The checklist

Debugging BGP goes faster with a fixed order: read the state, read the last reset reason, then decide whether the problem is below BGP (TCP), in the OPEN exchange, or in policy. Every row in this table is something you've now seen happen in the lab.

What you see	Most likely cause	Confirm with
Idle (Admin)	neighbor … shutdown left in place	show running-config
Idle (PfxCt)	Peer sent more prefixes than maximum-prefix allows	Log %MAXPFXEXCEED; fix, then clear bgp
Active, No path to specified Neighbor	Neighbour address not on a connected network (typo, or eBGP to a loopback)	show bgp nexthop: Must be Connected
Active, connection established then dropped	The peer isn't configured for your address	tcpdump: handshake, then FIN/RST from the peer
Connect for a long time, SYNs unanswered	Firewall or ACL dropping TCP 179, or no route back	tcpdump: repeated SYNs, no reply; firewall counters
Idle, repeating; NOTIFICATION 2/2	Wrong remote-as on one side	Log: Bad Peer AS, sent by the side with the wrong config
Active to a peer two hops away; ICMP time exceeded	eBGP TTL 1: missing ebgp-multihop	tcpdump -v: ttl 1, time exceeded in-transit
Session up although passwords differ	TCP-MD5 not supported by the kernel	Log: Unable to set TCP MD5 option
Session drops every hold time	Keepalives lost: path down, policer, MTU, CPU	Log: Hold Timer Expired
(Policy) in the summary	eBGP session with no import or export policy	show bgp neighbors: Inbound updates discarded due to missing policy
Prefix counts lower than expected	Your import policy filtered them	received-routes vs routes
Route present but not used	Next hop unreachable	show bgp …: inaccessible; show bgp nexthop

Three habits prevent most of these:

• Turn on bgp log-neighbor-changes on every router. FRR's traditional defaults don't log session changes, and you want the reason recorded before you need it.
• Know your normal prefix counts for every session. "4 received, 1 sent" is a health check that takes a second to read.
• Change one thing, then clear and watch. Most of these failures show up within seconds in the summary or the log.