When to use which
Use loopbacks for
- iBGP, always. Inside your AS you have an IGP anyway, routers usually have more than one path to each other, and you want sessions to survive any single failure. This is how the edge-and-core lesson builds its network.
- eBGP over parallel links to the same neighbor: a customer with two circuits, or a private interconnect with a peer. One session, traffic over every link, and policy written once.
Use interface addresses for
- Transit providers and IXs, almost always. There's one link, the provider assigns the addresses, and they expect the session on them. An IX route server peers with hundreds of members across the shared LAN, so loopbacks aren't an option.
- Single-link eBGP where you want the fastest simple failover. When your own interface goes down, FRR tears down a directly connected eBGP session immediately. If you can, add BFD too, to catch failures your interface doesn't see.
Checklist for loopback sessions
| Check | Why |
|---|---|
| Loopback /32 on every router, used as the router ID | One stable identity per router |
| Loopbacks reachable: IGP (passive loopback) for iBGP, static routes for eBGP | No route to the loopback, no session |
update-source set to our loopback on every loopback session | Otherwise the peer sees the wrong source address and refuses the session |
eBGP: disable-connected-check (one hop away) or ebgp-multihop (further) | Otherwise routes arrive but stay inactive |
| BFD on static next hops (and ideally the IGP and BGP) | Static routes never notice a dead far end on their own |
| Input firewall allows BGP from the peer's loopback | The source address has changed from the link address |
| Test it: break one link and watch that the session stays up | That's the whole point |
vyos@R1:~$ show configuration commands | match "protocols|interfaces (ethernet|loopback|dummy)|host-name"
set interfaces ethernet eth0 address '192.0.2.0/31'
set interfaces ethernet eth0 description 'LINK-A-TO-R2'
set interfaces ethernet eth0 hw-id '52:54:00:01:00:01'
set interfaces ethernet eth1 address '192.0.2.2/31'
set interfaces ethernet eth1 description 'LINK-B-TO-R2'
set interfaces ethernet eth1 hw-id '52:54:00:01:01:01'
set interfaces loopback lo address '198.51.100.1/32'
set protocols bfd peer 192.0.2.1
set protocols bfd peer 192.0.2.3
set protocols bgp neighbor 198.51.100.2 address-family ipv4-unicast
set protocols bgp neighbor 198.51.100.2 description 'R2 AS64501 loopback'
set protocols bgp neighbor 198.51.100.2 disable-connected-check
set protocols bgp neighbor 198.51.100.2 remote-as '64501'
set protocols bgp neighbor 198.51.100.2 update-source '198.51.100.1'
set protocols bgp parameters router-id '198.51.100.1'
set protocols bgp system-as '64500'
set protocols static route 198.51.100.2/32 next-hop 192.0.2.1 bfd
set protocols static route 198.51.100.2/32 next-hop 192.0.2.3 bfd
set system host-name 'R1'- Line 8: The loopback.
- Lines 9–10: BFD on both links.
- Lines 11–15: eBGP to R2's loopback, one hop away.
- Lines 18–19: Static routes to R2's loopback, guarded by BFD.
Check your understanding
You're connecting to a transit provider over a single link. Which is usually right?
- Interface addresses, ideally with BFD if the provider supports it
- Loopbacks with ebgp-multihop
- Loopbacks with OSPF to the provider
- It doesn't matter