What is BGP Flowspec and How to Configure It?
What is BGP Flowspec? BGP Flowspec is a feature that extends the Border Gateway Protocol (BGP) to enable…

These two protocols get compared constantly, but they are not competitors — they solve different problems at different scales.
OSPF optimises. BGP negotiates. That is the whole distinction, and almost every other difference follows from it.
| OSPF | BGP | |
|---|---|---|
| Type | IGP — interior | EGP — exterior |
| Algorithm | Link-state (Dijkstra SPF) | Path-vector |
| Scope | Within one autonomous system | Between autonomous systems |
| Transport | IP protocol 89, direct | TCP port 179 |
| Neighbour discovery | Automatic via multicast hellos | Manual — every peer configured explicitly |
| Path selection | Lowest cost (bandwidth-derived) | Best-path algorithm, ~13 tie-breakers |
| Metric | Cost — a single number | Attributes: weight, local preference, AS-path, MED, origin |
| Convergence | Seconds | Tens of seconds to minutes |
| Routing table size | Hundreds to a few thousand | 1,000,000+ in the global table |
| Topology knowledge | Full map of the area | Only the AS path, not the internal topology |
| Administrative distance | 110 | 20 (eBGP) / 200 (iBGP) |
| Policy control | Minimal | Extensive — the entire point |
| Authentication | MD5, SHA | MD5, TCP-AO |
| Loop prevention | SPF over a complete link-state database | AS-path — reject any route already containing your own ASN |
| Hierarchy | Areas, with a mandatory area 0 backbone | Route reflectors and confederations |
Every router floods link-state advertisements describing its own links. Every router in the area therefore holds an identical database — a complete map. Each then runs Dijkstra’s algorithm against it to compute a shortest-path tree rooted on itself.
Cost is derived from bandwidth: reference bandwidth ÷ interface bandwidth. The default reference of 100 Mbps means every link at 100 Mbps and above scores a cost of 1, so a gigabit link and a 100 Gbps link look identical. On any modern network you should raise it:
Router(config-router)# auto-cost reference-bandwidth 100000This must be set identically on every router in the area, or path selection becomes inconsistent.
BGP does not know or care about bandwidth, latency or link speed. It walks an ordered list of attributes and stops at the first one that breaks the tie:
The practical consequence: BGP will happily choose a slow, congested path over a fast one if the AS-path is shorter. It is optimising for policy and reachability, not performance.
A multi-homed organisation runs both, and they have distinct jobs:
The standard practice is not to redistribute the full BGP table into OSPF. A million routes will destroy an OSPF process. Instead, internal routers get a default route pointing at the BGP-speaking edge, and only the edge holds the full table.
| Situation | Use |
|---|---|
| Routing inside a campus or data centre | OSPF (or IS-IS, or eBGP in modern spine-leaf fabrics) |
| Single internet connection | Neither — a default static route is sufficient |
| Two connections to one ISP | Usually still static plus a floating static backup |
| Two or more different ISPs | BGP — you need your own ASN and address space |
| You must control which provider inbound traffic uses | BGP — nothing else can do this |
| Connecting to a partner or cloud provider | BGP — AWS Direct Connect, Azure ExpressRoute and equivalents all use it |
| Large modern data centre fabric | eBGP everywhere, increasingly, for its scaling and policy control |
The most common mistake is deploying BGP for a single-homed connection. If you have one provider, there is no path decision to make and a default route does the job with none of the complexity.
OSPF is easier to break badly. A flapping link floods LSAs to every router in the area, each of which reruns SPF. Areas exist to contain this blast radius, and skipping the hierarchy on a large flat network causes CPU problems that appear only under failure conditions.
BGP is easier to break publicly. A misconfigured BGP filter can leak routes to the internet and black-hole traffic for networks that are not yours. Prefix filters, maximum-prefix limits and RPKI validation are not optional on an internet-facing BGP session.
Router(config-router)# neighbor 203.0.113.1 maximum-prefix 500 90 warning-onlyConvergence differs by an order of magnitude. OSPF reconverges in seconds. BGP is deliberately slow — dampening, timers and the MRAI interval exist to keep the global table stable, not to be fast. A backup path via BGP will not fail over as quickly as one via OSPF.
Inside a data centre fabric, increasingly yes — eBGP-everywhere designs are common. In a general enterprise network, no: BGP has no automatic neighbour discovery, converges far more slowly, and does not select paths on link speed.
OSPF converges much faster. BGP’s slowness is intentional, to keep the internet’s routing table from oscillating.
Only if they are to different providers and you need the same public addresses to work over either. Two links to one ISP, or two links where you can tolerate different public addresses, are handled with static routes and NAT.
Because the table is large and must be reliably delivered, and because peers are often not directly connected. TCP handles retransmission, ordering and connection management so BGP does not have to. OSPF runs directly over IP and implements its own reliability, which works because neighbours are always adjacent.
eBGP peers with a different AS number; iBGP peers within the same one. eBGP has AD 20 and decrements TTL; iBGP has AD 200, does not advertise routes learned from one iBGP peer to another (requiring a full mesh, route reflectors or confederations), and does not change the next hop by default.
Almost never for the full table — it will overwhelm OSPF. Redistribute a default route or a small set of summaries instead, and keep the full table on the edge routers that need it.
EIGRP is another IGP, comparable to OSPF rather than BGP. See EIGRP vs OSPF for that comparison.