BGP for people who run a single uplink

BGP has a reputation that puts people off. For an organisation with one or two internet connections, the useful subset is small, and the first question is whether you need it at all.

Do you need it?

With one uplink and provider-assigned addresses, no. A default route does everything BGP would, with none of the complexity.

You need BGP when you have your own address space and want to keep it while changing or adding providers, when you have two providers and want automatic failover between them, or when you need to influence how traffic reaches you.

What it actually does

BGP exchanges reachability: “these prefixes are reachable through me, and here is the path of networks the traffic will cross.” It chooses on policy rather than on speed. There is no metric for bandwidth or latency. That surprises people, and it is deliberate — BGP is about which organisation’s traffic policy applies, not which link is fastest.

The five things worth knowing

AS path length is the main tiebreaker: fewer networks crossed wins. Local preference controls which uplink you use for outbound traffic, and is the knob you will use most. AS path prepending makes one path look longer, which is how you influence inbound traffic — crudely, because the far end is free to ignore it. Communities are tags your provider may act on, and are usually a better tool than prepending. MED suggests a preference to your neighbour, who may disregard it.

The asymmetry to accept

You control outbound traffic well and inbound traffic poorly. Everyone else’s routing policy decides how traffic reaches you. Plan around that rather than fighting it.

Protect yourself

! never accept or send more than you intend
neighbor 192.0.2.1 maximum-prefix 100
neighbor 192.0.2.1 prefix-list OUT-OURS out
neighbor 192.0.2.1 prefix-list IN-DEFAULT in

Filter in both directions from day one. The well-known BGP incidents are overwhelmingly cases where somebody announced routes they did not own, and nobody filtered them.