Border Gateway Protocol (BGP) has shaped Internet connectivity for decades, exchanging reachability information between independently operated networks. But BGP is no longer confined to the Internet edge. Enterprises have been actively using BGP within their own networks. Now BGP assurance can move with it.
Enterprise Routing Assurance enables an Enterprise Agent inside your network to collect routes over local external BGP (eBGP) sessions and send routing telemetry to Cisco ThousandEyes through an authenticated outbound HTTPS connection. This includes environments that use private autonomous system numbers (ASNs) to identify internal routing domains and private IP prefixes for internal addressing. Collection takes place on the customer-deployed Enterprise Agent, while the ThousandEyes platform provides route visualization, historical analysis, metrics, and alerts. This article examines how local and hosted collection differ, how export policies determine the routes visible to each monitor, and how routing events can be compared with active network and application measurements.
The Internal BGP Visibility Gap
Public route collectors provide valuable insight into how the Internet sees an organization’s prefixes. But they cannot observe routes that exist only inside an enterprise network.
When an internal prefix disappears, an unexpected AS enters a path, or a route begins oscillating;, investigation often starts at the router's command line interface. Operators collect routing information on specific prefixes, compare output from multiple devices, inspect logs, and attempt to reconstruct when the change occurred, and which locations were affected.
That process can be time-consuming and difficult to scale, and it separates control-plane analysis from the network and application symptoms users experience. At ThousandEyes, we wanted to close that gap by extending our established BGP monitoring capabilities to private environments that use BGP as their control plane.
Extending Proven BGP Monitoring Into the Enterprise
ThousandEyes already provides multiple perspectives on Internet routing:
ThousandEyes-operated BGP monitors form the primary distributed infrastructure for our Internet routing monitoring.
Public BGP monitors supplement this coverage with routing data from public sources.
Customer-specific private BGP monitors provide a routing view using routes advertised by a customer’s routers to a ThousandEyes-hosted collector.
Together, these perspectives help organizations monitor prefix reachability, investigate path changes, examine announcements and withdrawals, detect unexpected origins, and correlate routing events with network and application performance, among other use cases.
With hosted private BGP monitoring, a customer router establishes a multi-hop eBGP session with a ThousandEyes-hosted route collector. That approach remains valuable, but security policies or compliance requirements may restrict the use of public router addresses, outbound TCP port 179, or routing protocol sessions across an organization’s security perimeter. Enterprise Routing Assurance introduces another option.
Turn an Enterprise Agent Into a Local BGP Collector
With Enterprise Routing Assurance, BGP collection can be enabled on an Enterprise Agent deployed inside your network.
A router establishes a local eBGP session with the Enterprise Agent and advertises routes according to its export policy. Each peering session provides a routing vantage point represented in ThousandEyes as a BGP monitor. The Enterprise Agent receives and processes the routing updates, then sends the resulting routing telemetry to the ThousandEyes platform through its existing secure, authenticated outbound HTTPS connection. The BGP session remains inside the organization; there is no need to extend TCP port 179 from the router to a collector across the public Internet.
Once the data reaches ThousandEyes, teams can use the familiar Routing Views, Metrics, and Alerting workflows, along with the new Looking Glass view for inspecting collected BGP routes at different points in time.
From Routing Updates to Actionable Assurance
Enterprise Routing Assurance turns internal BGP activity into information that operations teams can understand and act on.
Teams can monitor:
Reachability to determine whether a prefix is visible from selected routing vantage points.
Path changes to track changes in observed AS paths and investigate unstable or unexpected routing behavior.
Updates to measure the volume of BGP announcements and withdrawals received from routing vantage points.
BGP Route Visualization presents current and historical AS paths in an interactive topology. Looking Glass complements this visualization with a structured view of advertised prefixes and their associated monitors, AS paths, communities, next-hop information, and other route attributes. For deeper investigation, the BGP Updates table exposes individual announcements and withdrawals, with their prefixes, source monitors, timestamps, and available route attributes, including AS paths and communities.
Teams can configure routing alerts for loss of prefix reachability, frequent path changes or route flapping, unexpected origin or transit ASNs, and unexpected more-specific prefix announcements. Also, they can compare BGP events collected by the Enterprise Agent with active network and application measurements. This helps teams investigate questions such as:
Did the route change coincide with packet loss or increased latency?
Did an inter-region failover restore connectivity?
Did the application remain available while the control plane converged?
Did traffic move to the expected backup path?
Did a change in an upstream AS path coincide with connectivity or application performance issues inside the enterprise?
This correlation helps teams move from route inspection to impact analysis and root-cause isolation.
Designed for Controlled Enterprise Environments
Enterprise Routing Assurance fits within the Enterprise Agent’s existing communication and security model.
The routing protocol session is established locally between the organization’s router and the Enterprise Agent. Routing telemetry is then sent outbound over HTTPS, using the agent’s established platform communication path.
Organizations can continue to apply their existing firewall, proxy, certificate-trust, and egress controls. Where TLS inspection is required, the proxy’s signing CA certificate can be installed on the Enterprise Agent so its HTTPS communication can traverse an authorized decrypting proxy.
Administrators also retain control over which routes are shared with the collector through standard BGP export policies and prefix filters.
This design helps avoid Internet-facing BGP peering and allow organizations to apply their established security and traffic-inspection controls to the outbound telemetry connection, including controls required by their compliance policies.
Enterprise Routing Use Cases
Enterprise Routing Assurance supports a range of operational scenarios:
Data center fabric and underlay visibility: Monitor route withdrawals, unexpected AS paths, and instability in eBGP-based leaf-spine or Clos fabrics, and correlate routing changes with application connectivity.
Inter-data-center and inter-region routing: Observe advertised path changes during failover and correlate them with connectivity measurements.
Hybrid and multi-cloud connectivity: Monitor private prefixes exchanged between data centers, cloud networks, virtual routing gateways, and WAN edges.
Campus, branch, and private WAN routing: Observe reachability and path behavior across internal eBGP boundaries and private ASN domains.
Mergers and network integration: Monitor routes exchanged between previously independent routing domains while integration policies evolve.
Change validation: Confirm the propagation and withdrawal of expected prefixes during migrations, maintenance, and policy changes.
Labs and preproduction environments: Test routing behavior and failure scenarios without depending on public collectors.
Comparing local and Internet routing views: For public destination prefixes exported to the Enterprise Agent, compare the AS paths advertised by the enterprise router with the paths observed by public BGP monitors.
Enterprise Routing Assurance in Action
For example, if a monitored prefix is withdrawn during a failover scenario and a replacement route is advertised, teams can inspect the updates and their source monitors, compare the advertised AS paths before and after the change, and review network and application measurements over the same period. The routing data shows what was advertised; the active measurements show whether connectivity and application availability recovered.
See Enterprise Routing Assurance in action in the video below.
Bringing Assurance to the Routes Public Monitors Cannot See
Enterprise Routing Assurance brings ThousandEyes’ route visualization, historical analysis, alerting, and cross-layer correlation to private eBGP environments. By placing the collection point on an Enterprise Agent, organizations gain visibility into the routing domains that matter to them, without extending BGP peering beyond their security perimeter.
To discuss Enterprise Routing Assurance in your environment, reach out to your ThousandEyes account team or contact us.
© 2026 Cisco Systems, Inc. and/or its affiliates. All rights reserved
