One of the most common routing troubleshooting mistakes is stopping at show ip bgp. The route appears in BGP, so the assumption is that the router must be using it. That assumption is not always correct.
A BGP prefix must move through several decision and programming stages before a packet can leave the correct interface. The BGP process learns and selects a path. The routing information base decides whether that path becomes the active route. Cisco Express Forwarding then converts the active route into forwarding information that the data plane can use.
Why It Matters
BGP answers which path the protocol prefers. The RIB answers which route the router installed. CEF answers how the router intends to forward the packet. Those are related questions, but they are not the same question.
01
The One Sentence Explanation
The RIB decides the active route, the FIB stores the forwarding result, and CEF is the Cisco forwarding architecture that uses the FIB and adjacency information to move packets.
| Component | Primary Job | Plane | Cisco Command |
|---|---|---|---|
| BGP table | Stores BGP paths and identifies the BGP best path | Control plane | show ip bgp |
| RIB | Selects the active route from all routing sources | Control plane | show ip route |
| FIB | Provides optimized prefix, next hop, and interface lookups | Forwarding plane | show ip cef |
| CEF | Uses the FIB and adjacency table to forward packets efficiently | Forwarding architecture | show ip cef and show adjacency |
Common Mistake
Do not describe CEF as a separate table that comes after the FIB. On Cisco platforms, the FIB is one of the main data structures used by CEF. The other major structure is the adjacency table.
02
How a BGP Route Moves Through the Router
The easiest way to understand the relationship is to follow one route from the BGP neighbor to the outgoing interface.
BGP UPDATE received from neighbor
↓
Inbound BGP policy
↓
BGP path table
↓
BGP best path selected
↓
Global routing table, RIB
↓
Cisco Express Forwarding
├── FIB lookup
└── Adjacency lookup
↓
Hardware or software forwarding
↓
Packet leaves the interface
Each stage can succeed while the next stage fails. A route can be received but filtered. It can be accepted but lose the BGP best path decision. It can become the BGP best path but lose to another routing protocol in the global RIB. It can be installed in the RIB but not yet be programmed correctly in the forwarding plane. It can also have a correct FIB entry but an unresolved adjacency.
Architect’s Note
Troubleshooting should follow the same direction as route installation. Start with the protocol, move to the RIB, then move to CEF and the platform forwarding layer. Random command collection usually hides the actual failure boundary.
03
The BGP Table and the RIB Are Not the Same
The term RIB can be confusing because BGP itself defines conceptual routing information bases. RFC 4271 describes the Adj RIB In, Loc RIB, and Adj RIB Out. These represent routes received from peers, routes selected by the local BGP decision process, and routes prepared for advertisement to peers.
In daily Cisco troubleshooting, engineers usually use RIB to mean the global IP routing table displayed by show ip route. That table contains active routes selected from BGP, OSPF, EIGRP, static routes, connected routes, and other sources.
The BGP table can contain several paths for the same prefix. BGP chooses its best path from those BGP candidates. It then attempts to install the selected path in the global RIB. The RIB can reject it when another route for the same prefix has a better administrative distance or when required next hop resolution is missing.
Router# show ip bgp 10.193.131.0/24 Router# show ip route 10.193.131.0 255.255.255.0
The first command answers: What does BGP know and which BGP path did it select? The second answers: What route did the router actually install?
BGP RIB Failure
A BGP route marked with r can still be the BGP best path while failing installation into the global RIB. A common cause is an identical prefix learned from a source with a lower administrative distance. The forwarding path then follows the route installed in the global RIB, not the BGP path marked as best.
04
What the FIB Actually Does
The forwarding information base is optimized for packet lookup. It is derived from the active routing information and contains the destination prefix, resolved next hop, outgoing interface, and forwarding behavior required by the data plane.
The RIB is designed to support route selection and maintain routing information. The FIB is designed to answer a much faster question for every packet: where should this destination go?
On a router with equal cost paths, the FIB can contain multiple next hops. CEF then applies the platform hashing logic to select a path for a particular flow. This is why two engineers can look at the same routing table, run traffic with different source and destination pairs, and observe different outgoing links.
Router# show ip cef 10.193.131.10 detail Router# show ip cef exact-route 10.10.10.25 10.193.131.10
The first command shows the forwarding entry for the destination. The exact route command is more useful when equal cost multipath is present because it evaluates a specific source and destination combination.
Real World Example
In an AWS Direct Connect design with multiple BGP paths, show ip route can confirm that multiple next hops are installed. show ip cef exact-route can then show which uplink a specific application flow is expected to use. Uneven link utilization does not automatically mean ECMP is broken. Per flow hashing naturally produces different totals when flows have different sizes and durations.
05
Where CEF Fits
Cisco Express Forwarding is the Cisco Layer 3 forwarding architecture. Its two primary structures are the FIB and the adjacency table.
- FIB: Contains destination prefixes and resolved forwarding paths.
- Adjacency table: Contains the Layer 2 rewrite information needed to reach the next hop.
The FIB might correctly say that a destination uses a particular next hop and interface. The packet can still fail if the adjacency for that next hop is incomplete, unresolved, discarded, or otherwise unusable.
Router# show adjacency HundredGigE0/1/0.100 detail Router# show arp 10.1.1.2
The adjacency command shows the rewrite information CEF intends to use. ARP confirms whether the IPv4 next hop resolved to a Layer 2 address.
Industry Trend
Modern routers separate control plane route calculation from hardware forwarding. The exact programming path differs by platform, but the troubleshooting principle remains consistent. Confirm the route in the protocol, confirm installation in the RIB, confirm the forwarding entry, then confirm hardware and adjacency state.
06
The Commands to Use
The following commands create a clean progression from BGP learning to packet forwarding. Command syntax can vary slightly by Cisco platform and software release.
Check the BGP neighbor and received scale
show ip bgp summary show ip bgp neighbors 10.1.1.2 show ip bgp neighbors 10.1.1.2 routes show ip bgp neighbors 10.1.1.2 advertised-routes
Check the BGP path for one prefix
show ip bgp 10.193.131.0/24 show bgp ipv4 unicast 10.193.131.0/24 show ip bgp rib-failure
Check the global RIB
show ip route 10.193.131.0 255.255.255.0 show ip route 10.193.131.10 show ip route 10.1.1.2
Check CEF and the adjacency
show ip cef 10.193.131.10 detail show ip cef exact-route 10.10.10.25 10.193.131.10 show adjacency HundredGigE0/1/0.100 detail show arp 10.1.1.2
Check a VRF
show bgp ipv4 unicast vrf CLOUD 10.193.131.0/24 show ip route vrf CLOUD 10.193.131.10 show ip cef vrf CLOUD 10.193.131.10 detail
Escalate to platform forwarding checks on IOS XE
show platform software ip rp active cef summary show platform software ip fp active cef summary show platform software ip rp active cef detail show platform software ip fp active cef detail show platform software adjacency rp active show platform software adjacency fp active
Platform Warning
Platform commands are not universal. An ASR 1000, Catalyst 8500, Catalyst switch, Nexus switch, and virtual router can expose forwarding state differently. Use the commands that match the platform architecture and software release.
07
A Practical BGP Troubleshooting Workflow
Use one affected destination and walk it through the router in order. Do not begin with broad table dumps unless the problem is truly table wide.
- Confirm the BGP session. Verify the neighbor is Established and that the expected address family is active.
- Confirm the prefix exists in BGP. If it is absent, inspect inbound policy, prefix limits, address family configuration, and what the peer actually advertised.
- Confirm the BGP path is valid and selected. Check next hop reachability, weight, local preference, locally originated status, AS path, origin, MED, and multipath eligibility.
- Confirm the route entered the global RIB. Compare the BGP entry with the active route in show ip route.
- Confirm recursive next hop resolution. A BGP next hop must resolve through an installed route.
- Confirm the CEF entry. Verify the destination resolves to the expected next hop and interface.
- Confirm the adjacency. Verify ARP or neighbor discovery and the Layer 2 rewrite.
- Confirm the actual traffic path. Use exact route checks, interface counters, packet capture, and platform counters.
- Confirm the return path. A correct forward path does not prevent asymmetric routing, firewall drops, or a missing route in the opposite direction.
| Observation | Likely Boundary | Next Check |
|---|---|---|
| Prefix absent from BGP | Peer, policy, or address family | Neighbor routes, inbound policy, logs |
| Prefix in BGP without best path marker | BGP decision process | Attributes and next hop reachability |
| BGP best path marked with RIB failure | RIB installation | Competing route and administrative distance |
| Route in RIB but missing or different in CEF | Forwarding programming | CEF state and platform forwarding state |
| CEF correct but traffic still fails | Adjacency or packet path | ARP, ACL, firewall, MTU, counters, return path |
08
Real World Failure Scenarios
Scenario One: BGP prefers the route, but OSPF owns the RIB
A router receives 10.193.131.0/24 through BGP and marks it as the BGP best path. The same prefix is also learned through OSPF. The OSPF route has a lower administrative distance, so the global RIB installs OSPF.
show ip bgp 10.193.131.0/24 show ip route 10.193.131.0 255.255.255.0 show ip bgp rib-failure
The correct conclusion is not that BGP is broken. BGP selected its preferred path, but the global routing process selected a different routing source. This distinction becomes critical during migrations where BGP and an IGP temporarily advertise overlapping prefixes.
Scenario Two: The route is installed, but CEF has not completed programming
Large BGP updates can create a short interval where the BGP table and global RIB have converged before every forwarding component has completed programming. Cisco documents this behavior on modular IOS XE platforms, particularly when very large route tables are installed.
show ip route 10.193.131.10 show ip cef 10.193.131.10 detail show platform software ip rp active cef summary show platform software ip fp active cef summary
A persistent mismatch is not normal and should be investigated. A brief programming interval after a large change can be platform dependent.
Scenario Three: RIB and FIB are correct, but the adjacency is incomplete
The destination resolves through the correct next hop and interface, but the router cannot resolve the next hop MAC address. The route exists and CEF knows the intended path, yet the router cannot construct the Ethernet frame.
show ip cef 10.193.131.10 detail show adjacency HundredGigE0/1/0.100 detail show arp 10.1.1.2 show interfaces HundredGigE0/1/0.100
At this point, changing BGP attributes is the wrong response. The failure is below route selection.
Scenario Four: ECMP is installed, but traffic looks uneven
BGP multipath installs two equal next hops. The RIB and CEF both show both paths, but one link carries more traffic. That can be expected because CEF normally hashes flows rather than dividing every packet into equal totals across all interfaces.
show ip route 10.193.131.0 255.255.255.0 show ip cef 10.193.131.10 detail show ip cef exact-route 10.10.10.25 10.193.131.10 show ip cef exact-route 10.10.20.25 10.193.131.10
Test multiple source and destination pairs before deciding that load sharing has failed.
09
Common Mistakes
Stopping at show ip bgp
This proves what BGP knows. It does not prove what the router installed or how the router forwards traffic.
Treating the BGP best path as the forwarding winner
BGP selects the best path among BGP candidates. The global RIB still compares that result against other routing sources.
Calling the routing table the BGP table
The BGP table and global routing table serve different purposes. Use precise language when documenting an outage or migration.
Assuming CEF only means the FIB
CEF uses the FIB for destination lookups and the adjacency table for Layer 2 rewrite information. Both matter.
Ignoring the VRF
A route can exist in one VRF and be absent from another. Always run the BGP, RIB, and CEF checks in the same routing context.
Changing BGP policy for a forwarding problem
When the RIB and CEF already point to the correct next hop, changing local preference or AS path prepending usually does not address the actual failure. Check adjacency, firewall policy, MTU, interface state, and return routing.
10
The Final Troubleshooting Checklist
- Is the BGP neighbor Established?
- Did the router receive the expected prefix?
- Did inbound policy permit it?
- Is the BGP next hop reachable?
- Did BGP select the intended path?
- Did the global RIB install the BGP route?
- Is another routing source winning?
- Does the FIB resolve the destination correctly?
- Is the adjacency complete?
- Is the expected path programmed in hardware?
- Do interface and platform counters confirm forwarding?
- Does the return path follow a valid and permitted route?
The Practical Rule
BGP tells you what the protocol selected. The RIB tells you what the router accepted. CEF tells you how the router will forward. Always verify all three before declaring the route correct.
11