BGP Disable-Connected-Check vs eBGP Multihop

Disable-connected-check enables a directly connected eBGP neighbor to peer using a loopback address without adjusting the default TTL of 1. What normally happens for eBGP neighbor statements, is that a check is done on the router to confirm that the neighbor is listed as being directly connected in the routing table. If eBGP neighbors are peering using loopbacks then the IP address of the neighbor will not listed as being directly connected in the routing table, and it is therefore not possible to complete this check. This is why you normally need to put neighbor x.x.x.x ebgp multihop 2 as a minimum for the neighbor to come online (if using ebgp multihop). Not because the neighbor is two hops away, but simply because the router checks, “is the IP address in the neighbor statement actually on the same subnet as any of my local interfaces?”. If the answer is no, then the router assumes the neighbor must be more than one hop away. But if we use the disable-connected-check syntax, this check is avoided and a TTL of 1 is accepted. So it is compulsory that the neighbor is only ever a maximum of one hop away when using this command as it’s not adjusting any TTL value, it’s just checking if the neighbors IP is a directly connected subnet in the routing table. The difference with eBGP multihop, is that you can specify how many hops away a neighbor is allowed to be. You are actually adjusting the TTL instead.

In the diagram below, I’m going to start by configuring BGP between R1 & R2 using loopbacks over their directly connected fa0/0 interfaces with #disable-connected-check.

R1(config-router)#neighbor remote-as 2
R1(config-router)#neighbor update-source lo0
R1(config-router)#neighbor disable-connected-check
R1(config-router)#ip route
*Mar 1 00:17:22.095: %BGP-5-ADJCHANGE: neighbor Up
R2(config)#router bgp 2
R2(config-router)#neighbor remote-as 1
R2(config-router)#neighbor update-source lo0
R2(config-router)#neighbor disable-connected-check
R2(config-router)#ip route
*Mar 1 00:17:22.083: %BGP-5-ADJCHANGE: neighbor Up
As you can see, the neighbors came straight up. If I now try and use the path via R1-R3-R4-R2, i.e. a path that is not directly connected, the neighbors will not establish a session because the ttl will only be set to 1, and therefore cause a reachability problem. This is shown below.

R2(config)#int fa0/0
R2(config-if)#no ip route
R2(config-if)#ip route
//Note that = R4//
R1(config)#int fa0/0
R1(config-if)#no ip route
R1(config-if)#ip route
//Note that = R3//
R1(config-if)#do ping so lo0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Packet sent with a source address of
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/66/80 ms

*Mar 1 00:25:23.763: %BGP-5-ADJCHANGE: neighbor Down BGP Notification sent
*Mar 1 00:25:23.763: %BGP-3-NOTIFICATION: sent to neighbor 4/0 (hold time expired) 0 bytes

R1#sh ip bgp sum
BGP router identifier, local AS number 1
BGP table version is 1, main routing table version 1

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 4 2 8 12 0 0 0 00:04:33 Active
So because the neighbor is no longer 1 hop away the session drops, a notification is sent, and the hold time expires. However if I use ebgp-multihop instead of the disable-connected check, the session will form (because we increased the TTL). This is shown below.

R1(config)#router bgp 1
R1(config-router)#no neighbor disable-connected-check
R1(config-router)#neighbor ebgp-multihop 3
R2(config)#router bgp 2
R2(config-router)#no neighbor disable-connected-check
R2(config-router)#neighbor ebgp-multihop 3

*Mar 1 00:41:45.159: %BGP-5-ADJCHANGE: neighbor Up

R2#sh ip bgp sum
BGP router identifier, local AS number 2
BGP table version is 1, main routing table version 1

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 4 1 27 31 1 0 0 00:15:02 0
In conclusion, if you want to use the disable-connected-check feature, then ensure the neighbor is directly connected. Otherwise, you need to use ebgp-multihop, or ttl-security to establish the session.


Share on facebook
Share on twitter
Share on linkedin

Leave a Reply

Your email address will not be published. Required fields are marked *

Become a member

Full Access to 739 Lessons. New Lessons Added Every Week!

Awesome Deal! Get 2 Months for FREE!

No Obligations. Cancel At Any Time!