A BGP route is only usable if the router can reach its next hop. This attribute causes more silent failures than any other, so it is worth understanding exactly who sets it and when.
Advanced · 9 min read
You'll learn to predict the next hop at each router, diagnose an inaccessible next hop, and repair it with next-hop-self.
What NEXT_HOP is
NEXT_HOP is a well-known mandatory attribute holding the IP address of the router to send traffic to for the prefix. BGP does not choose a path unless the router can reach that address, so the next hop is as important as the prefix itself.
NEXT_HOP: eBGP changes it, iBGP does not
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The next hop is the address the router forwards packets to. A path whose next hop is unreachable is not valid, so it is never chosen as best.
Who changes it
Two rules cover almost every case. Over eBGP the sender sets the next hop to its own address on the link. Over iBGP the next hop is left alone. A route learned from an external neighbour therefore reaches the rest of the AS still pointing at the external neighbour address.
Who changes the next hop along the path
On small screens, swipe sideways or focus the diagram and use the arrow keys.
eBGP sets the next hop to the sender. iBGP leaves it alone. R2 must therefore be able to reach 192.0.2.1, which is outside its own AS, or it marks the route inaccessible. The usual fix is next-hop-self on R1.
Next hop rules
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Inside the AS the original external address is carried along.
When the next hop is unreachable
R2 learns 203.0.113.0/24 from R1 with next hop 192.0.2.1, the ISP address on R1's provider link. R2 is not on that link and has no route to 192.0.2.1. BGP stores the path, but it cannot be chosen, so R2 does not install it and forwards nothing. The session is up and the prefix is visible, which is why this is so easy to miss.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R2#show ip bgp 203.0.113.0
BGP routing table entry for 203.0.113.0/24, version 5
Paths: (1 available, no best path)
64501
192.0.2.1 (inaccessible) from 10.255.0.1 (1.1.1.1)
Origin IGP, metric 0, localpref 100, valid, internal
The words inaccessible and no best path point straight at the next hop. R2 has the route but no way to reach 192.0.2.1.
Fixing it with next-hop-self
Tell R1 to put its own address in the next hop when it sends external routes to R2. R2 already has a route to R1 through the IGP, so the path becomes usable.
router bgp 64500
address-family ipv4 unicast
neighbor 10.255.0.2 next-hop-self
end
clear ip bgp 10.255.0.2 soft out
R1. Routes sent to R2 now carry next hop 10.255.0.1, R1's loopback, which R2 reaches through the IGP.
Repairing an unreachable next hop
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The alternative is to carry the provider link in the IGP as a passive interface.
Related behaviour
On a shared Ethernet segment with three eBGP routers, the sender can advertise the true next hop on that segment instead of itself. This third-party next hop avoids an extra hop through the sender. Next-hop changes also trigger recalculation: the BGP scanner or next-hop tracking notices when the route to the next hop disappears.
Check your understanding
Predict · scenario 1
R1 learns a route over eBGP and sends it to R2 over iBGP. What is the next hop on R2?
Predict · scenario 2
show ip bgp prints inaccessible next to a next hop. What is the problem?
Predict · scenario 3
Which command makes R1 advertise itself as the next hop to an iBGP neighbour?
FAQ
Why is my iBGP route not in the routing table?
Often because the next hop is outside the AS and the router has no route to it. BGP keeps the path but marks it inaccessible, so it cannot be best.
Does next-hop-self change the AS path?
No. It only rewrites the next hop to the sending router. The AS path and other attributes are unchanged.
What is third-party next hop?
On a shared segment, an eBGP router can tell a neighbour to send traffic directly to another router on the same segment instead of through itself.