09-27-2018 06:51 AM
Hello essays :)
something I've seen pretty often but never understood is: why we receive a route in BGP but we can't ping as seen in the output below:
R333#show ip bgp vpnv4 vrf ciaoo neighbors 3.3.3.2 received-routes
BGP table version is 6, local router ID is 30.30.30.30
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 3:3 (default for vrf ciaoo)
*> 11.11.11.0/24 3.3.3.2 0 2 1 i <<<<<<<<<<<<<<<<<<<
Total number of prefixes 1
R333#ping vrf ciaoo 11.11.11.0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.11.11.0, timeout is 2 seconds:
..... <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Success rate is 0 percent (0/5)
Any type of help will be kindly appreciate.
David
09-27-2018 12:19 PM
In you case many reason i can think of.
1. you have route does not mean you can always reachable.
- reasons may be you are not allowed ping
- may be any ACL in place.
- where is this IP outside network.
- you have enough access to ping.
2. Check traceroute and see where it dropping.
3. since we do not know your topo hard to say at the moment.
but start from traceroute 1 hop at a time, until edge of your network see you can ping from your edge network device.
09-28-2018 03:01 AM
This is MPLS VPNv4 route, the reasons why you are not able to ping can be various.
traceroute in case of MPLS will not help much, but it can, if it is allowed in the network (it usually is not)
(do not recommend to play with it in production networks)
1.check whether the source IP of the ping is reachable for the opposite side
(on opposite side, check whether it can see in pertaining vrf the route to the source IP
the same way, as you are checking for the route on your end)
2.check whether your MPLS transport is functional!! this is crucial.
Check associated label stack to your route on your router
Check assossiations of labels for destination PE router loopback along the way
easy ...first check, whether you can ping destination PE loopback
then do traceroute for destination PE loopback
then check whether LDP is allowed all the way in traceroute
and then go one hop at a time and check labels in sh mpls forwarding-table
3. If PE-CE connections are involved, you need to check routing end-to-end in both
directions, both ends.
If you want to understand this, you need to dismantle the whole problem and go
one thing at a time.
09-28-2018 03:50 AM
The topology is pretty simple, I am trying to reach a network two as path away, I've created a very basic lab in EVE-NG where from AS 3 I try to reach a network in AS 1, they belong to different vrf so I've done route leaking, there are no policies denying anything bust still not able to ping, I've seen that scenario pretty often, Ive pasted a treceroute:
R333#traceroute vrf ciaoo 11.11.11.0 source loopback 0
Type escape sequence to abort.
Tracing the route to 11.11.11.0
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.1.1 8 msec 8 msec 12 msec
2 * * *
3 * * *
R333#show ip vrf ciaoo
Name Default RD Interfaces
ciaoo 3:3 Lo0
Fa0/0
Thanks
Davide
09-28-2018 04:15 AM
09-28-2018 11:55 AM
If possible can you post all the configuration to have a look.
09-29-2018 11:55 PM
Dear valorous helpers.
Below I've pasted the conf of the 3 routers, as we can see again from R333 we receive network from PE but can't ping
PE#sh run
ip vrf davide
rd 1:788
route-target export 1:788
route-target import 1:788
!
!
!
interface Loopback0
ip vrf forwarding davide
ip address 1.1.1.1 255.255.255.255
!
interface Loopback1
ip vrf forwarding davide
ip address 11.11.11.11 255.255.255.0
!
interface Ethernet0/0
dampening
no ip address
no logging event link-status
carrier-delay msec 0
!
interface Ethernet0/0.1601
description verso VRF ciao_R222
encapsulation dot1Q 1601
ip vrf forwarding davide
ip address 10.1.1.1 255.255.255.0
!
router bgp 1
bgp router-id 10.10.10.10
bgp log-neighbor-changes
no bgp default ipv4-unicast
!
address-family ipv4 vrf davide
network 11.11.11.0 mask 255.255.255.0
redistribute connected
neighbor 2.2.2.2 remote-as 2
neighbor 2.2.2.2 description ciao
neighbor 2.2.2.2 ebgp-multihop 3
neighbor 2.2.2.2 update-source Loopback0
neighbor 2.2.2.2 timers 5 20
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 send-community both
neighbor 2.2.2.2 maximum-prefix 5000 80 warning-only
!
ip route vrf davide 2.2.2.2 255.255.255.255 10.1.1.2
!
PE#
R222#sh run
!
ip vrf ciao
rd 2:11
route-target import 2:11
route-target import 1:788
!
!
interface Loopback0
ip vrf forwarding ciao
ip address 2.2.2.2 255.255.255.255
!
interface Loopback1
ip vrf forwarding ciao
ip address 3.3.3.2 255.255.255.255
!
!
interface Ethernet0/0.1601
description to PE
encapsulation dot1Q 1601
ip vrf forwarding ciao
ip address 10.1.1.2 255.255.255.0
!
interface Ethernet0/1
ip vrf forwarding ciao
description to R333
ip address 192.168.1.1 255.255.255.0
!
router bgp 2
bgp router-id 20.20.20.20
bgp log-neighbor-changes
!
address-family ipv4 vrf ciao
network 22.22.22.0 mask 255.255.255.0
neighbor 1.1.1.1 remote-as 1
neighbor 1.1.1.1 ebgp-multihop 3
neighbor 1.1.1.1 update-source Loopback0
neighbor 1.1.1.1 activate
neighbor 1.1.1.1 send-community both
neighbor 1.1.1.1 soft-reconfiguration inbound
neighbor 3.3.3.3 remote-as 3
neighbor 3.3.3.3 ebgp-multihop 3
neighbor 3.3.3.3 update-source Loopback1
neighbor 3.3.3.3 activate
neighbor 3.3.3.3 soft-reconfiguration inbound
exit-address-family
!
ip route vrf ciao 1.1.1.1 255.255.255.255 10.1.1.1
ip route vrf ciao 3.3.3.3 255.255.255.255 192.168.1.2
!
!
ip prefix-list TO_ITDNE seq 100 permit 0.0.0.0/0 le 32
!
ip prefix-list TO_costa seq 100 permit 0.0.0.0/0 le 32
!
R222#
R333#show ip bgp vpnv4 vrf ciaoo neighbors 3.3.3.2 received-routes
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 3:3 (default for vrf ciaoo)
* 1.1.1.1/32 3.3.3.2 0 2 1 ?
* 10.1.1.0/24 3.3.3.2 0 2 1 ?
* 10.92.227.164/30 3.3.3.2 0 2 1 ?
* 11.11.11.0/24 3.3.3.2 0 2 1 i
Total number of prefixes 4
R333#ping vrf ciaoo 11.11.11.0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.11.11.0, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R333#
R333#sh running-config
!
hostname R333
!
ip vrf ciaoo
rd 3:3
route-target export 3:3
route-target export 2:11
route-target import 3:3
route-target import 2:11
!
interface Loopback0
ip vrf forwarding ciaoo
desc to r222
ip address 3.3.3.3 255.255.255.255
!
interface FastEthernet0/0
ip vrf forwarding ciaoo
desc to r222
ip address 192.168.1.2 255.255.255.0
duplex full
!
router bgp 3
bgp router-id 30.30.30.30
bgp log-neighbor-changes
!
address-family ipv4 vrf ciaoo
neighbor 3.3.3.2 remote-as 2
neighbor 3.3.3.2 ebgp-multihop 3
neighbor 3.3.3.2 update-source Loopback0
neighbor 3.3.3.2 activate
neighbor 3.3.3.2 soft-reconfiguration inbound
exit-address-family
!
R333#
Thank you so much.
Davide
10-13-2018 08:32 PM
Hi.
Follow this:
1. First, the ping from R3 must be "ping vrf ciao 11.11.11.11" not "ping vrf ciao 11.11.11.0"
2. Then, try to put under BGP vrf ciao configuration on R3 or R2 this command "redistribute connected" or announce the network 192.168.X.X/24. And then try the ping again, it should be work.
10-20-2018 01:29 AM
probably
R333#ping vrf ciaoo 11.11.11.1
11.11.11.0 is a network address according the routing table
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide