AWS <> Cisco IPSec configuration

[AvdVyver]

Hi,

I have a few IPSec tunnels between my Cisco router and my Amazon AWS VPCs (using the AWS VPC VPN functionality). I have always just downloaded the suggested configuration from the AWS VPN for Cisco and modified it for my router. I am no Cisco expert and I was wondering why the neighbor statements appear under both the "router bgp" section as well as the "address-family"? Is there a specific reason for this? Or is it possible for the neighbor statements only to appear once under the address-family section?   

router bgp 65000
  neighbor 169.254.0.1 remote-as 7224
  neighbor 169.254.0.1 activate
  neighbor 169.254.0.1 timers 10 30 30
  address-family ipv4 unicast
    neighbor 169.254.0.1 remote-as 7224
    neighbor 169.254.0.1 timers 10 30 30
    neighbor 169.254.0.1 activate
    neighbor 169.254.0.1 soft-reconfiguration inbound

Thanks!

[Mark Malone · Accepted solution]

Hi
its a newer style of BGP called MBGP which has extensions , the BGP process can be broken down into multiple different sections , they need to be in both sections the neighbor statements anyway but you shouldn't need to activate it under main area but only under ipv4 section
neighbor 169.254.0.1 activate

so we have the same setup but we also use  address-family ipv4 vrf xxx for iwan and ISPs will also have another section for there PE -PE communication address-family vpnv4 unicast

https://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfmbgp.html

probably the best explanation ive seen it described anyway from Peter in another post below

https://supportforums.cisco.com/t5/wan-routing-and-switching/when-to-use-bgp-address-family/td-p/1927840

[AvdVyver]

Thanks a lot for the clarification Mark!