Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

BGP Auto-Discovered Neighbors

Understanding BGP Auto-discovered Neighbor

Use BGP auto-discovered neighbor to configure BGP peering by interface rather than by specifying remote or local neighbor IP addresses.

To establish a BGP session between routers, you must explicitly configure BGP groups and peers by address. BGP peering sessions require that you identify source and destination IP addresses for endpoints of the TCP communication. Therefore, explicitly configuring these addresses is an obstacle to network scale-out and an opportunity for misconfiguration.

To streamline your BGP configuration, we have removed the need to configure per-peer address from BGP. Use BGP auto-discovered neighbor to configure BGP peering by interface rather than by specifying remote or local neighbor IP addresses. This includes use of implicit or protocol mechanisms to discover the IP addresses for use in the TCP peering sessions.

Figure 1: BGP Auto-discovered Neighbor Spine-leaf network topology showing spine layer with high-performance switches, leaf layer connecting to servers, enabling peer-autodiscovery for simplified setup.
Note:

Peering behavior and address usage must be explicitly configured to avoid peering changes based on interface address changes due to configuration or address validity (for example, IPv6 Duplicate Address Detection (DAD)).

BGP determines the address families to peer over based on the configuration. The peering sessions come up based on availability of the interface addresses for the determined families. The peer link-local address is discovered using IPv6 neighbor discovery (RFC4861) and creates a BGP session toward that neighbor. A link-local address is generated even when IPv6 interfaces have no addresses configured.

Note:

You must enable IPv6 neighbor discovery for this feature to work.

Interface‑scoped TCP authentication enables TCP‑MD5, TCP‑Keychain, and TCP AO authentication for BGP unnumbered peers using IPv6 link‑local addresses. Routers establish BGP sessions using IPv6 link-local addresses through BGP unnumbered peering, which eliminates the need to assign unique IP addresses to each point-to-point interface. This approach simplifies network configuration but creates challenges for traditional TCP authentication mechanism that rely on knowing the peers’ IP address or IP prefix in advance. The interface-scoped authentication approach associates the authentication key directly with an EVO network interface. This configuration ensures that the BGP session initiated over a configured interface uses the authentication key assigned to that interface regardless of the peer’s IP address.

Instead of binding authentication keys to IP addresses or prefixes, keys are bound to a logical interface, ensuring correct authentication for unnumbered links. BGP unnumbered peering uses IPv6 link-local address as the authentication key is associated with both the interface and the IPv6 link-local prefix. This feature supports only symmetric routing and is limited to single-hop connectivity.

Additionally, the dynamic-neighbor configuration is enhanced to allow specifying an authentication algorithm and either an authentication key or key-chain, so that the auto-discovered neighbors can be authenticated on both Junos OS and Junos OS EVO platforms.

BGP supports TCP authentication at the [edit protocols bgp group group-name neighbor address] and [edit protocols bgp group group-name] hierarchy levels. Configure TCP authentication under the dynamic-neighbor hierarchy at the [edit protocols bgp group group-name dynamic-neighbor dyn-name] hierarchy level.

The following CLI configuration options are now supported under the [edit protocols bgp group group-name dynamic-neighbor dyn-name] hierarchy level within the BGP protocol.

  • authentication-algorithm: Specifies the authentication algorithm to be used.
  • authentication-key: Defines the MD5 authentication key.

Benefits of BGP Auto-discovered Neighbor

  • Simplifies IGP deployment to a single-hop external BGP (EBGP)

  • Configures neighbors by interfaces and interface ranges instead of by IP addresses

  • Minimizes configuration on both sides with dynamic-neighbor groups

  • Establishes a secure BGP peering on enabling authentication for a BGP unnumbered session.

Limitations

The feature has the following limitations:

  • Scoped BGP link-local addresses do not currently support allow neighbor ranges.

  • BGP auto-discovered neighbor feature does not support IBGP or multi-hop EBGP.

  • BGP auto-discovered neighbor does not support discovering or peering with more than one remote neighbor on any given interface.

  • Changing the TCP MD5 key for an established BGP session might flap or restart the session.

Example: Configuring BGP Auto-discovered Neighbor

This example shows how to configure BGP Auto-discovered Neighbor.

Overview

Starting in Junos OS Release 21.1R1, we support BGP auto-discovered neighbors using IPv6 Neighbor Discovery Protocol (ND). This feature allows BGP to create peer neighbor sessions using link-local IPv6 addresses of directly connected neighbor routers. You need not specify remote or local neighbor IP addresses.

To configure TCP authenticaton for BGP unnumbered peers, the authentication-algorithm and authentication-key-chain options are now available even when peer-auto-discovery is enabled, which was previously restricted. The authentication configured here will be applied to the dynamic neighbors.

  • authentication-algorithm: Specifies the authentication algorithm to be used.
  • authentication-key: Defines the MD5 authentication key.

Topology

The following figure shows a simplified sample topology.

Spine-leaf network topology with Spine 1 and Spine 2 switches connected to Leaf 1 and Leaf 2, each linked to VMs for efficient data flow.

Requirements

This example uses the following hardware and software components:

MX Series routers

Junos OS Release 21.1R1 or later

VM1 and VM2 representing end host servers

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

VM1

VM2

Leaf 1

Leaf 2

Spine 1

Spine 2

Configuring VM1

To configure BGP auto-discovered neighbor, perform the following steps on VM1:

  1. Configure the device interfaces.

  2. Create the loopback interface and configure the IP address.

  3. Enable routing policies.

  4. Configure the autonomous system (AS) number

  5. Apply the per-packet policy to enable load balancing of traffic and ECMP.

  6. Configure BGP to establish internal and external peering sessions. There are 2 groups configured autodisc and to-leaf-v4. BGP group autodisc is for BGP sessions using dynamic peering (IPv6 peers) while BGP group to-leaf-v4 is for static BGP session (IPv4 peers) between VM1 and Leaf1.

  7. If you are done configuring the device, commit the configuration.

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols, show policy-options, and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Verification

Confirm that the configuration is working properly.

Verifying Auto-discovered neighbors

Purpose

Verify the auto-discovered BGP neighbors.

Action

From operational mode, run the show bgp summary auto-discovered command

On Leaf1

On Spine1

Meaning

The output shows the summary of auto-discovered bgp neighbors. You can see the number of auto-discovered peers and its details.

Verifying BGP Auto-discovered Peers

Purpose

Verify the auto-discovered BGP neighbors.

Action

From operational mode, run the show bgp neighbor auto-discovered command.

On Leaf1

On Spine1

Meaning

The output shows information about the auto-discovered BGP neighbors.