bgp gr

Pre-Alpha. This page describes behavior that may change.

Graceful Restart (RFC 4724) and Long-Lived Graceful Restart (RFC 9494) state machine.

Configuration

plugin {
    internal gr  { use bgp-gr }
    internal rib { use bgp-rib }
}

bgp {
    peer upstream {
        session {
            capability {
                graceful-restart {
                    restart-time          120;
                    long-lived-stale-time 3600;
                }
            }
        }
        attach process gr {
            receive [ open-received state eor ]
            send    [ update ]
        }
        attach process rib {
            receive [ update state refresh ]
            send    [ update ]
        }
    }
}

The attach process block is authoritative since 2026-08-15. A peer that attaches neither program feeds neither one any peer-scoped event, so neither one acts on that peer's session.

Load the plugin with internal, never with run "ze plugin bgp-gr". The RFC 9494 egress filter runs in the daemon and reads state the plugin engine writes. A child engine leaves that state empty for the life of the daemon, and the filter then fails closed for every neighbour. ze doctor reports the arrangement as doctor-bgp-gr-out-of-process.

Full reference on the Graceful Restart configuration page.

Behaviour

When a peer session drops, the plugin sends retain-routes to the RIB, which marks the routes stale. It starts a restart timer of restart-time seconds. When the peer reconnects, fresh routes replace the stale ones and purge-stale removes what did not come back. If the timer expires without a reconnect, every stale route is purged (with a 5-second safety margin).

When long-lived-stale-time is configured, the LLGR flow starts after the GR window expires. Stale routes get the LLGR_STALE community and stale level 2 (deprioritised in best-path selection). Routes with NO_LLGR are deleted on entry. The LLST timer is per family.

A stale route that Ze forwards on is governed by RFC 9494 sections 4.3 and 4.6. A destination that sent the LLGR Capability gets the route unchanged, an internal destination that did not gets it with NO_EXPORT and LOCAL_PREF 0, and an external destination that did not has the route withdrawn. The filter fails closed on a capability state it cannot read.

Interactions

Depends on bgp-rib for the stale route handling. The engine starts bgp-rib first.
bgp-persist combines with this plugin to provide persist-across-restart for binary upgrades.
The RIB has its own timeout as a fail-safe: stale routes are expired at restart-time + 5s even if the plugin never issues purge-stale.