In Juniper routers running the Junos operating system, one can set the BGP peer group type either to external or internal:

root@M10i# set groups customer protocols bgp group customer-BGP-group type ?           
Possible completions:
  external             EBGP group
  internal             IBGP group
root@M10i# set groups customer protocols bgp group customer-BGP-group type    

Default should be external. I know that if the type is set to external, then the peer AS can not be the same as the local AS, and if the type is set to internal, then the peer AS must be the same as the local AS.

Does this change anything else?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 7, 2017 at 13:58

2 Answers 2


Because the AS-PATH attribute is not updated in iBGP, in order to prevent routing loops, an iBGP router will not advertise routes learned from an iBGP peer.

BGP speakers within a single AS (iBGP) must be connected in a full mesh or use a mitigation to prevent traffic from being blackholed.

Some BGP attributes cannot be sent from one AS to a different AS, and some BGP attributes only have meaning between different ASes.


@Ron_Maupin is 100% correct.

As far as the Juniper specific portion goes, this is nothing but a construct to make configuration easier, as well as more explicit/obvious. JunOS was built to be very specific in nature.

The following example would work for both iBGP or EBGP peers, as long as the router on the other end had its AS set correctly, setting a group type is not mandatory.

jhead@VPN-EP1# show | compare
[edit protocols]
+   bgp {
+       group TRANSIT {
+           neighbor {
+               peer-as 65555;
+           }
+       }
+   }

As you can see, you don't have to specify external or internal. But looking at that configuration you wouldn't be able to tell whether it was EBGP or iBGP, without looking at neighbor information or already having knowledge of the network.

For a more practical reason to set a type at the group level, would be enforcement of that type of peering in that group. If you have a group built for peers in an IX exchange, those peers probably inherit the same policies and other attributes. If someone comes along and puts an iBGP peer in that group without having the type set, that peer might come up. There are a ton of reasons that this could be bad, but would vary per deployment, setting the type at the group level helps mitigate any of the potential issues.

It's a lot cleaner to do something like this:

jhead@VPN-EP1# show protocols bgp
group TRANSIT {
    type external;
    neighbor {
        peer-as 20000;

jhead@VPN-EP1# show routing-options
autonomous-system 10000;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.