BGP evaluates 13 steps in order and stops at the first one that produces a winner. Here is the full order, with steps 1 and 2 proven on real show ip bgp output from a three-AS CML lab where the best marker moves between two paths as one attribute changes.
An unauthenticated BGP session is vulnerable to TCP-based attacks and spoofed RSTs. MD5 has been the standard for decades; TCP-AO is the modern replacement. A practical guide to BGP session authentication.
A BGP default route tells a peer to send anything it does not have a more specific path for. Different injection methods, default-originate, network, redistribute, have different behaviors and failure modes. Pick carefully.
The IPv4 BGP table has over 950,000 prefixes and growing. Route aggregation lets you advertise a summary instead of many specifics, reducing the routing table burden on your peers and the internet. Configuration and gotchas.
Weight is the first step of Cisco BGP best-path selection, Cisco-proprietary, never advertised, and local to the router. The most targeted BGP traffic engineering tool when you need one router to override AS-wide policy.
AS-path prepending is the go-to tool for influencing inbound BGP traffic: artificially lengthen the AS-path so remote ASes prefer your other exit. It is blunt, global, and has real security implications. When it works, and when it does not.
MED tries to influence how traffic enters your AS by suggesting which of your entry points the neighbor should prefer. It is optional non-transitive and easy to misuse. How MED actually works, and how to set it safely.
Local preference tells every router in your AS which exit to prefer for specific destinations. It rides iBGP throughout the AS and resolves in step 2 of best path. The cleanest tool for inbound exit engineering.
Most community write-ups stop at the set community line. This one follows the tag all the way through: R1 tags a prefix with 65001:200 and no-export, R2 prints the community and flags it as not advertised to EBGP peer, and R3 answers with % Network not in table. Captured on IOS XE 17.18.2 in CML.
Route maps are the primary BGP traffic engineering tool on Cisco IOS XE. Match on AS-path, community, or MED, then set attributes to steer paths. A practical guide to matching, setting, and manipulating BGP routes.
RPKI lets prefix owners sign ROAs that say which AS is authorized to originate their prefixes. Route Origin Validation rejects invalid routes. A practical guide to RPKI and ROV on Cisco IOS XE for internet-facing networks.
BGP was designed when every AS was trusted. Accidental route leaks and deliberate prefix hijacks have caused repeated major outages. How to detect them, prevent them, and protect your AS from the blast radius when others make mistakes.