BGP Prefix Limit per Address Family
This chapter provides information about BGP prefix limit per address family.
Topics in this chapter include:
Applicability
The CLI in the latest update based on SR Linux Release 26.7.1.
Overview
A BGP per address family prefix limit can be defined to control the number of prefixes learned per neighbor or per group of neighbors in the default network instance or in an IP-VRF. This feature allows ISPs to secure their network from misbehaving or misconfigured peers. This feature can also be used to enforce the terms of a service contract.
If the number of received routes from a peer exceeds a defined per address family limit, the BGP session can be torn down, the state changed to disabled, the routes learned from that peer deleted, and the RIB and FIB recalculated. With the prevent-teardown true option configured, the BGP session is not torn down and no routes are deleted. An SNMP trap message is issued when exceeding the per address family threshold (default: 90%), and the per address family prefix limit.
With the default prevent-teardown false option, the BGP session is torn down when the prefix limit is exceeded. The prefix-limit-restart-timer defines the time in seconds after which the system attempts to re-establish the BGP session and has a default value of 0 seconds. An absent prefix-limit-restart-timer corresponds to the default value of 0 seconds. The prefix-limit-restart-timer can be configured with a value in the range from 0 to 65535 seconds, but can also have the keyword forever, in which case a manual intervention is needed when the BGP session is torn down.
The prefix-limit-accepted option indicates that the limit should be applied only to the routes accepted by import policies, as shown in Prefix limit applied to accepted routes. A route rejected by an import policy is not counted when checking against the prefix limit. The default prefix-limit-received option results in routes being counted and verified against the prefix limit when they are received, before the import policy is executed, and may lead to BGP sessions being torn down unexpectedly. For a specified address family, different types of prefix-limit are not supported at the same time.
BGP sessions are torn down as soon as one of the address family prefix limits is exceeded, even when the limit for the other address family is not yet exceeded. In cases where this is important, consider defining two BGP sessions between two peers; the first using IPv4 for its transport, and the second using IPv6. In this way, an IPv4 limit being exceeded does not lead to IPv6 prefixes being affected.
Configuration
Example topology shows the example topology. PE-1 in AS 64501 peers with VRF1 hosted by PE-2 in AS 64502.
Two scenarios are considered:
Prefix limit for received routes
PE-1 peers with VRF1 on PE-2, where IP prefix limits are configured in the BGP groups toward PE-1: the IPv4 prefix limit is 10, the threshold is 50%, and the prefix-limit-restart-timer is 30s; the IPv6 prefix limit is 10, the threshold 80%, and the prefix-limit-restart-timer is 240 seconds, as follows:
# on PE-2:
enter candidate
network-instance VRF1 {
type ip-vrf
admin-state enable
description IP-VRF-with-BGP-prefix-limit
interface int-VRF1onPE2-PE1 {
interface-ref {
interface ethernet-1/1
subinterface 0
}
}
protocols {
bgp {
admin-state enable
autonomous-system 64502
router-id 172.31.2.2
afi-safi ipv4-unicast {
admin-state enable
}
group grp-EBGPv4 {
import-policy [
rp-import-10.1-ranges
]
afi-safi ipv4-unicast {
admin-state enable
ipv4-unicast {
prefix-limit-received {
max-received-routes 10
warning-threshold-pct 50
prevent-teardown false
}
}
}
timers {
prefix-limit-restart-timer 30 # in seconds (default:0)
}
}
group grp-EBGPv6 {
import-policy [
rp-import-ipv6-88-ranges
]
afi-safi ipv4-unicast {
admin-state disable
}
afi-safi ipv6-unicast {
admin-state enable
ipv6-unicast {
prefix-limit-received {
max-received-routes 10
warning-threshold-pct 80
prevent-teardown false
}
}
}
timers {
prefix-limit-restart-timer 240
}
}
neighbor 172.16.12.1 {
peer-group grp-EBGPv4
peer-as 64501
}
neighbor 2001:db8::16:12:1 {
peer-group grp-EBGPv6
peer-as 64501
}
PE-1 exports IPv4 and IPv6 routes to VRF1 on PE-2. Initially, the number of IPv4 routes received from PE-1 is below the threshold, and PE-1 gradually injects more IPv4 routes into VRF1 on PE-2. The following is a snapshot where three IPv4 routes and four IPv6 routes are received and active in PE-2:
--{ + running }--[ ]--
A:admin@PE2# show / network-instance VRF1 protocols bgp neighbor
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flags: see legend after the summary when applicable.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+===================+============================+===================+=======+==========+================+================+========================================+
| VRF1 | 172.16.12.1 | grp-EBGPv4 | S | 64501 | established | 0d:0h:1m:36s | ipv4-unicast [3/3/0] |
| VRF1 | 2001:db8::16:12:1 | grp-EBGPv6 | S | 64501 | established | 0d:0h:1m:36s | ipv6-unicast [4/4/0] |
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
2 configured neighbors, 2 configured sessions are established, 0 disabled peers
0 dynamic peers
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
S Static neighbor
The following three BGP IPv4 routes are received by VRF1 on PE-2 and they are all active:
--{ + running }--[ ]--
A:admin@PE2# show / network-instance VRF1 protocols bgp routes ipv4 summary | grep -v 0.0.0.0
------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP route table of network-instance "VRF1"
------------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
------------------------------------------------------------------------------------------------------------------------------------
+---------+--------------------------------------+----------------------------------+---------+---------+--------------------------+
| Status | Network | Next Hop | MED | LocPref | Path Val |
+=========+======================================+==================================+=========+=========+==========================+
| u*> | 10.1.0.0/24 | 172.16.12.1 | | | i[64501] |
| u*> | 10.1.1.0/24 | 172.16.12.1 | | | i[64501] |
| u*> | 10.1.2.0/24 | 172.16.12.1 | | | i[64501] |
+---------+--------------------------------------+----------------------------------+---------+---------+--------------------------+
------------------------------------------------------------------------------------------------------------------------------------
4 received BGP routes: 4 used, 4 valid, 0 stale
4 available destinations: 0 with ECMP multipaths
------------------------------------------------------------------------------------------------------------------------------------When the sixth BGP IPv4 route is received, the threshold value (50% of 10 is 5) is exceeded, and a message is generated and logged in bgp-events, as follows:
# on PE-2:
enter candidate
system {
logging {
buffer bgp-events {
subsystem bgp {
priority {
match-above notice
}
}
}
}
}--{ + running }--[ ]--
A:admin@PE-2# show / system logging buffer bgp-events | grep threshold
2026-09-07T13:25:59.571 sr_bgp_mgr: bgp|395080|N: In network-instance VRF1, the number of ipv4 routes received from the neighbor VR VRF1 (4): Group grp-EBGPv4: Peer 172.16.12.1 has exceeded the configured threshold, which is 50% of the limit.
--{ + running }--[ ]--
A:admin@PE-2# show / system logging buffer bgp-events | grep threshold
2026-09-07T13:27:13.640 sr_bgp_mgr: bgp|395080|N: In network-instance VRF1, the number of ipv4 routes received from the neighbor VR VRF1 (4): Group grp-EBGPv4: Peer 172.16.12.1 has exceeded the configured threshold, which is 50% of the limit.
2026-09-07T13:30:56.844 sr_bgp_mgr: bgp|395080|N: In network-instance VRF1, the number of ipv6 routes received from the neighbor VR VRF1 (4): Group grp-EBGPv6: Peer 2001:db8::16:12:1 has exceeded the configured threshold, which is 80% of the limit.
When the eleventh BGP IPv4 route is received, the configured maximum number of BGP routes for IPv4 is exceeded. The BGP session state changes from established to idle and the peer is notified, as indicated in the following log:
--{ + running }--[ ]--
A:admin@PE-2# show / system logging buffer bgp-events | tail -n 50
############################################################################################################################################################################
# /var/log/srlinux/buffer{,/ramdisk}/*bgp-events* # presented with option: -c2
############################################################################################################################################################################
2026-09-07T13:38:47.276 sr_bgp_mgr: bgp|395080|N: In network-instance VRF1, the number of ipv4 routes received from the neighbor VR VRF1 (4): Group grp-EBGPv4: Peer 172.16.12.1 has exceeded the configured threshold, which is 50% of the limit.
2026-09-07T13:38:47.276 sr_bgp_mgr: bgp|395080|N: In network-instance VRF1, the number of ipv4 routes received from the neighbor VR VRF1 (4): Group grp-EBGPv4: Peer 172.16.12.1 has exceeded the configured limit.
2026-09-07T13:38:47.276 sr_bgp_mgr: bgp|395080|W: In network-instance VRF1, the BGP session with VR VRF1 (4): Group grp-EBGPv4: Peer 172.16.12.1 moved from higher state ESTABLISHED to lower state IDLE due to event MAXPREFIX_EXCEEDED
2026-09-07T13:38:47.276 sr_bgp_mgr: bgp|395080|W: In network-instance VRF1, the BGP session with VR VRF1 (4): Group grp-EBGPv4: Peer 172.16.12.1 was closed because the router sent this neighbor a NOTIFICATION with code CEASE and subcode MAX_PFX_RCHD
Because the prevent-teardown false option is configured, the BGP session is torn down and the corresponding state is administratively disabled, as follows:
--{ + running }--[ ]--
A:admin@PE2# show / network-instance VRF1 protocols bgp neighbor
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF1"
Peer flags: see legend after the summary when applicable.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+===================+============================+===================+=======+==========+================+================+========================================+
| VRF1 | 172.16.12.1 | grp-EBGPv4 | -S | 64501 | | - | |
| VRF1 | 2001:db8::16:12:1 | grp-EBGPv6 | S | 64501 | established | 0d:0h:9m:30s | ipv6-unicast [10/10/0] |
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
2 configured neighbors, 1 configured sessions are established, 0 disabled peers
0 dynamic peers
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
S Static neighbor
- Administratively disabled
When idle-timeout expires, in this case, after 30 seconds, the system tries to re-establish the session. With the BGP session re-established, the peer starts re-advertising its routes. As long as the number of received routes in VRF1 on PE-2 is lower than or equal to the limit, the session is maintained. In the following example, the maximum number of received IPv4 routes is 10 and the maximum number of received IPv6 routes is 10.
--{ + running }--[ ]--
A:admin@PE2# show / network-instance VRF1 protocols bgp neighbor
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF1"
Peer flags: see legend after the summary when applicable.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+===================+============================+===================+=======+==========+================+================+========================================+
| VRF1 | 172.16.12.1 | grp-EBGPv4 | S | 64501 | established | 0d:0h:0m:46s | ipv4-unicast [10/10/0] |
| VRF1 | 2001:db8::16:12:1 | grp-EBGPv6 | S | 64501 | established | 0d:0h:12m:27s | ipv6-unicast [10/10/0] |
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
2 configured neighbors, 2 configured sessions are established, 0 disabled peers
0 dynamic peers
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
S Static neighbor
Prefix limit for accepted routes
Use caution when using the prefix limit in combination with import policies. By default, the routes are counted when receiving them, that is, before the import policy is enforced. To postpone the prefix limit check, the prefix-limit-received context is removed and the prefix-limit-accepted context must be used, so the BGP configuration for VRF1 on PE-2 is as follows:
# on PE-2:
enter candidate
network-instance VRF1 {
type ip-vrf
admin-state enable
description IP-VRF-with-BGP-prefix-limit
interface int-VRF1onPE2-PE1 {
interface-ref {
interface ethernet-1/1
subinterface 0
}
}
protocols {
bgp {
admin-state enable
autonomous-system 64502
router-id 172.31.2.2
afi-safi ipv4-unicast {
admin-state enable
}
group grp-EBGPv4 {
import-policy [
rp-import-10.1-ranges
]
afi-safi ipv4-unicast {
admin-state enable
ipv4-unicast {
delete prefix-limit-received
prefix-limit-accepted {
max-received-routes 10
warning-threshold-pct 50
prevent-teardown false
}
}
}
timers {
prefix-limit-restart-timer 30
}
}
group grp-EBGPv6 {
import-policy [
rp-import-ipv6-88-ranges
]
afi-safi ipv4-unicast {
admin-state disable
}
afi-safi ipv6-unicast {
admin-state enable
ipv6-unicast {
delete prefix-limit-received
}
}
}
neighbor 172.16.12.1 {
peer-group grp-EBGPv4
peer-as 64501
}
neighbor 2001:db8::16:12:1 {
peer-group grp-EBGPv6
peer-as 64501
}
The import-10.1-ranges policy is defined as follows:
# on PE-2:
enter candidate
routing-policy {
prefix-set ps-10.1-ranges {
prefix 10.1.0.0/16 mask-length-range 16..24 {
}
}
policy rp-import-10.1-ranges {
statement stmt-10 {
match {
prefix {
prefix-set ps-10.1-ranges
}
}
action {
policy-result accept
}
}
}When twelve IPv4 routes are received over this BGP session, six in the 10.1.0.0/16 range and six in the 10.2.0.0/16 range, then only the six routes in the 10.1.0.0/16 range are accepted and active in the routing table, as follows:
--{ + running }--[ ]--
A:admin@PE-2# show / network-instance VRF1 protocols bgp routes ipv4 summary | grep -v 0.0.0.0
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP route table of network-instance "VRF1"
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+---------+------------------------------------------+------------------------------------------+---------+---------+---------------------------------------------------------+
| Status | Network | Next Hop | MED | LocPref | Path Val |
+=========+==========================================+==========================================+=========+=========+=========================================================+
| u*> | 10.1.0.0/24 | 172.16.12.1 | | | i[64501] |
| u*> | 10.1.1.0/24 | 172.16.12.1 | | | i[64501] |
| u*> | 10.1.2.0/24 | 172.16.12.1 | | | i[64501] |
| u*> | 10.1.3.0/24 | 172.16.12.1 | | | i[64501] |
| u*> | 10.1.4.0/24 | 172.16.12.1 | | | i[64501] |
| u*> | 10.1.5.0/24 | 172.16.12.1 | | | i[64501] |
| | 10.2.0.0/24 | 172.16.12.1 | | | i[64501] |
| | 10.2.1.0/24 | 172.16.12.1 | | | i[64501] |
| | 10.2.2.0/24 | 172.16.12.1 | | | i[64501] |
| | 10.2.3.0/24 | 172.16.12.1 | | | i[64501] |
| | 10.2.4.0/24 | 172.16.12.1 | | | i[64501] |
| | 10.2.5.0/24 | 172.16.12.1 | | | i[64501] |
+---------+------------------------------------------+------------------------------------------+---------+---------+---------------------------------------------------------+
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
13 received BGP routes: 7 used, 7 valid, 0 stale
7 available destinations: 6 with ECMP multipaths
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The BGP session remains established with twelve received routes and six of these being active, as follows:
--{ + running }--[ ]--
A:admin@PE-2# show / network-instance VRF1 protocols bgp neighbor
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "VRF1"
Peer flags: see legend after the summary when applicable.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+===================+============================+===================+=======+==========+================+================+========================================+
| VRF1 | 172.16.12.1 | grp-EBGPv4 | S | 64501 | established | 0d:0h:1m:30s | ipv4-unicast [12/6/0] |
| VRF1 | 2001:db8::16:12:1 | grp-EBGPv6 | S | 64501 | established | 0d:0h:27m:0s | ipv6-unicast [10/10/0] |
+-------------------+----------------------------+-------------------+-------+----------+----------------+----------------+----------------------------------------+
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
2 configured neighbors, 2 configured sessions are established, 0 disabled peers
0 dynamic peers
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
S Static neighbor
With the prefix-limit-received option instead of prefix-limit-accepted, the session is torn down as soon as the number of received routes exceeds the configured prefix limit of 10.
Conclusion
The BGP prefix limit per address family feature allows ISPs to protect their network from misbehaving or misconfigured peers, and can also be used to enforce the terms of a service contract.