BGP problem

[Ahmede]

BGP was up and suddenley it went down and it doesn't want to come up again.. We removed all the BGP config and it just came down to the neighbor statments but still down.. We ran debug for TCP and BGP and here's the output..

112828: May 9 18:00:20.160: TCP0: Data repacketized, seq 2642756153, sent 56 byte

112829: May 9 18:00:26.024: TCB63A095A0 created

112830: May 9 18:00:26.024: TCP0: state was LISTEN -> SYNRCVD [179 -> 10.133.23

.17(15269)]

112831: May 9 18:00:26.024: TCP0: Connection to 10.133.23.17:15269, received MSS 1460, MSS is 516

112832: May 9 18:00:26.024: TCP: sending SYN, seq 2151872273, ack 2653104385

112833: May 9 18:00:26.024: TCP0: Connection to 10.133.23.17:15269, advertising MSS 1460

112834: May 9 18:00:26.024: TCP0: state was SYNRCVD -> ESTAB [179 -> 10.133.23.17(15269)]

112835: May 9 18:00:26.024: TCB6388CA58 callback, connection queue = 1

112836: May 9 18:00:26.024: TCB6388CA58 accepting 63A095A0 from 10.133.23.17.15269

112837: May 9 18:00:26.024: BGP: 10.133.23.17 passive open

112838: May 9 18:00:26.024: BGP: 10.133.23.17 went from Active to Idle

112839: May 9 18:00:26.024: BGP: 10.133.23.17 went from Idle to Connect

112840: May 9 18:00:26.028: TCP0: RST received, Closing connection

112841: May 9 18:00:26.028: TCP0: state was ESTAB -> CLOSED [179 -> 10.133.23.17(15269)]

112842: May 9 18:00:26.836: BGP: 10.133.23.17 remote close, state CLOSED

112843: May 9 18:00:26.836: BGP: 10.133.23.17 -reset the session

112844: May 9 18:00:27.836: BGP: 10.133.23.17 went from Connect to Idle

112845: May 9 18:00:27.836: BGP: 10.133.23.17 closing

112846: May 9 18:00:27.836: TCB 0x63A095A0 destroyed

112847: May 9 18:00:27.836: BGPNSF state: 10.133.23.17 went from nsf_not_active

to nsf_not_active

112848: May 9 18:00:48.833: BGP: 10.133.23.17 went from Idle to Active

112849: May 9 18:00:48.833: BGP: 10.133.23.17 open active, delay 18155ms

Any help please...

[jrahm]

TCP is acting correctly, so it doesn't appear to be a connectivity issue. Is neighbor authentication configured on this peer? The neighbor is resetting the connection, it appears your router is sending (or not sending) something disagreeable to the neighbor's configuration.

[Ahmede]

No authrntication is configured.. Beside I did remove all the config other than the just neighbor statment..

[Harold Ritter]

Could you see if there any BGP specific message in the log. The session is being reset by the peer and I would like to see if a notification message has been received.

Thanks,

[Ahmede]

No thing in the log... And the other peer is getting the same message.. Reset by peer...

[Ahmede]

Here's debug IP bgp from the other peer

May 5 17:42:05: BGP: 10.133.23.18 went from Idle to Active

May 5 17:42:05: BGP: 10.133.23.18 open active, delay 25886ms

May 5 17:42:12: BGP: 10.133.23.18 went from Active to Idle

May 5 17:42:12: BGPNSF state: 10.133.23.18 went from nsf_not_active to nsf_not_active

May 5 17:42:12: BGP: 10.133.23.18 went from Idle to Active

May 5 17:42:12: BGP: 10.133.23.18 open active, delay 28304ms

May 5 17:42:21: BGP: Applying map to find origin for 10.133.255.12/32

May 5 17:42:31: BGP: 10.133.23.18 passive open

May 5 17:42:31: BGP: 10.133.23.18 went from Active to Idle

May 5 17:42:31: BGP: 10.133.23.18 went from Idle to Connect

May 5 17:42:32: BGP: 10.133.23.18 remote close, state CLOSED

May 5 17:42:32: BGP: 10.133.23.18 -reset the session

May 5 17:42:33: BGP: 10.133.23.18 went from Connect to Idle

May 5 17:42:33: BGP: 10.133.23.18 closing

May 5 17:42:33: BGPNSF state: 10.133.23.18 went from nsf_not_active to nsf_not_active

May 5 17:42:53: BGP: 10.133.23.18 went from Idle to Active

May 5 17:42:53: BGP: 10.133.23.18 open active, delay 16496ms

May 5 17:43:10: BGP: 10.133.23.18 open active, local address 10.133.23.17

May 5 17:43:10: BGP: 10.133.23.18 went from Active to OpenSent

May 5 17:43:10: BGP: 10.133.23.18 sending OPEN, version 4, my as: 64513

May 5 17:43:10: BGP: 10.133.23.18 send message type 1, length (incl. header) 45

May 5 17:43:10: BGP: 10.133.23.18 remote close, state CLOSED

May 5 17:43:10: BGP: 10.133.23.18 -reset the session

May 5 17:43:11: BGP: 10.133.23.18 went from OpenSent to Idle

May 5 17:43:11: BGP: 10.133.23.18 closing

May 5 17:43:11: BGPNSF state: 10.133.23.18 went from nsf_not_active to nsf_not_active

[Harold Ritter]

Could you provide us with the configuration from both sides.

Thanks,

[Ahmede]

We cleared all the extra config.. What we have now is that

router bgp 64513

network 0.0.0.0

neighbor 10.133.23.18 remote-as 65513

The other peer

router bgp 65513

network 172.16.0.0 mask 255.255.0.0

neighbor 10.133.23.17 remote-as 64513

[Harold Ritter]

Nothing fancy in this configuration ;o) Can you do a "sh ip bgp nei 10.133.23.18" and "sh ip bgp nei 10.133.23.17" on the respective routers.

Thanks,

[Ahmede]

I have a very limited access to the peer router.. So here is sh ip bgp from my router..

XXXXXXXXXX#sh ip bgp nei 10.133.23.17

BGP neighbor is 10.133.23.17, remote AS 64513, external link

BGP version 4, remote router ID 0.0.0.0

BGP state = Active

Last read 00:00:18, hold time is 180, keepalive interval is 60 seconds

Message statistics:

InQ depth is 0

OutQ depth is 0

Sent Rcvd

Opens: 859 0

Notifications: 0 0

Updates: 0 0

Keepalives: 0 0

Route Refresh: 0 0

Total: 859 0

Default minimum time between advertisement runs is 30 seconds

For address family: IPv4 Unicast

BGP table version 1547, neighbor version 0

Index 1, Offset 0, Mask 0x2

Incoming update prefix filter list is test

Outgoing update prefix filter list is test

Sent Rcvd

Prefix activity: ---- ----

Prefixes Current: 0 0

Prefixes Total: 0 0

Implicit Withdraw: 0 0

Explicit Withdraw: 0 0

Used as bestpath: n/a 0

Used as multipath: n/a 0

Outbound Inbound

Local Policy Denied Prefixes: -------- -------

Total: 0 0

Number of NLRIs in the update sent: max 0, min 0

Connections established 0; dropped 0

Last reset never

External BGP neighbor may be up to 255 hops away.

No active TCP connection

[Harold Ritter]

What IOS versions are you running on either side? Can you run "deb ip bgp 10.133.23.17" on your side.

Thanks,

[Ahmede]

I'm running 12.3.3a and he's running 12.3.1a..

the debug did not return any data... And the same at his end as well.. FOr some reason he's not receiving any BGP updates from my end and I'm not receiving any BGP updates from his end.. However the TCP session seems to be fine....

[Harold Ritter]

From the info you provided, the TCP session is not up. You can quickly verify that with "sh ip bgp summary" and "sh tcp brief".

I'm kind of surprised that the debug command didn't return any info. How did you run the debug via telnet. If so, did you enter the "term mon" command? After entering the "deb ip bgp nei 10.133.23.17", could you do a "clear ip bgp 10.133.23.17" just to be sure that we will get something out of the debug command.

Thanks,

[Ahmede]

This command does not work "deb ip bgp nei 10.133.23.17" so I used "deb ip bgp 10.133.23.17 updates".. And yes I turned on term mon and still sees no thing...

[Harold Ritter]

"deb ip bgp 10.133.23.17 updates" won't help in this case. Try "deb ip bgp".

Thanks,