BGP Local-Pref vs MED: show ip bgp When the 'Wrong' ISP Still Wins

Cisco routing · Techclick CLI troubleshooting lab

You raised MED to make ISP-B less preferred. Outbound traffic still leaves ISP-B. Inbound is a separate fight.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco routing for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Outbound path is local-pref, weight, then AS-path, then MED. MED does not choose your exit unless those are equal.

Why this ticket shows up

MED is a hint to the other AS. Local-pref is how you pick your own exit. People apply the wrong attribute.

Symptoms operators actually see

• Outbound still on ISP-B

• MED changed on inbound advertisements

• local-pref equal

• Weight leftover on a network statement

CLI first — copy this block

Run these on the Cisco routing device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show ip bgp 8.8.8.8
show ip bgp neighbors 192.0.2.1 advertised-routes
show route-map SET-MED
show ip bgp summary

How to read that output

show ip bgp on a destination shows why that path won: bestpath reason. If local-pref is 200 vs 100, MED is irrelevant.

Triage order

1. show ip bgp for a destination

2. Read bestpath attributes

3. Set local-pref for outbound preference

4. Use MED only to influence inbound from that ISP

5. Clear the session or wait for update

Classic traps

What you see	Real cause	Fix
Keep raising MED	You wanted outbound	Set local-pref
AS-path prepend inbound	That affects how others reach you	Different problem
Hard reset repeatedly	Policy is still wrong	Fix the map

Proof the ticket is closed

• bestpath uses ISP-A

• traceroute leaves ISP-A

• Attributes documented

Say this in an interview

I ask whether we are choosing our exit or influencing inbound. Local-pref vs MED is that question.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/