify the first attribute where the candidates differ.
Confirm whether the result is a best-path decision or a multipath/install decision.
Verify the selected route in the RIB.
Perform a positive forwarding test.
Perform a negative/containment test where safe.
Record the smallest proven cause.

Useful IOS XE commands

show ip bgp 203.0.113.0
show ip bgp 203.0.113.0 longer-prefixes
show ip bgp summary
show ip route 203.0.113.0
show ip route <next-hop>
show ip bgp neighbors <peer> advertised-routes
show ip bgp neighbors <peer> routes

Adapt the command set to the actual feature under test. Do not claim output was observed unless the exact lab was executed.

11. Root cause

The root cause is not “BGP prefers eBGP.” The precise cause is that the candidates reached the eBGP-versus-iBGP comparison with earlier attributes equal. When LOCAL_PREF differs, the earlier LOCAL_PREF decision wins instead.

12. Post-fix verification

Re-run the same evidence set used before the change. The comparison should demonstrate the intended decision change without unrelated routing changes.

13. Rollback

Remove the temporary LOCAL_PREF policy and restore the original equal-attribute state. Recheck the selected path and forwarding entry before closing the change.

14. Production lessons

Treat “eBGP beats iBGP” as an ordered-algorithm statement, not as a universal override. In production, document which earlier attribute is intentionally controlling the route. This makes troubleshooting far faster than starting from session type alone.

15. Knowledge check

Question: What is the first decision point that can distinguish the two candidate paths in this lab?

Answer: Inspect the ordered attributes and identify the first actual difference; do not assume AS_PATH is always the first useful discriminator.

Question: Why must a best-path change be verified in both the BGP table and the IP routing table?

Answer: A BGP path can be selected while recursive next-hop or installation conditions prevent the expected forwarding entry.

Question: What configuration change would make the lab result misleading?

Answer: Changing multiple selection inputs simultaneously, because the engineer can no longer prove which factor caused the outcome.

Engineering notes

This day is deliberately a bridge between attribute-based selection and topology-based selection. It should precede IGP-cost and tie-breaker topics.

16. Sources

RFC 4271 — IETF/RFC Editor; standards baseline for BGP behavior relevant to this post.
Cisco IOS XE 17.x BGP Decision Attributes — Cisco official configuration/implementation documentation for IOS XE 17.x/17.18.x.
RFC 4456 where route-reflector behavior or Cluster List is discussed.
RFC 7911 where ADD-PATH behavior is discussed.

Access date: 12 August 2026

Stream of Knowledge