Dynamic BGP Peers
This chapter provides information about dynamic BGP peers.
Topics in this chapter include:
Applicability
The CLI in the latest update corresponds to SR Linux Release 26.10.1.
Overview
SR Linux supports static and dynamic BGP sessions, where the static sessions are initiated toward explicitly configured non-passive neighbors, which are identified through an IPv4 or IPv6 address.
Neighbors must be part of a BGP peer group, and all neighbors in the same group share the same characteristics unless more specific characteristics are defined at the neighbor level.
SR Linux initiates TCP sessions toward explicitly configured non-passive neighbors, and listens for incoming TCP connections on port 179 for these configured neighbors. Sessions established with explicitly configured neighbors are considered static BGP sessions.
Dynamic BGP sessions can be established without explicitly configured neighbors; see Establishing dynamic BGP sessions. The source address of a dynamic peer should match one of the configured IPv4 or IPv6 prefixes for the allowed peer Autonomous Systems (ASs). SR Linux only listens for incoming TCP connections on port 179 for these prefixes (which defines passive mode). SR Linux never initiates connections toward dynamic peers. This is consistent with RFC 4271, which allows a BGP speaker to accept connections from unconfigured BGP peers.
Dynamic BGP peering is also supported for Enhanced Subscriber Management routed subscriber hosts to improve deployment flexibility, but this is out of the scope of this chapter.
Characteristics
In SR Linux, BGP groups and dynamic BGP peers have the following characteristics:
-
A BGP group can support static and dynamic peers simultaneously.
-
To support dynamic, unconfigured peers, multiple prefixes (IPv4/IPv6) in multiple allowed peer ASs can be associated with a group.
-
A dynamic peer is associated with a group, based on the source IP address of an incoming TCP connection. If multiple overlapping prefixes match, the prefix with the longest prefix length is used.
-
A maximum number of dynamic peers can be configured for the entire BGP instance. Whenever an incoming connection for a new dynamic session would cause the limit to be exceeded, the connection attempt is rejected with a BGP Notification message.
-
Dynamic peers are supported in the default network instance as well as in IP VRF BGP instances.
Behavior
When a dynamic session is established, the following behavior is observed when changes are made:
-
If a new prefix entry is added to a group and this entry becomes the longest prefix match for the IP address, then the session remains up, without interruption, if the new entry belongs to the same group as the one previously used to set up the dynamic session.
-
If a new prefix entry is added to a group and this entry becomes the longest prefix match for the IP address, then the session is torn down immediately if the new entry belongs to a different group from the one previously used to set up the dynamic session. When the remote end attempts to reestablish the session, the parameters used locally are inherited from the new group.
-
If a static neighbor is added to any group and its IP address matches the source IP address of an established dynamic session, then the dynamic session is torn down and the new session that is established inherits its local parameters from the neighbor configuration.
Using dynamic BGP peers can reduce the configuration file size of an SR Linux router considerably, and is mainly used on route reflectors.
Configuration
In this section, the following two examples are shown:
Dynamic BGP peers on a route reflector in an AS
Dynamic BGP peers shows the example topology, and has the following characteristics:
-
All nodes are part of AS 64496.
-
BGP sessions are established between the routers of AS 64496, using RR-5 as route reflector with PE-1, PE-2, PE-3, and PE-4 being the route reflector clients.
The initial configuration on the nodes includes:
-
cards, MDAs, and ports
-
router interfaces
-
IS-IS between the routers
BGP is configured between the route reflector clients and the route reflector for the IPv4 address family. The configuration on PE-1 is as follows:
# on PE-1:
enter candidate
network-instance default {
protocols {
bgp {
admin-state enable
autonomous-system 64496
router-id 192.0.2.1
afi-safi ipv4-unicast {
admin-state enable
}
group grp-IBGP {
peer-as 64496
}
neighbor 192.0.2.5 {
peer-group grp-IBGP
}
}
The BGP configuration on PE-2 is as follows. The BGP configuration on PE-3 and PE-4 is similar, but the prefix-lists are different.
# on PE-2:
enter candidate
routing-policy {
prefix-set ps-lo0.0 {
prefix 172.31.2.0/24 mask-length-range 24..24 {
}
}
policy rp-export-lo0.0 {
statement stmt-10 {
match {
prefix {
prefix-set ps-lo0.0
}
}
action {
policy-result accept
}
}
}
}
network-instance default {
protocols {
bgp {
admin-state enable
autonomous-system 64496
router-id 192.0.2.2
afi-safi ipv4-unicast {
admin-state enable
}
group grp-IBGP {
peer-as 64496
export-policy [
rp-export-lo0.0
]
}
neighbor 192.0.2.5 {
peer-group grp-IBGP
}
}
}
}
The initial route reflector RR-5 BGP configuration is as follows:
# on RR-5:
enter candidate
network-instance default {
protocols {
bgp {
admin-state enable
router-id 192.0.2.5
autonomous-system 64496
afi-safi ipv4-unicast {
admin-state enable
}
trace-options {
flag open {
}
flag notification {
}
}
route-reflector {
client true
cluster-id 192.0.2.5
}
group grp-IBGP {
peer-as 64496
}
dynamic-neighbors {
accept {
max-sessions 10 # dynamic neighbor limit
match 192.0.2.0/24 {
peer-group grp-IBGP
allowed-peer-as [ 64496 ]
}
}
}
Dynamic neighbors are shown with the "D" flag, as follows:
--{ + running }--[ ]--
A:admin@RR-5# show network-instance default protocols bgp neighbor
----------------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "default"
Peer flags: see legend after the summary when applicable.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------------------------------------
+------------------+--------------------------+------------------+------+----------+--------------+--------------+-------------------------------------+
| Net-Inst | Peer | Group | Flag | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
| | | | s | | | | |
+==================+==========================+==================+======+==========+==============+==============+=====================================+
| default | 192.0.2.1 | grp-IBGP | D | 64496 | established | 0d:0h:2m:51s | ipv4-unicast [0/0/3] |
| default | 192.0.2.2 | grp-IBGP | D | 64496 | established | 0d:0h:2m:8s | ipv4-unicast [1/1/2] |
| default | 192.0.2.3 | grp-IBGP | D | 64496 | established | 0d:0h:2m:3s | ipv4-unicast [1/1/2] |
| default | 192.0.2.4 | grp-IBGP | D | 64496 | established | 0d:0h:1m:46s | ipv4-unicast [1/1/2] |
+------------------+--------------------------+------------------+------+----------+--------------+--------------+-------------------------------------+
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
0 configured neighbors, 0 configured sessions are established, 0 disabled peers
4 dynamic peers
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
D Dynamic neighbor
The following shows the details for dynamic neighbor PE-2. The properties, such as the keepalive interval and the hold time have default values.
--{ + running }--[ ]--
A:admin@RR-5# show network-instance default protocols bgp neighbor 192.0.2.2 detail
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.2, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
Export policies : []
Import policies: []
Under maintenance: False
Maintenance group:
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Admin-state is enable, session-state is established, up for 0d:0h:2m:37s
TCP connection is 192.0.2.5 [43395] -> 192.0.2.2 [179]
TCP-MD5 authentication is disabled
0 messages in input queue, 0 messages in output queue
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Last-state was openconfirm, last-event was recvOpen, 1 peer-flaps
Last establish exit event: N/A
Last received Notification was Error: None SubError: None
Failure detection: BFD is False, fast-failover is True
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Graceful Restart
Admin State : disable
Restarts by the peer : None
Last restart : N/A
Peer requested restart-time : None
Stale routes time : None
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Timer Configured Operational Next
===========================================================================================================================================================
connect-retry 120 120 -
keepalive-interval 30 30 -
hold-time 90 90 -
minimum-advertisement-interval 5 5 -
prefix-limit-restart-timer 0 0 -
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Cap Sent: ROUTE_REFRESH 4-OCTET_ASN MP_BGP GRACEFUL_RESTART
Cap Recv: ROUTE_REFRESH 4-OCTET_ASN MP_BGP GRACEFUL_RESTART
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Messages Sent Received Last
===========================================================================================================================================================
Non Updates 8 8
Updates 3 2 2026-09-
09T13:20:40.
800Z
Malformed updates 0 0
Route Refreshes 0 0
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Ipv4-unicast AFI/SAFI
End of RIB : sent, received
Received routes : 1
Rejected routes : None
Active routes : 1
Advertised routes : 2
Prefix-limit-received : 4294967295 routes, warning at 90, prevent-teardown False
Prefix-limit-accepted : None
Default originate : disabled
Advertise with IPv6 next-hops : False
Peer requested GR helper : None
Peer preserved forwarding state: None
----------------------------------------------------------------------------------------------------------------------------------------------------------------
The BGP configuration on route reflector RR-5 is modified as follows: neighbor PE-1 is configured as a static neighbor with non-default values for keepalive interval and hold time, as follows:
# on RR-5:
enter candidate
network-instance default {
protocols {
bgp {
admin-state enable
router-id 192.0.2.5
autonomous-system 64496
afi-safi ipv4-unicast {
admin-state enable
}
trace-options {
flag open {
}
flag notification {
}
}
route-reflector {
client true
cluster-id 192.0.2.5
}
group grp-IBGP {
peer-as 64496
}
dynamic-neighbors {
accept {
max-sessions 10 # dynamic neighbor limit
match 192.0.2.0/24 {
peer-group grp-IBGP
allowed-peer-as [ 64496 ]
}
}
}
neighbor 192.0.2.1 { # static neighbor
peer-group grp-IBGP
timers {
keepalive-interval 20 # default: 30
hold-time 60 # default: 90
}
}
The BGP session toward PE-1 is static. The shorter session time is an indication that the BGP session toward PE-1 has been reestablished, as follows:
--{ + running }--[ ]--
A:admin@RR-5# show / network-instance default protocols bgp neighbor
--------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "default"
Peer flags: see legend after the summary when applicable.
--------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------
+-------------+------------+------------+-------+---------+--------------+--------------+--------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+=============+============+============+=======+=========+==============+==============+==========================+
| default | 192.0.2.1 | grp-IBGP | S | 64496 | established | 0d:0h:0m:6s | ipv4-unicast [0/0/3] |
| default | 192.0.2.2 | grp-IBGP | D | 64496 | established | 0d:0h:3m:21s | ipv4-unicast [1/1/2] |
| default | 192.0.2.3 | grp-IBGP | D | 64496 | established | 0d:0h:3m:16s | ipv4-unicast [1/1/2] |
| default | 192.0.2.4 | grp-IBGP | D | 64496 | established | 0d:0h:2m:59s | ipv4-unicast [1/1/2] |
+-------------+------------+------------+-------+---------+--------------+--------------+--------------------------+
--------------------------------------------------------------------------------------------------------------------
Summary:
1 configured neighbors, 1 configured sessions are established, 0 disabled peers
3 dynamic peers
---------------------------------------------------------------------------------------------------------------------
Peer flag legend:
S Static neighbor
D Dynamic neighbor
On RR-5, logging is configured, as follows:
# on RR-5:
enter candidate
system {
logging {
buffer debug-messages {
rotate 5
size 5000000
subsystem bgp {
priority {
match-exact [
debug
]
}
}
}
}
}
network-instance default {
protocols {
bgp {
trace-options {
flag open {
}
flag notification {
}
}
}
}
}With the preceding logging configuration, reestablishment of the BGP session can be logged, as follows:
A:admin@RR-5# show / system logging messages debug-messages
2026-09-09T13:23:52.384256+00:00 RR-5 sr_bgp_mgr: bgp|25229|25261|00060|TR||D: VR default (1) Peer 1: 192.0.2.1 NOTIFICATION: Peer 1: 192.0.2.1 - Send BGP NOTIFICATION: Code = 6 (CEASE) Subcode = 6 (Configuration Change)
2026-09-09T13:23:52.394945+00:00 RR-5 sr_bgp_mgr: bgp|25229|25261|00061|TR||D: VR default (1) BGP OPEN: Peer 1: 192.0.2.1 - Send (Passive) BGP OPEN: Version 4
AS Num 64496: Holdtime 60: BGP_ID 192.0.2.5: Opt Length 20 (ExtOpt F)
Opt Para: Type CAPABILITY: Length = 18: Data:
Cap_Code GRACEFUL-RESTART: Length 2
Bytes: 0x1 0x2c
Cap_Code MP-BGP: Length 4
Bytes: 0x0 0x1 0x0 0x1
Cap_Code ROUTE-REFRESH: Length 0
Cap_Code 4-OCTET-ASN: Length 4
Bytes: 0x0 0x0 0xfb 0xf0
2026-09-09T13:23:52.395088+00:00 RR-5 sr_bgp_mgr: bgp|25229|25261|00062|TR||D: VR default (1) BGP OPEN: Peer 1: 192.0.2.1 - Received BGP OPEN: Version 4
AS Num 64496: Holdtime 90: BGP_ID 192.0.2.1: Opt Length 20 (ExtOpt F)
Opt Para: Type CAPABILITY: Length = 18: Data:
Cap_Code GRACEFUL-RESTART: Length 2
Bytes: 0x1 0x2c
Cap_Code MP-BGP: Length 4
Bytes: 0x0 0x1 0x0 0x1
Cap_Code ROUTE-REFRESH: Length 0
Cap_Code 4-OCTET-ASN: Length 4
Bytes: 0x0 0x0 0xfb 0xf0
2026-09-09T13:23:52.395110+00:00 RR-5 sr_bgp_mgr: bgp|25229|25261|00064|TR||D: VR default (1) Peer 1: 192.0.2.1 NOTIFICATION: Peer 1: 192.0.2.1 - Send BGP NOTIFICATION: Code = 6 (CEASE) Subcode = 7 (Connection Collision Resolution)
The configured settings for the hold time and the keepalive interval apply to static neighbor PE-1, as follows:
--{ + running }--[ ]--
A:admin@RR-5# show network-instance default protocols bgp neighbor 192.0.2.1 detail
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.1, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : static
Description : None
Group : grp-IBGP
Export policies : []
Import policies: []
Under maintenance: False
Maintenance group:
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Admin-state is enable, session-state is established, up for 0d:0h:1m:34s
TCP connection is 192.0.2.5 [34845] -> 192.0.2.1 [179]
TCP-MD5 authentication is disabled
0 messages in input queue, 0 messages in output queue
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Last-state was openconfirm, last-event was recvOpen, 2 peer-flaps
Last establish exit event: configChange
Last received Notification was Error: None SubError: None
Failure detection: BFD is False, fast-failover is True
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Graceful Restart
Admin State : disable
Restarts by the peer : None
Last restart : N/A
Peer requested restart-time : None
Stale routes time : None
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Timer Configured Operational Next
===========================================================================================================================================================
connect-retry 120 120 -
keepalive-interval 20 20 -
hold-time 60 60 -
minimum-advertisement-interval 5 5 -
prefix-limit-restart-timer 0 0 -
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Cap Sent: ROUTE_REFRESH 4-OCTET_ASN MP_BGP GRACEFUL_RESTART
Cap Recv: ROUTE_REFRESH 4-OCTET_ASN MP_BGP GRACEFUL_RESTART
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Messages Sent Received Last
===========================================================================================================================================================
Non Updates 7 7
Updates 4 1 2026-09-
09T13:23:56.
800Z
Malformed updates 0 0
Route Refreshes 0 0
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Ipv4-unicast AFI/SAFI
End of RIB : sent, received
Received routes : None
Rejected routes : None
Active routes : None
Advertised routes : 3
Prefix-limit-received : 4294967295 routes, warning at 90, prevent-teardown False
Prefix-limit-accepted : None
Default originate : disabled
Advertise with IPv6 next-hops : False
Peer requested GR helper : None
Peer preserved forwarding state: None
----------------------------------------------------------------------------------------------------------------------------------------------------------------
The properties of all static and dynamic peers can be displayed using a single command, as follows:
--{ + running }--[ ]--
A:admin@RR-5# show / network-instance default protocols bgp neighbor * detail | grep 'Peer :' --before-context 1 --after-context 33
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.1, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : static
Description : None
Group : grp-IBGP
---snip---
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Timer Configured Operational Next
===========================================================================================================================================================
connect-retry 120 120 -
keepalive-interval 20 20 -
hold-time 60 60 -
minimum-advertisement-interval 5 5 -
prefix-limit-restart-timer 0 0 -
----------------------------------------------------------------------------------------------------------------------------------------------------------------
--
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.2, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
---snip---
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Timer Configured Operational Next
===========================================================================================================================================================
connect-retry 120 120 -
keepalive-interval 30 30 -
hold-time 90 90 -
minimum-advertisement-interval 5 5 -
prefix-limit-restart-timer 0 0 -
----------------------------------------------------------------------------------------------------------------------------------------------------------------
--
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.3, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
---snip---
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Timer Configured Operational Next
===========================================================================================================================================================
connect-retry 120 120 -
keepalive-interval 30 30 -
hold-time 90 90 -
minimum-advertisement-interval 5 5 -
prefix-limit-restart-timer 0 0 -
----------------------------------------------------------------------------------------------------------------------------------------------------------------
--
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.4, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
---snip---
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Timer Configured Operational Next
===========================================================================================================================================================
connect-retry 120 120 -
keepalive-interval 30 30 -
hold-time 90 90 -
minimum-advertisement-interval 5 5 -
prefix-limit-restart-timer 0 0 -
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Lowering the dynamic peer limit does not tear down any existing BGP sessions, as follows:
# on RR-5:
enter candidate
network-instance default {
protocols {
bgp {
group grp-IBGP {
peer-as 64496
}
dynamic-neighbors {
accept {
max-sessions 2 # lower dynamic neighbor limit
match 192.0.2.0/24 {
peer-group grp-IBGP
allowed-peer-as [
64496
]
}
}
}
The following command shows that three dynamic BGP sessions remain established when the maximum number of dynamic neighbors is lowered to two:
--{ + running }--[ ]--
A:admin@RR-5# show network-instance default protocols bgp neighbor * detail | grep Type --after-context 2 --before-context 2
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.1, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : static
Description : None
Group : grp-IBGP
--
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.2, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
--
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.3, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
--
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.4, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGPA hard reset of a running BGP session results in that BGP session being torn down, as follows:
--{ + running }--[ ]--
A:admin@RR-5# tools / network-instance default protocols bgp neighbor 192.0.2.4 reset-peer
/network-instance[name=default]/protocols/bgp/neighbor[peer-address=192.0.2.4]:
Successfully executed the tools clear command.
The following log messages show that RR-5 initiated an administrative hard reset of the BGP session with dynamic neighbor 192.0.2.4. RR-5 sent a BGP notification, tore down the TCP session, and removed the runtime state of the neighbor.
--{ + running }--[ ]--
A:admin@RR-5# show / system logging file messages | tail -n 50
---snip---
2026-09-09T13:30:29.826 sr_bgp_mgr: bgp|25229|W: In network-instance default, the BGP session with VR default (1): Group grp-IBGP: Peer 192.0.2.4 moved from higher state ESTABLISHED to lower state IDLE due to event ADMIN_RESET_HARD
2026-09-09T13:30:29.826 sr_bgp_mgr: bgp|25229|W: In network-instance default, the BGP session with VR default (1): Group grp-IBGP: Peer 192.0.2.4 was closed because the router sent this neighbor a NOTIFICATION with code CEASE and subcode HARD_RESET
2026-09-09T13:30:29.837 sr_bgp_mgr: debug|25229|W: bgpmgr bgp_mgr.cc:5781 BgpngNeighborDeleted net-inst-id: 10241 neighbor: 192.0.2.4 cleanup done
The following log message states that an incoming BGP connection from PE-4 was rejected because the maximum number of dynamic peers has been reached:
--{ + running }--[ ]--
A:admin@RR-5# show / system logging buffer messages | tail -n 50 | grep rejected
2026-09-09T13:30:29.826 sr_bgp_mgr: bgp|20656|N: In network-instance default, an incoming BGP connection from 192.0.2.4 was rejected because the limit for the maximum number of incoming dynamic peers, 2, has been reached.
Only two dynamic BGP sessions remain, as follows:
--{ + running }--[ ]--
A:admin@RR-5# show network-instance default protocols bgp neighbor * detail | grep Type --after-context 2 --before-context 2
----------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.1, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : static
Description : None
Group : grp-IBGP
--
----------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.2, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
--
----------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.3, remote AS: 64496, local AS: 64496, peer-type : ibgp
Type : dynamic
Description : None
Group : grp-IBGP
Dynamic BGP peers in multiple ASs
Dynamic BGP sessions associated with a single BGP peer group can belong to different peer Autonomous Systems (ASs), both in the default network instance and in IP VRFs. Example topology with VRF1 in different ASs shows the example topology with VRF1 configured in different ASs. Each interface in VRF1 has an IPv4 and an IPv6 address.
EBGP sessions are established between VRF1 on PE-1 and VRF1 on the other nodes. In VRF1 on PE-2, PE-3, and PE-4, static BGP neighbors are configured. The IP VRF configuration on PE-2 is as follows:
# on PE-2:
enter candidate
system {
mpls {
label-ranges {
dynamic dlb-services {
start-label 30000
end-label 39999
}
}
services {
network-instance {
dynamic-label-block dlb-services
}
}
}
}
network-instance VRF1 {
type ip-vrf
admin-state enable
interface int-VRF1onPE2-VRF1onPE1 { # 172.16.12.2 / 2001:db8::12:2
interface-ref {
interface ethernet-1/1
subinterface 1
}
}
interface lo0.1-172.31.0.2 {
interface-ref {
interface lo0
subinterface 1
}
}
protocols {
bgp {
admin-state enable
autonomous-system 64502
router-id 172.31.0.2
afi-safi ipv4-unicast {
admin-state enable
}
group grp-EBGPv4 {
next-hop-self true
export-policy [
rp-export-VRF1-v4
]
import-policy [
rp-import-1-1
]
afi-safi ipv4-unicast {
admin-state enable
}
}
group grp-EBGPv6 {
next-hop-self true
export-policy [
rp-export-VRF1-v6
]
import-policy [
rp-import-1-1
]
afi-safi ipv4-unicast {
admin-state disable
}
afi-safi ipv6-unicast {
admin-state enable
}
}
neighbor 172.16.12.1 {
peer-as 64501
peer-group grp-EBGPv4
}
neighbor 2001:db8::12:1 {
peer-as 64501
peer-group grp-EBGPv6
}
}
}
In VRF1 on PE-1, dynamic BGP peering is configured for IPv4 prefixes matching 172.16.0.0/16 in AS 64502 (PE-2) or AS 64504 (PE-4) and IPv6 prefixes matching 2001:db8::/107 ASN range from 64502 (PE-2) to 64503 (PE-3). The BGP configuration in VRF1 on PE-1 is as follows:
# on PE-1:
enter candidate
network-instance VRF1 {
type ip-vrf
admin-state enable
interface int-VRF1onPE1-VRF1onPE2 { # 172.16.12.1 / 2001:db8::12:1
interface-ref {
interface ethernet-1/2
subinterface 1
}
}
interface int-VRF1onPE1-VRF1onPE3 { # 172.16.13.1 / 2001:db8::13:1
interface-ref {
interface ethernet-1/3
subinterface 1
}
}
interface int-VRF1onPE1-VRF1onPE4 { # 172.16.14.1 / 2001:db8::14:1
interface-ref {
interface ethernet-1/4
subinterface 1
}
}
interface lo0.1 {
interface-ref {
interface lo0
subinterface 1
}
}
protocols {
bgp {
admin-state enable
autonomous-system 64501
router-id 172.31.0.1
dynamic-neighbors {
accept {
max-sessions 10
match 172.16.0.0/16 {
peer-group grp-EBGPv4
allowed-peer-as [
64502
64504
]
}
match 2001:db8::/107 {
peer-group grp-EBGPv6
allowed-peer-as [
64502..64503
]
}
}
}
afi-safi ipv4-unicast {
admin-state enable
}
trace-options {
flag open {
}
flag notification {
}
}
group grp-EBGPv4 {
next-hop-self true
export-policy [
rp-export-VRF1-v4
]
import-policy [
rp-import-1-1
]
afi-safi ipv4-unicast {
admin-state enable
}
}
group grp-EBGPv6 {
next-hop-self true
export-policy [
rp-export-VRF1-v6
]
import-policy [
rp-import-1-1
]
afi-safi ipv4-unicast {
admin-state disable
}
afi-safi ipv6-unicast {
admin-state enable
}
}
}
PE-1 rejects a dynamic BGP session if a received neighbor BGP OPEN message does not report an AS number in an allowed list: in the grp-EBGPv4 group, AS 64503 is not allowed and in the grp-EBGPv6 group, AS 64504 is not allowed. PE-1 sends notification messages with code OPEN and subcode INCORRECT_AS to PE-3 and PE-4 and closes the sessions for peers 172.16.13.2 and 2001:db8::14:2. The following messages are logged on PE-1:
--{ + running }--[ ]--
A:admin@PE-1# show / system logging file messages | grep INCORRECT_AS
2026-09-09T13:36:30.239 sr_bgp_mgr: bgp|25043|W: In network-instance VRF1, the BGP session with VR VRF1 (3): Group grp-EBGPv6: Peer 2001:db8::14:2 was closed because the router sent this neighbor a NOTIFICATION with code OPEN and subcode INCORRECT_AS
2026-09-09T13:36:54.058 sr_bgp_mgr: bgp|25043|W: In network-instance VRF1, the BGP session with VR VRF1 (3): Group grp-EBGPv4: Peer 172.16.13.2 was closed because the router sent this neighbor a NOTIFICATION with code OPEN and subcode INCORRECT_AS
When debugging is enabled for BGP OPEN messages and BGP notifications, the following messages are logged on PE-1: a BGP OPEN message received from PE-3 in AS 64503 and a BGP notification with code OPEN and subcode Bad Peer AS.
2026-09-09T13:37:54.113459+00:00 PE-1 sr_bgp_mgr: bgp|25043|25103|00103|TR||D: VR VRF1 (3) BGP OPEN: Peer 3: 172.16.13.2 - Send (Passive) BGP OPEN: Version 4
AS Num 64501: Holdtime 90: BGP_ID 172.31.0.1: Opt Length 20 (ExtOpt F)
Opt Para: Type CAPABILITY: Length = 18: Data:
Cap_Code GRACEFUL-RESTART: Length 2
Bytes: 0x1 0x2c
Cap_Code MP-BGP: Length 4
Bytes: 0x0 0x1 0x0 0x1
Cap_Code ROUTE-REFRESH: Length 0
Cap_Code 4-OCTET-ASN: Length 4
Bytes: 0x0 0x0 0xfb 0xf5
2026-09-09T13:37:54.113693+00:00 PE-1 sr_bgp_mgr: bgp|25043|25103|00104|TR||D: VR VRF1 (3) BGP OPEN: Peer 3: 172.16.13.2 - Received BGP OPEN: Version 4
AS Num 64503: Holdtime 90: BGP_ID 172.31.0.3: Opt Length 20 (ExtOpt F)
Opt Para: Type CAPABILITY: Length = 18: Data:
Cap_Code GRACEFUL-RESTART: Length 2
Bytes: 0x1 0x2c
Cap_Code MP-BGP: Length 4
Bytes: 0x0 0x1 0x0 0x1
Cap_Code ROUTE-REFRESH: Length 0
Cap_Code 4-OCTET-ASN: Length 4
Bytes: 0x0 0x0 0xfb 0xf7 # AS 64503
2026-09-09T13:37:54.113744+00:00 PE-1 sr_bgp_mgr: bgp|25043|25103|00106|TR||D: VR VRF1 (3) Peer 3: 172.16.13.2 NOTIFICATION: Peer 3: 172.16.13.2 - Send BGP NOTIFICATION: Code = 2 (OPEN) Subcode = 2 (Bad Peer AS)
The following BGP summary on PE-1 shows four dynamic BGP neighbors: 172.16.12.2 in AS 64502, 172.16.14.2 in AS 64504, 2001:db8::12:2 in AS 64502, and 2001:db8::13:2 in AS 64503:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance VRF1 protocols bgp neighbor
---------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF1"
Peer flags: see legend after the summary when applicable.
---------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------
+--------------+------------------+------------------+-------+----------+--------------+--------------+-------------------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+==============+==================+==================+=======+==========+==============+==============+=====================================+
| VRF1 | 172.16.12.2 | grp-EBGPv4 | D | 64502 | established | 0d:0h:5m:24s | ipv4-unicast [1/1/1] |
| VRF1 | 172.16.14.2 | grp-EBGPv4 | D | 64504 | established | 0d:0h:5m:2s | ipv4-unicast [1/1/1] |
| VRF1 | 2001:db8::12:2 | grp-EBGPv6 | D | 64502 | established | 0d:0h:5m:28s | ipv6-unicast [1/1/1] |
| VRF1 | 2001:db8::13:2 | grp-EBGPv6 | D | 64503 | established | 0d:0h:5m:16s | ipv6-unicast [1/1/1] |
+--------------+------------------+------------------+-------+----------+--------------+--------------+-------------------------------------+
---------------------------------------------------------------------------------------------------------------------------------------------
Summary:
0 configured neighbors, 0 configured sessions are established, 0 disabled peers
4 dynamic peers
---------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
D Dynamic neighbor
The maximum number of allowed dynamic peers can be lowered, as follows:
# on PE-1:
enter candidate
network-instance VRF1 {
protocols {
bgp {
dynamic-neighbors {
accept {
max-sessions 2
Reducing the number of allowed dynamic peers does not result in any existing BGP sessions to be torn down.
The following command causes a hard reset on the BGP session with dynamic peer 172.16.14.2:
--{ + running }--[ ]--
A:admin@PE-1# tools / network-instance VRF1 protocols bgp neighbor 172.16.14.2 reset-peer
/network-instance[name=VRF1]/protocols/bgp/neighbor[peer-address=172.16.14.2]:
Successfully executed the tools clear command.
PE-1 does not accept a new session with dynamic peer 172.16.14.2 because the maximum number of sessions is reached, so only the other sessions remain established, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance VRF1 protocols bgp neighbor
----------------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF1"
Peer flags: see legend after the summary when applicable.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------------------------------------
+------------------+--------------------------+------------------+------+----------+--------------+--------------+-------------------------------------+
| Net-Inst | Peer | Group | Flag | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
| | | | s | | | | |
+==================+==========================+==================+======+==========+==============+==============+=====================================+
| VRF1 | 172.16.12.2 | grp-EBGPv4 | D | 64502 | established | 0d:0h:8m:36s | ipv4-unicast [1/1/1] |
| VRF1 | 2001:db8::12:2 | grp-EBGPv6 | D | 64502 | established | 0d:0h:8m:40s | ipv6-unicast [1/1/1] |
| VRF1 | 2001:db8::13:2 | grp-EBGPv6 | D | 64503 | established | 0d:0h:8m:28s | ipv6-unicast [1/1/1] |
+------------------+--------------------------+------------------+------+----------+--------------+--------------+-------------------------------------+
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
0 configured neighbors, 0 configured sessions are established, 0 disabled peers
3 dynamic peers
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
D Dynamic neighbor
When BGP is bounced (admin-state disable followed by admin-state enable), only two sessions with dynamic peers are established, as follows:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show network-instance VRF1 protocols bgp neighbor
----------------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF1"
Peer flags: see legend after the summary when applicable.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------------------------------------
+------------------+--------------------------+------------------+------+----------+--------------+--------------+-------------------------------------+
| Net-Inst | Peer | Group | Flag | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
| | | | s | | | | |
+==================+==========================+==================+======+==========+==============+==============+=====================================+
| VRF1 | 172.16.14.2 | grp-EBGPv4 | D | 64504 | established | 0d:0h:0m:55s | ipv4-unicast [1/1/1] |
| VRF1 | 2001:db8::12:2 | grp-EBGPv6 | D | 64502 | established | 0d:0h:0m:36s | ipv6-unicast [1/1/1] |
+------------------+--------------------------+------------------+------+----------+--------------+--------------+-------------------------------------+
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
0 configured neighbors, 0 configured sessions are established, 0 disabled peers
2 dynamic peers
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
D Dynamic neighborConclusion
The use of dynamic BGP peers provides ISPs the means to reduce the configuration file size for routers. This reduces the number of configuration changes to be made to the network over time, which lowers the operational cost of running the network.