Dynamic BGP Peers
This chapter provides information about dynamic BGP peers.
Topics in this chapter include:
Applicability
This chapter was initially written for SR OS Release 14.0.R7, but the CLI in the latest update corresponds to SR OS Release 26.7.R1.
Overview
SR OS supports static and dynamic BGP sessions, where the static sessions are initiated toward explicitly configured non-passive neighbors, which are identified through an IPv4 or IPv6 address.
Neighbors must be part of a BGP peer group, and all neighbors in the same group share the same characteristics unless more specific characteristics are defined at the neighbor level.
SR OS initiates TCP sessions toward explicitly configured non-passive neighbors, and listen for incoming TCP connections on port 179 for these configured neighbors. Sessions established with explicitly configured neighbors are considered static BGP sessions.
Dynamic BGP sessions can be established without explicitly configured neighbors; see Establishing dynamic BGP sessions. The source address of a dynamic peer should match one of the configured IPv4 or IPv6 prefixes for the allowed peer Autonomous Systems (ASs). SR OS only listens for incoming TCP connections on port 179 for these prefixes (which defines passive mode). SR OS never initiates connections toward dynamic peers. This is consistent with RFC 4271, which allows a BGP speaker to accept connections from unconfigured BGP peers.
Dynamic BGP peering is also supported for ESM-routed subscriber hosts to improve deployment flexibility, but this is out of the scope of this chapter.
Characteristics
In SR OS, BGP groups and dynamic BGP peers have the following characteristics:
A BGP group can support static and dynamic peers simultaneously.
To support dynamic, unconfigured peers, multiple prefixes (IPv4/IPv6) in multiple allowed peer ASs can be associated with a group.
A dynamic peer is associated with a group, based on the source IP address of an incoming TCP connection. If multiple overlapping prefixes match, the prefix with the longest prefix length is used.
A maximum number of dynamic peers can be configured per group and for the entire BGP instance. Whenever an incoming connection for a new dynamic session would cause either a group limit or the overall BGP limit to be exceeded, the connection attempt is rejected with a BGP Notification message.
Dynamic peers are supported in the base router as well as in VPRN BGP instances.
Behavior
When a dynamic session is established, the following behavior is observed when changes are made:
If a new prefix entry is added to a group and this entry becomes the longest prefix match for the IP address, then the session remains up, without interruption, if the new entry belongs to the same group as the one previously used to set up the dynamic session.
If a new prefix entry is added to a group and this entry becomes the longest prefix match for the IP address, then the session is torn down immediately if the new entry belongs to a different group from the one previously used to set up the dynamic session. When the remote end attempts to reestablish the session, the parameters used locally are inherited from the new group.
If a neighbor command is added to any group and its IP address matches the source IP address of an established dynamic session, then the dynamic session is torn down and the new session that is established inherits its local parameters from the neighbor configuration.
Using dynamic BGP peers can reduce the configuration file size of an SR OS router considerably, and is mainly used on route reflectors.
Configuration
In this section, the following two examples are shown:
Dynamic BGP peers on a route reflector in an AS
Dynamic BGP peers shows the example topology, and has the following characteristics:
All nodes are part of AS 64496.
BGP sessions are established between the routers of AS 64496, using RR-5 as route reflector with PE-1, PE-2, PE-3, and PE-4 being the route reflector clients.
The initial configuration on the nodes includes:
cards, MDAs, and ports
router interfaces
IS-IS between the routers
BGP is configured between the route reflector clients and the route reflector for the IPv4 address family. The configuration on PE-1 is as follows:
# on PE-1:
configure
router Base
autonomous-system 64496
bgp
loop-detect discard-route
split-horizon
group "grp-IBGP"
peer-as 64496
neighbor 192.0.2.5
exit
exit
no shutdown
exit
The BGP configuration on the other route reflector clients is similar. Routing policies can be added to export routes.
The initial route reflector RR-5 BGP configuration is as follows:
# on RR-5:
configure
router Base
autonomous-system 64496
bgp
loop-detect discard-route
split-horizon
dynamic-neighbor-limit 20
group grp-IBGP
cluster 192.0.2.5
peer-as 64496
dynamic-neighbor-limit 10
dynamic-neighbor
match
prefix 192.0.2.0/24
allowed-peer-as 64496
exit
exit
exit
exit
no shutdown
exit
Dynamic neighbors are shown with the "D" flag, as follows:
*A:RR-5# show router bgp summary all
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description
ServiceId AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family)
PktSent OutQ
-------------------------------------------------------------------------------
192.0.2.1(D)
Def. Inst 64496 9 0 00h02m31s 0/0/3 (IPv4)
12 0
192.0.2.2(D)
Def. Inst 64496 9 0 00h02m12s 1/1/2 (IPv4)
10 0
192.0.2.3(D)
Def. Inst 64496 9 0 00h02m06s 1/1/2 (IPv4)
10 0
192.0.2.4(D)
Def. Inst 64496 8 0 00h01m34s 1/1/2 (IPv4)
9 0
The details for neighbor PE-2 show that the session is dynamic, as follows:
*A:RR-5# show router bgp neighbor 192.0.2.2
===============================================================================
BGP Neighbor
===============================================================================
-------------------------------------------------------------------------------
Peer : 192.0.2.2
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 50187
Peer Address : 192.0.2.2
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
Min Hold Time : 0
Active Hold Time : 90 Active Keep Alive : 30
Cluster Id : 192.0.2.5
---snip---
-------------------------------------------------------------------------------
Neighbors shown : 1
===============================================================================
* indicates that the corresponding row element may have been truncated.
The BGP configuration on route reflector RR-5 is modified with static BGP neighbor PE-1, as follows:
# on RR-5:
configure
router Base
autonomous-system 64496
bgp
loop-detect discard-route
split-horizon
dynamic-neighbor-limit 20
group grp-IBGP
cluster 192.0.2.5
peer-as 64496
dynamic-neighbor-limit 10
dynamic-neighbor
match
prefix 192.0.2.0/24
allowed-peer-as 64496
exit
exit
exit
neighbor 192.0.2.1 # defines PE-1 as a static neighbor
keepalive 20
hold-time 60
exit
exit
no shutdown
exit
Therefore, the properties of BGP group grp-IBGP are as follows:
*A:RR-5# show router bgp group "grp-IBGP"
===============================================================================
BGP Group : grp-IBGP
===============================================================================
Group : grp-IBGP
Description : (Not Specified)
Group Type : No Type State : Up
Peer AS : 64496 Local AS : 64496
AS Override : Disabled
Local Address : n/a Loop Detect : Discard
Import Policy : None Specified
Export Policy : None Specified
Hold Time : 90 Keep Alive : 30
Min Hold Time : 0
Cluster Id : 192.0.2.5 Client Reflect : Enabled
NLRI : Unicast Preference : 170
TTL Security : Disabled Min TTL Value : n/a
Graceful Restart : Disabled Stale Routes Time: n/a
Restart Time : n/a
Auth key chain : n/a
Bfd Enabled : Disabled Disable Cap Nego : Disabled
Creation Origin : manual
Default Route Tgt: Disabled
Aigp Metric : Disabled
Split Horizon : Enabled
Damp Peer Oscill*: Disabled
GR Notification : Disabled Fault Tolerance : Disabled
Next-Hop Unchang*: n/a
Egress Engineeri*: Disabled
SRv6 : Disabled SRv6 Route Adver*: Disabled
Drop SRv6 Routes : Disabled
List of Static Peers
- 192.0.2.1 :
List of Dynamic Peers
- 192.0.2.2
- 192.0.2.3
- 192.0.2.4
Total Peers : 4 Established : 4
-------------------------------------------------------------------------------
Peer Groups : 1
===============================================================================
* indicates that the corresponding row element may have been truncated.
The BGP session toward PE-1 is static. The shorter session time is an indication that the BGP session toward PE-1 has been reestablished, as follows:
*A:RR-5# show router bgp summary all
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description
ServiceId AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family)
PktSent OutQ
-------------------------------------------------------------------------------
192.0.2.1
Def. Inst 64496 7 0 00h01m07s 0/0/3 (IPv4)
10 0
192.0.2.2(D)
Def. Inst 64496 14 0 00h04m45s 1/1/2 (IPv4)
15 0
192.0.2.3(D)
Def. Inst 64496 14 0 00h04m39s 1/1/2 (IPv4)
15 0
192.0.2.4(D)
Def. Inst 64496 13 0 00h04m07s 1/1/2 (IPv4)
14 0
Reestablishment of the BGP session is also indicated in log 99, as follows:
134 2026/09/01 11:57:41.009 UTC MINOR: BGP #2038 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: moved into established state"
133 2026/09/01 11:57:41.000 UTC WARNING: BGP #2011 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: remote end closed connection"
132 2026/09/01 11:57:41.000 UTC WARNING: BGP #2005 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: sending notification: code CEASE subcode CONN_COLL_RES"
131 2026/09/01 11:57:40.979 UTC WARNING: BGP #2039 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: moved from higher state ACTIVE to lower state IDLE due to event CONFIG_CHG"
130 2026/09/01 11:57:40.970 UTC WARNING: BGP #2011 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: remote end closed connection"
129 2026/09/01 11:57:40.970 UTC WARNING: BGP #2005 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: sending notification: code CEASE subcode CONFIG_CHG"
128 2026/09/01 11:57:40.970 UTC WARNING: BGP #2039 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: moved from higher state CONNECT to lower state IDLE due to event CONFIG_CHG"
127 2026/09/01 11:57:40.959 UTC WARNING: BGP #2005 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: sending notification: code CEASE subcode CONFIG_CHG"
126 2026/09/01 11:57:40.959 UTC WARNING: BGP #2039 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: moved from higher state ESTABLISHED to lower state IDLE due to event CONFIG_CHG"
New and more specific settings for the hold time and the keepalive interval apply to static neighbor PE-1, as follows:
*A:RR-5# show router bgp neighbor 192.0.2.1
===============================================================================
BGP Neighbor
===============================================================================
-------------------------------------------------------------------------------
Peer : 192.0.2.1
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 49678
Peer Address : 192.0.2.1
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : No
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 60 Keep Alive : 20
Min Hold Time : 0
Active Hold Time : 60 Active Keep Alive : 20
Cluster Id : 192.0.2.5
---snip---
The properties of all dynamic peers can be displayed using a single command, as follows:
*A:RR-5# show router bgp neighbor dynamic | match "Peer AS" pre-lines 5 post-lines 11
-------------------------------------------------------------------------------
Peer : 192.0.2.2
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 50187
Peer Address : 192.0.2.2
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
-------------------------------------------------------------------------------
Peer : 192.0.2.3
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 50040
Peer Address : 192.0.2.3
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
-------------------------------------------------------------------------------
Peer : 192.0.2.4
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 49561
Peer Address : 192.0.2.4
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
Lowering the dynamic peer limit does not tear down any existing BGP sessions, as follows:
# on RR-5:
configure
router Base
bgp
group grp-IBGP
dynamic-neighbor-limit 2
exitA hard reset of a running BGP session results in that BGP session being torn down, as follows:
*A:RR-5# clear router bgp neighbor 192.0.2.4 hard
The BGP peer fails to reconnect to the route reflector, because the peer limit has been reached, as follows:
138 2026/09/01 12:06:14.760 UTC MINOR: BGP #2037 Base VR 1: Group grp-IBGP
"192.0.2.4: Closing connection: reached dynamic peer limit (2) for BGP group grp-IBGP"
137 2026/09/01 12:06:14.749 UTC WARNING: BGP #2005 Base Peer 1: 192.0.2.4
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.4: sending notification: code CEASE subcode HARD_RESET"
136 2026/09/01 12:06:14.749 UTC WARNING: BGP #2039 Base Peer 1: 192.0.2.4
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.4: moved from higher state ESTABLISHED to lower state IDLE due to event ADMIN_RESET_HARD"
135 2026/09/01 12:06:14.733 UTC INDETERMINATE: LOGGER #2010 Base Clear BGP
"Clear function clearRtrBgpNbr has been run with parameters: rtr-name="Base" neighbor="192.0.2.4" type="hard". The completion result is: success. Additional error text, if any, is: "
Dynamic BGP peers in multiple ASs
In SR OS Release 19.5.R1 and later, dynamic BGP sessions associated with a single BGP peer group can belong to different peer Autonomous Systems (ASs), both in the base router and in VPRNs. Example topology with VPRN 1 in different ASs shows the example topology with VPRN 1 configured in different ASs. Each interface in VPRN 1 has an IPv4 and an IPv6 address.
EBGP sessions are established between VPRN 1 on PE-1 and VPRN 1 on the other nodes. In VPRN 1 on PE-2, PE-3, and PE-4, static BGP neighbors are configured. The VPRN configuration on PE-2 is as follows:
# on PE-2:
configure
service
vprn 1 name "VPRN 1" customer 1 create
autonomous-system 64502
router-id 172.31.0.2
interface "int-VPRN1-PE-2-PE-1" create
address 172.16.12.2/30
ipv6
address 2001:db8::12:2/126
exit
sap 1/1/c1/1:1 create
exit
exit
interface "system" create
address 172.31.0.2/32
ipv6
address 2001:db8::31:0:2/128
exit
loopback
exit
bgp
split-horizon
group grp-EBGPv4
family ipv4
next-hop-self
peer-as 64501
neighbor 172.16.12.1
export "exp-vprn-1-v4"
exit
exit
group grp-EBGPv6
family ipv6
next-hop-self
peer-as 64501
neighbor 2001:db8::12:1
export "exp-vprn-1-v6"
exit
exit
exit
no shutdown
In VPRN 1 on PE-1, dynamic BGP peering is configured for IPv4 prefixes matching 172.16.0.0/16 in AS 64502 (PE-2) or AS 64504 (PE-4) and IPv6 prefixes matching 2001:db8::/107 ASN range from 64502 (PE-2) to 64503 (PE-3). The BGP configuration in VPRN 1 on PE-1 is as follows:
# on PE-1:
configure
service
vprn 1 name "VPRN 1" customer 1 create
bgp
split-horizon
group "grp-EBGPv4"
family ipv4
next-hop-self
export "exp-vprn-1-v4"
dynamic-neighbor-limit 10
dynamic-neighbor
match
prefix 172.16.0.0/16
allowed-peer-as 64502
allowed-peer-as 64504
exit
exit
exit
exit
group "grp-EBGPv6"
family ipv6
next-hop-self
export "exp-vprn-1-v6"
dynamic-neighbor-limit 10
dynamic-neighbor
match
prefix 2001:db8::/107
allowed-peer-as 64502 max 64503
exit
exit
exit
exit
exit
A dynamic BGP session can be rejected if receiving neighbor BGP OPEN message does not report an AS number in an allowed list: in the grp-EBGPv4 group, AS 64503 is not allowed and in the grp-EBGPv6 group, AS 64504 is not allowed. PE-1 sends a notification message with code OPEN and subcode INCORRECT_AS to PE-3 in AS 64503 and the following notification is logged in log 99:
172 2026/09/01 12:12:01.095 UTC WARNING: BGP #2005 vprn1 Peer 2: 172.16.13.2
"(ASN 64503) VR 2: Group grp-EBGPv4: Peer 172.16.13.2: sending notification: code OPEN subcode INCORRECT_AS"
When debugging is enabled for BGP OPEN messages and BGP notifications, the following messages are logged on PE-1: a BGP OPEN message received from PE-3 in AS 64503 and a BGP notification with code OPEN and subcode Bad Peer AS.
46 2026/09/01 12:12:31.096 UTC MINOR: DEBUG #2001 vprn1 Peer 2: 172.16.13.2
"Peer 2: 172.16.13.2: NOTIFICATION
Peer 2: 172.16.13.2 - Send BGP NOTIFICATION: Code = 2 (OPEN) Subcode = 2 (Bad Peer AS)
"
45 2026/09/01 12:12:31.096 UTC MINOR: DEBUG #2001 vprn1 BGP
"BGP: OPEN
Peer 2: 172.16.13.2 - Received BGP OPEN: Version 4
AS Num 64503: Holdtime 90: BGP_ID 172.31.0.3: Opt Length 20 (ExtOpt F)
Opt Para: Type CAPABILITY: Length = 18: Data:
Cap_Code GRACEFUL-RESTART: Length 2
Bytes: 0x0 0x78
Cap_Code MP-BGP: Length 4
Bytes: 0x0 0x1 0x0 0x1
Cap_Code ROUTE-REFRESH: Length 0
Cap_Code 4-OCTET-ASN: Length 4
Bytes: 0x0 0x0 0xfb 0xf7 # AS 64503
"
The following BGP summary on PE-1 shows four dynamic BGP neighbors: 172.16.12.2 (in AS 64502), 172.16.14.2 (in AS 64504), 2001:db8::12:2 (in AS 64502), and 2001:db8::13:2 (in AS 64503):
A:PE-1# show router bgp summary all
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description
ServiceId AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family)
PktSent OutQ
-------------------------------------------------------------------------------
192.0.2.5
Def. Inst 64496 54 0 00h15m34s 2/2/0 (IPv4)
52 0
172.16.12.2(D)
1 64502 9 0 00h02m20s 1/1/2 (IPv4)
10 0
172.16.14.2(D)
1 64504 9 0 00h02m06s 1/1/2 (IPv4)
10 0
2001:db8::12:2(D)
1 64502 9 0 00h02m20s 1/1/2 (IPv6)
10 0
2001:db8::13:2(D)
1 64503 9 0 00h02m14s 1/1/2 (IPv6)
10 0
The following command shows that BGP group grp-EBGPv4 has two dynamic peers (172.16.12.2 and 172.16.14.2) and group grp-EBGPv6 has two dynamic peers (2001:db8::12:2 and 2001:db8::13:2):
*A:PE-1# show router service-name "VPRN 1" bgp group
===============================================================================
BGP Group
===============================================================================
Group : grp-EBGPv4
Description : (Not Specified)
Group Type : No Type State : Up
Peer AS : n/a Local AS : 64501
AS Override : Disabled
Local Address : n/a Loop Detect : Ignore
Import Policy : None Specified
Export Policy : exp-vprn-1-v4
---snip---
List of Static Peers
List of Dynamic Peers
- 172.16.12.2
- 172.16.14.2
Total Peers : 2 Established : 2
Group : grp-EBGPv6
Description : (Not Specified)
Group Type : No Type State : Up
Peer AS : n/a Local AS : 64501
AS Override : Disabled
Local Address : n/a Loop Detect : Ignore
Import Policy : None Specified
Export Policy : exp-vprn-1-v6
---snip---
List of Static Peers
List of Dynamic Peers
- 2001:db8::12:2
- 2001:db8::13:2
Total Peers : 2 Established : 2
-------------------------------------------------------------------------------
Peer Groups : 2
===============================================================================
* indicates that the corresponding row element may have been truncated.Conclusion
The use of dynamic BGP peers provides ISPs the means to reduce the configuration file size for routers. This reduces the number of configuration changes to be made to the network over time, which lowers the operational cost of running the network.