BGP Profile

Updated: July 8, 2026

Want to summarize with AI?

Learn how a BGP profile supports dynamic route exchange between Multicloud Defense gateways and neighboring routers for site-to-site VPN connections.

Border Gateway Protocol (BGP) is an Internet Engineering Task Force (IETF) standard, and the most scalable of all routing protocols. BGP is the routing protocol for the global Internet and service provider private networks. BGP enables the VPN gateways and your BGP neighbors to exchange routes that inform the gateways on both sides of the connectoin of the availability of the gateways or routers involved.

You must create and add a BGP profile to your gateway if you are establishing a site-to-site VPN tunnel connection to another platform or device. Deploying with a BGP profile depoys a gateway that uses dynamic routing with BGP between your networks and cloud service providers.

BGP Neighbors and Path Selection

BGP profiles utilize a property called "neighbors"; a neighbor refers to another BGP router with which a BGP session is established. The purpose of configuring neighbors in a BGP profile is to facilitate the exchange of routing information between autonomous systems (ASes) or within a singular AS.

We strongly recommend adding at least one nighbor to your BGP profile.

Within the neighbor section of the BGP profile, you have the chance to opt to Route Map In or Route Map Out. The route maps provide us a mechanism to only advertise (outbound) or accept (inbound), based on whats identified in that route map.

Allowing a route map in enables the following actions:

Incoming Route Filtering: Control which routes are accepted from a BGP neighbor. Filter out unwanted routes to optimize the routing table to ensure only the relevant routes are considered.
Attribute Modification: Adjust attributes of incoming routes, such as the local preference or metric, to influence the path selection process within your network. This helps prioritize certain routes over others based on your deployed network policies.
Security and Policy Compliance: Prevent routes that do not comply with your network policies from being accepted to enhance security and ensure policy compliance.

Adversely, allowing a route map out enables the following actions:

Outgoing Route Filtering: Control which routes are advertised to a BGP neighbor. This helps manage the visibility of your network to external peers and has the potential to prevent the advertisement of specific internal routes.
Attribute Setting: Modify route attributes before they are sent to a neighbor.
Traffic Engineering: Influence inbound traffic paths by adjusting route attributes like AS path length to guide traffic through preferred routes.

BGP may receive multiple advertisements for the same route from different sources. BGP selects only one path as the best path. When this path is selected, BGP puts the selected path in the IP routing table and propagates the path to its neighbors. BGP uses the following criteria, in the order presented, to select a path for a destination:

If the path specifies a next hop that is inaccessible, drop the update.
Prefer the path with the largest weight.
If the weights are the same, prefer the path with the largest local preference.
If the local preferences are the same, prefer the path that was originated by BGP running on this router.
If no route was originated, prefer the route that has the shortest AS_path.
If all paths have the same AS_path length, prefer the path with the lowest origin type (where IGP is lower than EGP, and EGP is lower than incomplete).
If the origin codes are the same, prefer the path with the lowest MED attribute.
If the paths have the same MED, prefer the external path over the internal path.
If the paths are still the same, prefer the path through the closest IGP neighbor.
If both paths are external, prefer the path that was received first (the oldest one).
Prefer the path with the lowest IP address, as specified by the BGP router ID.
If the originator or router ID is the same for multiple paths, prefer the path with the minimum cluster list length.
Prefer the path that comes from the lowest neighbor address.

Create a BGP Profile

Use the following procedure to create a BGP profile from the Multicloud Defense Controller dashboard:

Before you begin

Note

When you create a BGP profile, the profile must be enabled for traffic and same value to be used in the tunnel as in the BGP profile.

Procedure

	1.	Navigate to Infrastructure > Network > BGP.
	2.	Click Create.
	3.	In the General Settings tab of the creation window enter a unique Profile Name.
	4.	(Optional) Enter a Description. This may help differentiate from other profiles with a similar name.
	5.	Enter the LocalAS value. This value represents the local autonomous system (AS) in which the BGP4 device resides.
	6.	Click the Neighbors tab at the top of the window to switch views. For more information on neighbors and what this configuration can do for you environment, see BGP Neighbors and Path Selection.
	7.	Click Add Neighbors.
	8.	Expand the Neighbor 1 space.
	9.	Manually enter a singular address or a range of IP addresses and BGP peer groups in the IP Address text box. If you are adding multiple addresses, separate each address with a space.
	10.	Enter the Autonomous System value, the LocalAS for where the neighbor resides.
	11.	If you opt to include Route Map In, note that enabling this option applies the route map on all matching traffic in the inbound direction on the interface. If you opt to include Route Map Out, enabling this option applies the routemap to all matching traffic in the outbound direction on the interface. Check the appropriate option for your environment and then enter the following information: Local Preference - By default, this value is "100". Optionally, enter a 32-bit unsigned integer value between 0 to 4,294,967,295. Note that with a higher local preference value indicating a more preferred route within an autonomous system. Local preference is only exchanged between BGP routers within the same autonomous system (iBGP) and not advertised externally (eBGP). AS Path Prepend - Maually enter a value for this; if you enter more than one separate each value with a space. This value influences the path selection process by artificially lengthening the AS path attribute of a route. While it is unconventional to include this for inbound traffic, prepending additional AS numbers to incoming routes can make these routes appear less preferable to your internal BGP speakers when selecting paths for routing traffic. Click Add to include an IP address or a network and enter an IP address, a range of IP addresses sepearated by commas, or a network comprised of both the IP and netmask. These are routes or networks that you want to allow in or out within the bgp session(s). At any point, click Remove to remove an IP address from the neighbor.
	12.	Click Save.

What to do next

Add your BGP profile to a Multicloud Defense Gateway. You can either create a new gateway or edit an existing gateway to include the new profile.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.