What is eBGP?
External BGP
eBGP (External BGP) is a BGP session between routers in two different autonomous systems, such as your edge router and your internet provider's router.
The rules for eBGP are what make BGP work across the internet. When a router advertises a route to an eBGP neighbour it prepends its own ASN to the AS_PATH, and it normally sets the NEXT_HOP to its own address on the shared link. A router that receives a route with its own ASN already in the path rejects it, which stops routing loops between networks. Routes learned over eBGP can be passed on to both eBGP and iBGP neighbours. By default eBGP expects the neighbour to be directly connected: packets are sent with a TTL of 1, so peering between loopbacks needs ebgp-multihop or a disabled connected check. In best-path selection, an eBGP-learned path beats an otherwise equal iBGP-learned one, and many implementations, including FRR and Cisco, give eBGP routes an administrative distance of 20 against 200 for iBGP.
Because eBGP faces networks you don't control, it's where policy matters most: filter what you accept, announce only your own prefixes, set maximum-prefix limits and consider GTSM and session authentication. RFC 8212 recommends that eBGP sessions exchange nothing until a policy is configured, and FRR follows this by default, which surprises people whose new session comes up but carries no routes. The contrast is iBGP, which runs inside one AS, leaves the AS_PATH alone and keeps the NEXT_HOP unchanged. The BGP Fundamentals lesson builds an eBGP session in FRR, and Setting up VyOS with basic BGP adds transit and IX policy.
Lessons that use eBGP
- BGP FundamentalsTeaches this term · Intermediate · 75 min
How the Border Gateway Protocol glues the internet together: autonomous systems, sessions, path attributes, best-path selection, iBGP scaling and a hands-on eBGP lab with real FRR configuration.
- BGP on loopbacks vs interface addressesIntermediate · 45 min
Why BGP sessions between loopbacks survive link failures and use parallel links, and what they need to work: an IGP or static routes, update-source, the eBGP connected check, and BFD. Every failure is reproduced on two real VyOS routers.
- Debugging BGP: every session state, reproducedIntermediate · 60 min
Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.
- EVPN and VXLAN: layer 2 over a routed fabricAdvanced · 45 min
Stretch a layer-2 segment across a routed leaf-spine fabric: VXLAN for the data plane, BGP EVPN for the control plane. Built with FRR: the underlay, VNIs, type-2 and type-3 routes, route targets, and the VXLAN packets on the wire.
- Edge and core: building out a VyOS networkIntermediate · 60 min
Split one BGP router into edge routers that face the outside world and a core that carries traffic inside: loopbacks, OSPF for infrastructure, iBGP between loopbacks, next-hop-self, and what happens when a link fails. Built and broken on three real VyOS routers.
- BGP communities, prepending and RTBHIntermediate · 45 min
Tag routes with large communities, steer inbound traffic with AS-path prepending (and see why providers' local preference limits it), and stop a DDoS at your provider's edge with remotely triggered blackholing. Built on VyOS with two transit providers, including the two RTBH mistakes the lab made first.
- Setting up VyOS with basic BGPIntermediate · 50 min
Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.
- Building a network lab on an Apple Silicon MacBeginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.