What is MP-BGP?

Multiprotocol BGP (MP-BGP) extends the Border Gateway Protocol to carry route information for multiple address families – IPv4, IPv6, VPNv4, VPNv6, and multicast – within a single BGP session. Versa SD-WAN Controllers run MP-BGP, augmented with custom SD-WAN attributes, as the control-plane protocol that distributes routes, security associations, and topology across the overlay.

Key takeaways

• MP-BGP extends BGP to carry IPv4, IPv6, VPNv4, VPNv6, and multicast routes.
• Versa SD-WAN Controllers act as MP-BGP route reflectors, one session per tenant per branch.
• Versa augmented MP-BGP’s NLRI to carry key management and access-circuit state.
• MP-BGP sessions run inside secure IPsec control-plane tunnels to each CPE.
• Graceful restart lets MP-BGP routes survive a Controller outage for hours.

On this page: Why it matters · How it works · Types · MP-BGP & Versa · FAQ

Why is MP-BGP important?

Any network carrying more than plain IPv4 unicast over BGP needs a way to describe additional route types. MP-BGP does this by adding address-family identifiers to BGP’s update messages, so one session carries IPv4, IPv6, VPN, and multicast routes side by side – the same mechanism MPLS Layer 3 VPN networks use to distribute per-customer VPNv4 and VPNv6 routes across a shared provider core.

Versa’s SD-WAN control plane is built on this same proven technology rather than a proprietary protocol. That matters operationally: BGP route-reflector scaling and troubleshooting practices network engineers already know carry directly into SD-WAN operations. MP-BGP sessions between Controllers and CPE devices, inside secure control channels, also carry the security-association and topology information that lets thousands of branches build direct tunnels without full-mesh manual configuration.

What is MP-BGP?

MP-BGP is BGP-4 with multiprotocol extensions: path attributes (MP_REACH_NLRI and MP_UNREACH_NLRI) that let an update announce or withdraw routes for an address family other than plain IPv4 unicast. A Versa Controller acts as a BGP route reflector – it doesn’t forward data traffic, but uses NLRI and community attributes to learn routes and security-association (SA) information from branch CPE devices and reflect them to other branches in the same VPN.

Versa extends MP-BGP’s NLRI with information beyond routes and next hops: transport WAN interface state, NAT information, and PKI key exchange. This lets a branch CPE device, after receiving BGP NLRI and SA information from the Controller, establish an IPsec tunnel directly to a remote peer without a separate discovery step.

Types of MP-BGP

MP-BGP’s address-family identifiers (AFI/SAFI pairs) distinguish the route types it carries in one session: IPv4 and IPv6 unicast, VPNv4 and VPNv6 (used in MPLS Layer 3 VPN, and by Versa CPE devices acting as PE-like nodes), and multicast. The VPNv4 and VPNv6 families carry route distinguisher and route target attributes that keep per-VPN routing tables isolated on a shared session.

On top, Versa’s SD-WAN implementation adds its own NLRI extensions outside the base standard: attributes describing each branch’s transport WAN interfaces, NAT state, and key material for IPsec tunnels. These let a Controller distribute enough information for CPE devices to build hub-and-spoke, full-mesh, or partial-mesh topologies automatically, driven by import and export policies rather than manual peer configuration.

MP-BGP & Versa

In Versa’s SD-WAN architecture, each Controller node acts as a multi-instance MP-BGP route reflector, maintaining one BGP session per tenant per branch, each inside its own secure overlay control channel. The Controller redistributes routes, VPN labels, and SA information so CPE devices build the appropriate topology for each VPN – hub and spoke, full mesh, or partial mesh – based on configured policy, without manual peering.

Control-plane resilience relies on mechanisms in the consolidated SD-WAN design guide: IKE dead-peer detection, the hold timer, and BFD detect a lost session, withdrawing routes and tearing down affected tunnels. Graceful restart, on by default with a multiplier of 8, retains routes for up to eight hours so forwarding keeps running through a brief outage. For large deployments, hub-controller nodes (HCNs) extend this control plane hierarchically, unifying SD-WAN islands through IBGP sessions to a headend Controller. Versa’s approach parallels traditional MPLS Layer 3 VPN design, with CPE devices playing a PE-like role.

Frequently asked questions

What is the difference between BGP and MP-BGP?

Plain BGP-4 carries only IPv4 unicast reachability. MP-BGP adds path attributes that let the same session carry other address families – IPv6, VPNv4, VPNv6, multicast – and, in Versa’s case, custom SD-WAN attributes, without a separate protocol or session.

How does Versa’s SD-WAN use MP-BGP?

SD-WAN Controllers run MP-BGP as route reflectors, distributing routes and security-association information to branch CPE devices over secure control channels. Versa’s MP-BGP extensions let branches learn enough about remote peers to establish direct IPsec data tunnels automatically.

What is a BGP route reflector, and how does Versa use one?

A route reflector lets BGP peers exchange routes through a central point instead of a full mesh. Versa Controllers act as route reflectors, receiving updates from each branch and reflecting them to other branches in the same VPN.

What extensions has Versa added to MP-BGP?

Versa augments MP-BGP’s NLRI with attributes for key management, transport WAN interface state, and access-circuit state. These let a CPE device establish IPsec tunnels to remote peers directly from BGP-distributed information, without a separate discovery step.

What happens to MP-BGP routes if a Controller becomes unreachable?

Loss of a Controller session is detected by IKE dead-peer detection, the MP-BGP hold timer, or BFD. Graceful restart, on by default with a multiplier of 8, retains routes for up to eight hours so the data plane keeps forwarding.

More on MP-BGP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about MP-BGP, these are worth looking at next.