BGP Neighbor Stuck in Active/Idle: How to Fix It
A BGP session that never reaches Established sits in Idle, Connect, or Active. Each state tells you where it's failing — TCP, reachability, or the BGP parameters. Here's how to read it and fix it.
Step 1 — Read the state
show ip bgp summary
show ip bgp neighbors <ip>What the state means:
- Idle — BGP isn't even trying: no route to the neighbor, the peer isn't configured/reachable, or the session is administratively down.
- Active / Connect — BGP is trying to open the TCP session but the handshake on port 179 is failing (blocked, wrong neighbor IP, or no return path).
Step 2 — Reachability and TCP 179
ping <neighbor-ip>
telnet <neighbor-ip> 179If ping fails, fix routing first. If ping works but TCP 179 doesn't open, an ACL or firewall is blocking BGP, or the peer isn't listening (peer not configured for your IP).
Step 3 — Check the BGP parameters
- Remote AS: a wrong
remote-ason either side keeps the session down. Verify both ends. - Update source: if peering over loopbacks, both sides need
update-sourceset to the loopback, and eBGP over loopbacks needsebgp-multihop. - TTL / multihop: directly-connected eBGP expects TTL 1; multihop or loopback peering needs the matching multihop setting.
Watch the negotiation if needed:
debug ip bgp <neighbor-ip>Step 4 — Fix and confirm
Correct the reachability, ACL, AS, or update-source issue, then clear the session and confirm it reaches Established: clear ip bgp <neighbor-ip> and re-check show ip bgp summary.
How Tech Matrix solves this in ~60 seconds
The state tells you the layer, but confirming TCP 179, reachability and the AS/update-source config still means hopping between two routers. Tech Matrix reads the BGP state and config on both peers at once, tells you whether it's reachability, an ACL, or a parameter mismatch, and gives the exact fix for your platform — in seconds, with your approval.
Frequently asked questions
Active means BGP is trying to open the TCP session to the peer but the handshake on port 179 is failing — usually blocked TCP, a wrong neighbor IP, or no return route.
Idle means BGP isn't attempting a connection: no route to the neighbor, the peer isn't configured/reachable, or the session is administratively shut.
Confirm reachability (ping), confirm TCP 179 isn't blocked, verify the remote-as matches, and for loopback/eBGP peering set update-source and ebgp-multihop.