07 - Next-Hop Behavior (next-hop-self)

07 Next-Hop Behavior

The next-hop attribute behaves differently depending on whether a route is advertised over eBGP or iBGP. This difference creates a common problem inside an AS, and the fix is next-hop-self.

How the next-hop is set

Advertised to an eBGP peer

When a prefix is advertised to an external (eBGP) neighbor, the advertising router sets the next-hop to its own outgoing interface IP. The external peer receives a next-hop it can reach directly.

Advertised to an iBGP peer

When a prefix is propagated to an internal (iBGP) neighbor, the next-hop is not modified. It keeps the original value, which is usually the IP of the external eBGP router that first advertised it.

The problem this creates

An internal router receiving an iBGP route inherits a next-hop that points to an external IP address from another AS. That external subnet is typically not known by the internal IGP, so the internal router has no way to reach the next-hop.

The result is that the route is received but its next-hop is unreachable, so the route is considered invalid and is not installed into the routing table. The prefix appears in the BGP table but cannot be used.

The solution: next-hop-self

When a border router learns a prefix over eBGP and passes it to its iBGP peers, next-hop-self tells it to rewrite the next-hop to its own IP, one that is reachable inside the AS. In practice this is the border router’s loopback, because the loopback is advertised by the internal IGP and every internal router can reach it.

With next-hop-self, internal routers receive a resolvable next-hop and can install the route.

An alternative to next-hop-self

next-hop-self is the most common fix, but it is not the only one. The other option is to make the external link’s subnet reachable inside the AS (for example by advertising that subnet into the internal IGP), so the original external next-hop becomes resolvable. In practice next-hop-self is cleaner and more widely used.

This is why loopbacks tie the iBGP story together

The same loopbacks used to source resilient iBGP sessions are what next-hop-self typically points to. The whole iBGP chain connects: full-mesh requirement, loopback-sourced sessions, and next-hop-self all reinforce each other.

Self-check

Q1 — When a prefix is advertised to an eBGP peer, what is the next-hop set to?

A) It is left unchanged
B) The advertising router’s own outgoing interface IP
C) 0.0.0.0
D) The loopback of the receiving peer

Respuesta

B is correct. For eBGP advertisements, the advertising router sets the next-hop to its own outgoing interface IP, which the external peer can reach directly.

• A) False — leaving it unchanged is the iBGP behavior.
• C) False — 0.0.0.0 marks a locally originated route in the table, not an advertised next-hop.
• D) False — the next-hop is the advertiser’s address, not the receiver’s loopback.

Q2 — When a prefix is propagated to an iBGP peer, what happens to the next-hop by default?

A) It is rewritten to the advertising router’s IP
B) It is not modified and keeps the original (often external) value
C) It is set to 0.0.0.0
D) It is removed entirely

Respuesta

B is correct. By default the next-hop is not changed for iBGP; it retains the original value, usually the external eBGP router’s IP.

• A) False — rewriting it is exactly what next-hop-self must be configured to do.
• C) False — 0.0.0.0 denotes local origination, not iBGP propagation.
• D) False — the next-hop is kept, not removed.

Q3 — Why does an unmodified iBGP next-hop often make a route unusable?

A) Because the next-hop is an internal loopback
B) Because the next-hop is an external IP the internal IGP does not know how to reach
C) Because iBGP routes have AD 20
D) Because the AS-PATH becomes too long

Respuesta

B is correct. The inherited next-hop points to an external subnet the internal IGP usually does not know, so it is unreachable, the route is invalid, and it is not installed.

• A) False — a reachable internal loopback is exactly what fixes the problem, not what causes it.
• C) False — iBGP AD is 200, and AD is not why the next-hop is unreachable.
• D) False — AS-PATH length is unrelated to next-hop reachability.

Q4 — What does next-hop-self do?

A) Raises the TTL for multi-hop peers
B) Rewrites the next-hop to the border router’s own reachable IP (typically its loopback) when advertising to iBGP peers
C) Disables the connected-check
D) Forces the route to be advertised only to eBGP peers

Respuesta

B is correct. On the border router, next-hop-self rewrites the next-hop to its own IP (usually its loopback), which internal routers can reach via the IGP, so the route becomes usable.

• A) False — raising TTL is ebgp-multihop.
• C) False — disabling the connected-check is a different command.
• D) False — it changes the next-hop, not which peers receive the route.