Cisco BGP Configuration Generator

Generate Cisco IOS BGP configuration with prefix lists, route maps, maximum-prefix protection and BFD, in the modern address-family form.

Config generator Cisco Runs in your browser
Try:

Result

Session
eBGP 65001 ↔ 64512
Peer
192.0.2.2
Maximum prefixes
1,000,000
warn at 80%, restart at 5 min
Advertising
1 network
BGP session (IOS / IOS-XE)
router bgp 65001
 bgp router-id 10.255.0.1
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 bgp graceful-restart
 neighbor 192.0.2.2 remote-as 64512
 neighbor 192.0.2.2 description TRANSIT-PROVIDER-A
 neighbor 192.0.2.2 fall-over bfd
 !
 address-family ipv4 unicast
  network 203.0.113.0 mask 255.255.255.0
  neighbor 192.0.2.2 activate
  neighbor 192.0.2.2 soft-reconfiguration inbound
  neighbor 192.0.2.2 maximum-prefix 1000000 80 restart 5
  neighbor 192.0.2.2 prefix-list TRANSIT-PROVIDER-A-IN in
  neighbor 192.0.2.2 prefix-list OWN-PREFIXES out
  neighbor 192.0.2.2 route-map TRANSIT-PROVIDER-A-IN in
 exit-address-family
!
Prefix lists and inbound policy
ip prefix-list OWN-PREFIXES seq 10 permit 203.0.113.0/24
!
ip prefix-list TRANSIT-PROVIDER-A-IN seq 5 deny 0.0.0.0/0
ip prefix-list TRANSIT-PROVIDER-A-IN seq 10 deny 10.0.0.0/8 le 32
ip prefix-list TRANSIT-PROVIDER-A-IN seq 15 deny 172.16.0.0/12 le 32
ip prefix-list TRANSIT-PROVIDER-A-IN seq 20 deny 192.168.0.0/16 le 32
ip prefix-list TRANSIT-PROVIDER-A-IN seq 25 deny 100.64.0.0/10 le 32
ip prefix-list TRANSIT-PROVIDER-A-IN seq 30 deny 0.0.0.0/0 ge 25
ip prefix-list TRANSIT-PROVIDER-A-IN seq 100 permit 0.0.0.0/0 le 24
!
route-map TRANSIT-PROVIDER-A-IN permit 10
 set local-preference 100
!
Verification
show ip bgp summary
show ip bgp neighbors 192.0.2.2
show ip bgp neighbors 192.0.2.2 received-routes
show ip bgp neighbors 192.0.2.2 advertised-routes
clear ip bgp 192.0.2.2 soft in
Explicit activation
"no bgp default ipv4-unicast" means neighbours carry no address family until explicitly activated. It looks like extra work and it prevents the classic accident of a new peer immediately exchanging the full table before policy exists.
Size the limit to the peer
maximum-prefix is the guard that stops a misconfigured peer exhausting router memory. Set it to a small multiple of what the peer legitimately announces - for a customer expecting to send five prefixes, 100 is generous, not one million.

About Cisco BGP Configuration Generator

A BGP session without inbound filtering and a prefix limit is an outage waiting for a neighbour to make a mistake. This generates the session in modern address-family form, with bogon filtering, a prefix limit and soft reconfiguration so policy changes do not require a hard reset.

Soft reconfiguration and route refresh

Changing an inbound policy only affects routes received after the change, so the session has to be refreshed. clear ip bgp x.x.x.x soft in uses the route-refresh capability and re-sends the table without tearing the session down. soft-reconfiguration inbound keeps an unfiltered copy locally, which allows the same refresh without asking the peer — at the cost of memory proportional to the received table, so enable it on customer sessions rather than full-table transit peers.

Filter in both directions

Inbound, reject prefixes that should never appear: default, RFC 1918 space, CGNAT space, and anything longer than /24 from a transit provider. Outbound, permit only your own prefixes explicitly - the route leaks that make the news are almost always a missing outbound filter, not a clever attack.

Common use cases

  • Turning up a transit or peering session to a standard build.
  • Adding a customer BGP session with strict prefix limits.
  • Adding BFD to an existing session for sub-second failure detection.

Edge cases and gotchas

  • clear ip bgp without "soft" tears the session down - use soft reconfiguration for policy changes.
  • MD5 passwords must match exactly at both ends; a mismatch produces a session that never leaves Active with no obvious error.

Frequently asked questions

Do I need BFD on a BGP session?
On anything carrying real traffic, yes. Default BGP hold timers detect failure in up to 180 seconds; BFD detects it in under a second, which is the difference between a blip and an incident.
Why is my neighbour up but no routes exchanged?
Either the address family is not activated, or an inbound prefix list or route map is rejecting everything. Check "show ip bgp neighbors x received-routes" against the filtered table.