Dynamic BGP Peers
This chapter provides information about dynamic BGP peers.
Topics in this chapter include:
Applicability
This chapter was initially written for SR OS Release 14.0.R7, but the MD-CLI in the latest update corresponds to SR OS Release 26.7.R1.
Overview
SR OS supports static and dynamic BGP sessions, where the static sessions are initiated toward explicitly configured non-passive neighbors, which are identified through an IPv4 or IPv6 address.
Neighbors must be part of a BGP peer group, and all neighbors in the same group share the same characteristics unless more specific characteristics are defined at the neighbor level.
SR OS initiates TCP sessions toward explicitly configured non-passive neighbors, and listen for incoming TCP connections on port 179 for these configured neighbors. Sessions established with explicitly configured neighbors are considered static BGP sessions.
Dynamic BGP sessions can be established without explicitly configured neighbors; see Establishing dynamic BGP sessions. The source address of a dynamic peer should match one of the configured IPv4 or IPv6 prefixes for the allowed peer Autonomous Systems (ASs). SR OS only listens for incoming TCP connections on port 179 for these prefixes (which defines passive mode). SR OS never initiates connections toward dynamic peers. This is consistent with RFC 4271, which allows a BGP speaker to accept connections from unconfigured BGP peers.
Dynamic BGP peering is also supported for ESM-routed subscriber hosts to improve deployment flexibility, but this is out of the scope of this chapter.
Characteristics
In SR OS, BGP groups and dynamic BGP peers have the following characteristics:
-
A BGP group can support static and dynamic peers simultaneously.
-
To support dynamic, unconfigured peers, multiple prefixes (IPv4/IPv6) in multiple allowed peer ASs can be associated with a group.
-
A dynamic peer is associated with a group, based on the source IP address of an incoming TCP connection. If multiple overlapping prefixes match, the prefix with the longest prefix length is used.
-
A maximum number of dynamic peers can be configured per group and for the entire BGP instance. Whenever an incoming connection for a new dynamic session would cause either a group limit or the overall BGP limit to be exceeded, the connection attempt is rejected with a BGP Notification message.
-
Dynamic peers are supported in the base router as well as in VPRN BGP instances.
Behavior
When a dynamic session is established, the following behavior is observed when changes are made:
-
If a new prefix entry is added to a group and this entry becomes the longest prefix match for the IP address, then the session remains up, without interruption, if the new entry belongs to the same group as the one previously used to set up the dynamic session.
-
If a new prefix entry is added to a group and this entry becomes the longest prefix match for the IP address, then the session is torn down immediately if the new entry belongs to a different group from the one previously used to set up the dynamic session. When the remote end attempts to reestablish the session, the parameters used locally are inherited from the new group.
-
If a neighbor command is added to any group and its IP address matches the source IP address of an established dynamic session, then the dynamic session is torn down and the new session that is established inherits its local parameters from the neighbor configuration.
Using dynamic BGP peers can reduce the configuration file size of an SR OS router considerably, and is mainly used on route reflectors.
Configuration
In this section, the following two examples are shown:
Dynamic BGP peers on a route reflector in an AS
Dynamic BGP peers shows the example topology, and has the following characteristics:
-
All nodes are part of AS 64496.
-
BGP sessions are established between the routers of AS 64496, using RR-5 as route reflector with PE-1, PE-2, PE-3, and PE-4 being the route reflector clients.
The initial configuration on the nodes includes:
-
cards, MDAs, and ports
-
router interfaces
-
IS-IS between the routers
BGP is configured between the route reflector clients and the route reflector for the IPv4 address family. The configuration on PE-1 is as follows:
# on PE-1:
configure {
router "Base" {
autonomous-system 64496
bgp {
loop-detect discard-route
split-horizon true
group "grp-IBGP" {
peer-as 64496
}
neighbor "192.0.2.5" {
group "grp-IBGP"
}
The BGP configuration on PE-2 is as follows. The BGP configuration on PE-3 and PE-4 is similar, but the prefix-lists are different.
# on PE-2:
configure {
policy-options {
prefix-list "local-lb" {
prefix 172.31.2.0/24 type exact {
}
}
policy-statement "exp-local-lb" {
entry 10 {
from {
prefix-list ["local-lb"]
}
action {
action-type accept
}
}
}
}
router "Base" {
autonomous-system 64496
bgp {
loop-detect discard-route
split-horizon true
group "grp-IBGP" {
peer-as 64496
export {
policy ["exp-local-lb"]
}
}
neighbor "192.0.2.5" {
group "grp-IBGP"
}
The initial route reflector RR-5 BGP configuration is as follows:
# on RR-5:
configure {
router "Base" {
autonomous-system 64496
bgp {
loop-detect discard-route
split-horizon true
dynamic-neighbor-limit 20
group "grp-IBGP" {
peer-as 64496
dynamic-neighbor-limit 10
cluster {
cluster-id 192.0.2.5
}
dynamic-neighbor {
match {
prefix 192.0.2.0/24 {
allowed-peer-as ["64496"]
}
}
}
}
Dynamic neighbors are shown with the "D" flag, as follows:
[/]
A:admin@RR-5# show router bgp summary all
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description
ServiceId AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family)
PktSent OutQ
-------------------------------------------------------------------------------
192.0.2.1(D)
Def. Inst 64496 8 0 00h02m01s 0/0/3 (IPv4)
11 0
192.0.2.2(D)
Def. Inst 64496 9 0 00h02m00s 1/1/2 (IPv4)
10 0
192.0.2.3(D)
Def. Inst 64496 8 0 00h01m46s 1/1/2 (IPv4)
9 0
192.0.2.4(D)
Def. Inst 64496 7 0 00h01m08s 1/1/2 (IPv4)
8 0
The details for neighbor PE-2 show that the session is dynamic, as follows:
[/]
A:admin@RR-5# show router bgp neighbor 192.0.2.2
===============================================================================
BGP Neighbor
===============================================================================
-------------------------------------------------------------------------------
Peer : 192.0.2.2
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 50786
Peer Address : 192.0.2.2
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
Min Hold Time : 0
Active Hold Time : 90 Active Keep Alive : 30
Cluster Id : 192.0.2.5
---snip---
-------------------------------------------------------------------------------
Neighbors shown : 1
===============================================================================
* indicates that the corresponding row element may have been truncated.
The BGP configuration on route reflector RR-5 is modified with static BGP neighbor PE-1, as follows:
# on RR-5:
configure {
router "Base" {
autonomous-system 64496
bgp {
loop-detect discard-route
split-horizon true
dynamic-neighbor-limit 20
group "grp-IBGP" {
peer-as 64496
dynamic-neighbor-limit 10
cluster {
cluster-id 192.0.2.5
}
dynamic-neighbor {
match {
prefix 192.0.2.0/24 {
allowed-peer-as ["64496"]
}
}
}
}
neighbor "192.0.2.1" { # defines PE-1 as a static neighbor
group "grp-IBGP"
keepalive 20
hold-time {
seconds 60
}
}
Therefore, the properties of BGP group grp-IBGP are as follows:
[/]
A:admin@RR-5# show router bgp group grp-IBGP
===============================================================================
BGP Group : grp-IBGP
===============================================================================
Group : grp-IBGP
Description : (Not Specified)
Group Type : No Type State : Up
Peer AS : 64496 Local AS : 64496
AS Override : Disabled
Local Address : n/a Loop Detect : Discard
Import Policy : None Specified
Export Policy : None Specified
Hold Time : 90 Keep Alive : 30
Min Hold Time : 0
Cluster Id : 192.0.2.5 Client Reflect : Enabled
NLRI : Unicast Preference : 170
TTL Security : Disabled Min TTL Value : n/a
Graceful Restart : Disabled Stale Routes Time: n/a
Restart Time : n/a
Auth key chain : n/a
Bfd Enabled : Disabled Disable Cap Nego : Disabled
Creation Origin : manual
Default Route Tgt: Disabled
Aigp Metric : Disabled
Split Horizon : Enabled
Damp Peer Oscill*: Disabled
GR Notification : Disabled Fault Tolerance : Disabled
Next-Hop Unchang*: n/a
Egress Engineeri*: Disabled
SRv6 : Disabled SRv6 Route Adver*: Disabled
Drop SRv6 Routes : Disabled
List of Static Peers
- 192.0.2.1 :
List of Dynamic Peers
- 192.0.2.2
- 192.0.2.3
- 192.0.2.4
Total Peers : 4 Established : 4
-------------------------------------------------------------------------------
Peer Groups : 1
===============================================================================
* indicates that the corresponding row element may have been truncated.
The BGP session toward PE-1 is static. The shorter session time is an indication that the BGP session toward PE-1 has been reestablished, as follows:
[/]
A:admin@RR-5# show router bgp summary all
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description
ServiceId AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family)
PktSent OutQ
-------------------------------------------------------------------------------
192.0.2.1
Def. Inst 64496 8 0 00h01m22s 0/0/3 (IPv4)
11 0
192.0.2.2(D)
Def. Inst 64496 12 0 00h03m39s 1/1/2 (IPv4)
13 0
192.0.2.3(D)
Def. Inst 64496 12 0 00h03m37s 1/1/2 (IPv4)
13 0
192.0.2.4(D)
Def. Inst 64496 12 0 00h03m46s 1/1/2 (IPv4)
13 0
Reestablishment of the BGP session is also indicated in log 99, as follows:
137 2026/09/02 06:11:37.790 UTC MINOR: BGP #2038 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: moved into established state"
136 2026/09/02 06:11:37.780 UTC WARNING: BGP #2011 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: remote end closed connection"
135 2026/09/02 06:11:37.780 UTC WARNING: BGP #2005 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: sending notification: code CEASE subcode CONN_COLL_RES"
134 2026/09/02 06:11:37.769 UTC WARNING: BGP #2005 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: sending notification: code CEASE subcode CONFIG_CHG"
133 2026/09/02 06:11:37.769 UTC WARNING: BGP #2039 Base Peer 1: 192.0.2.1
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.1: moved from higher state ESTABLISHED to lower state IDLE due to event CONFIG_CHG"
New and more specific settings for the hold time and the keepalive interval apply to static neighbor PE-1, as follows:
[/]
A:admin@RR-5# show router bgp neighbor 192.0.2.1
===============================================================================
BGP Neighbor
===============================================================================
-------------------------------------------------------------------------------
Peer : 192.0.2.1
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 50767
Peer Address : 192.0.2.1
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : No
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 60 Keep Alive : 20
Min Hold Time : 0
Active Hold Time : 60 Active Keep Alive : 20
Cluster Id : 192.0.2.5
---snip---
The properties of all dynamic peers can be displayed using a single command, as follows:
[/]
A:admin@RR-5# show router bgp neighbor dynamic | match "Peer AS" pre-lines 5 post-lines 11
-------------------------------------------------------------------------------
Peer : 192.0.2.2
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 50786
Peer Address : 192.0.2.2
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
-------------------------------------------------------------------------------
Peer : 192.0.2.3
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 49359
Peer Address : 192.0.2.3
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
-------------------------------------------------------------------------------
Peer : 192.0.2.4
Description : (Not Specified)
Group : grp-IBGP
-------------------------------------------------------------------------------
Peer AS : 64496 Peer Port : 50431
Peer Address : 192.0.2.4
Local AS : 64496 Local Port : 179
Local Address : 192.0.2.5
Peer Type : Internal Dynamic Peer : Yes
State : Established Last State : OpenConfirm
Last Event : recvOpen
Last Error : Cease (Connection Collision Resolution)
AS Override : Disabled
Local Family : IPv4
Remote Family : IPv4
Hold Time : 90 Keep Alive : 30
Lowering the dynamic peer limit does not tear down any existing BGP sessions, as follows:
# on RR-5:
configure {
router "Base" {
bgp {
group "grp-IBGP" {
dynamic-neighbor-limit 2
}
A hard reset of a running BGP session results in that BGP session being torn down, as follows:
[/]
A:admin@RR-5# clear router bgp neighbor 192.0.2.4 hard
The BGP peer fails to reconnect to the route reflector, because the peer limit has been reached, as follows:
142 2026/09/02 06:17:10.300 UTC MINOR: BGP #2037 Base VR 1: Group grp-IBGP
"192.0.2.4: Closing connection: reached dynamic peer limit (2) for BGP group grp-IBGP"
141 2026/09/02 06:17:10.290 UTC WARNING: BGP #2005 Base Peer 1: 192.0.2.4
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.4: sending notification: code CEASE subcode HARD_RESET"
140 2026/09/02 06:17:10.290 UTC WARNING: BGP #2039 Base Peer 1: 192.0.2.4
"(ASN 64496) VR 1: Group grp-IBGP: Peer 192.0.2.4: moved from higher state ESTABLISHED to lower state IDLE due to event ADMIN_RESET_HARD"
139 2026/09/02 06:17:10.277 UTC INDETERMINATE: LOGGER #2010 Base Clear BGP
"Clear function clearRtrBgpNbr has been run with parameters: rtr-name="Base" neighbor="192.0.2.4" type="hard". The completion result is: success. Additional error text, if any, is: "
Dynamic BGP peers in multiple ASs
In SR OS Release 19.5.R1 and later, dynamic BGP sessions associated with a single BGP peer group can belong to different peer Autonomous Systems (ASs), both in the base router and in VPRNs. Example topology with VPRN 1 in different ASs shows the example topology with VPRN 1 configured in different ASs. Each interface in VPRN 1 has an IPv4 and an IPv6 address.
EBGP sessions are established between VPRN 1 on PE-1 and VPRN 1 on the other nodes. In VPRN 1 on PE-2, PE-3, and PE-4, static BGP neighbors are configured. The VPRN configuration on PE-2 is as follows:
# on PE-2:
configure {
service {
vprn "VPRN 1" {
admin-state enable
service-id 1
customer "1"
autonomous-system 64502
router-id 172.31.0.2
bgp {
split-horizon true
group "grp-EBGPv4" {
next-hop-self true
peer-as 64501
family {
ipv4 true
}
export {
policy ["exp-vprn-1-v4"]
}
import {
policy ["1:1"]
}
}
group "grp-EBGPv6" {
next-hop-self true
peer-as 64501
family {
ipv6 true
}
export {
policy ["exp-vprn-1-v6"]
}
import {
policy ["1:1"]
}
}
neighbor "172.16.12.1" {
group "grp-EBGPv4"
}
neighbor "2001:db8::12:1" {
group "grp-EBGPv6"
}
}
interface "int-VPRN1-PE-2-PE-1" {
ipv4 {
primary {
address 172.16.12.2
prefix-length 30
}
}
sap 1/1/c1/1:1 {
}
ipv6 {
address 2001:db8::12:2 {
prefix-length 126
}
}
}
interface "system" {
loopback true
ipv4 {
primary {
address 172.31.0.2
prefix-length 32
}
}
ipv6 {
address 2001:db8::31:0:2 {
prefix-length 128
}
}
}
}
In VPRN 1 on PE-1, dynamic BGP peering is configured for IPv4 prefixes matching 172.16.0.0/16 in AS 64502 (PE-2) or AS 64504 (PE-4) and IPv6 prefixes matching 2001:db8::/107 ASN range from 64502 (PE-2) to 64503 (PE-3). The BGP configuration in VPRN 1 on PE-1 is as follows:
# on PE-1:
configure {
service {
vprn "VPRN 1" {
bgp {
split-horizon true
group "grp-EBGPv4" {
next-hop-self true
dynamic-neighbor-limit 10
family {
ipv4 true
}
import {
policy ["1:1"]
}
export {
policy ["exp-vprn-1-v4"]
}
dynamic-neighbor {
match {
prefix 172.16.0.0/16 {
allowed-peer-as ["64502" "64504"]
}
}
}
}
group "grp-EBGPv6" {
next-hop-self true
dynamic-neighbor-limit 10
family {
ipv6 true
}
import {
policy ["1:1"]
}
export {
policy ["exp-vprn-1-v6"]
}
dynamic-neighbor {
match {
prefix 2001:db8::/107 {
allowed-peer-as ["64502..64503"]
}
}
}
}
}
A dynamic BGP session can be rejected if receiving neighbor BGP OPEN message does not report an AS number in an allowed list: in the grp-EBGPv4 group, AS 64503 is not allowed and in the grp-EBGPv6 group, AS 64504 is not allowed. PE-1 sends a notification message with code OPEN and subcode INCORRECT_AS to PE-3 in AS 64503 and the following notification is logged in log 99:
171 2026/09/02 06:21:05.909 UTC WARNING: BGP #2005 vprn1 Peer 2: 172.16.13.2
"(ASN 64503) VR 2: Group grp-EBGPv4: Peer 172.16.13.2: sending notification: code OPEN subcode INCORRECT_AS"
When debugging is enabled for BGP OPEN messages and BGP notifications, the following messages are logged on PE-1: a BGP OPEN message received from PE-3 in AS 64503 and a BGP notification with code OPEN and subcode Bad Peer AS.
23 2026/09/02 06:21:05.909 UTC MINOR: DEBUG #2001 vprn1 Peer 2: 172.16.13.2
"Peer 2: 172.16.13.2: NOTIFICATION
Peer 2: 172.16.13.2 - Send BGP NOTIFICATION: Code = 2 (OPEN) Subcode = 2 (Bad Peer AS)
"
22 2026/09/02 06:21:05.909 UTC MINOR: DEBUG #2001 vprn1 BGP
"BGP: OPEN
Peer 2: 172.16.13.2 - Received BGP OPEN: Version 4
AS Num 64503: Holdtime 90: BGP_ID 172.31.0.3: Opt Length 20 (ExtOpt F)
Opt Para: Type CAPABILITY: Length = 18: Data:
Cap_Code GRACEFUL-RESTART: Length 2
Bytes: 0x0 0x78
Cap_Code MP-BGP: Length 4
Bytes: 0x0 0x1 0x0 0x1
Cap_Code ROUTE-REFRESH: Length 0
Cap_Code 4-OCTET-ASN: Length 4
Bytes: 0x0 0x0 0xfb 0xf7 # AS 64503
"
The following BGP summary on PE-1 shows four dynamic BGP neighbors: 172.16.12.2 (in AS 64502), 172.16.14.2 (in AS 64504), 2001:db8::12:2 (in AS 64502), and 2001:db8::13:2 (in AS 64503):
[/]
A:admin@PE-1# show router bgp summary all
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description
ServiceId AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family)
PktSent OutQ
-------------------------------------------------------------------------------
192.0.2.5
Def. Inst 64496 45 0 00h12m35s 2/2/0 (IPv4)
42 0
172.16.12.2(D)
1 64502 13 0 00h04m13s 1/1/1 (IPv4)
13 0
172.16.14.2(D)
1 64504 13 0 00h04m00s 1/1/1 (IPv4)
13 0
2001:db8::12:2(D)
1 64502 13 0 00h04m13s 1/1/1 (IPv6)
13 0
2001:db8::13:2(D)
1 64503 13 0 00h04m07s 1/1/1 (IPv6)
13 0
The following command shows that BGP group grp-EBGPv4 has two dynamic peers (172.16.12.2 and 172.16.14.2) and group grp-EBGPv6 has two dynamic peers (2001:db8::12:2 and 2001:db8::13:2):
[/]
A:admin@PE-1# show router service-name "VPRN 1" bgp group
===============================================================================
BGP Group
===============================================================================
Group : grp-EBGPv4
Description : (Not Specified)
Group Type : No Type State : Up
Peer AS : n/a Local AS : 64501
AS Override : Disabled
Local Address : n/a Loop Detect : Ignore
Import Policy : 1:1
Export Policy : exp-vprn-1-v4
---snip---
List of Static Peers
List of Dynamic Peers
- 172.16.12.2
- 172.16.14.2
Total Peers : 2 Established : 2
Group : grp-EBGPv6
Description : (Not Specified)
Group Type : No Type State : Up
Peer AS : n/a Local AS : 64501
AS Override : Disabled
Local Address : n/a Loop Detect : Ignore
Import Policy : 1:1
Export Policy : exp-vprn-1-v6
---snip---
List of Static Peers
List of Dynamic Peers
- 2001:db8::12:2
- 2001:db8::13:2
Total Peers : 2 Established : 2
-------------------------------------------------------------------------------
Peer Groups : 2
===============================================================================
* indicates that the corresponding row element may have been truncated.Conclusion
The use of dynamic BGP peers provides ISPs the means to reduce the configuration file size for routers. This reduces the number of configuration changes to be made to the network over time, which lowers the operational cost of running the network.