bgp drops

[andrew.webster]

hi,

  about once a day I see my bgp session flap with a 'cease' notification.  My interface never goes down, just the bgp session over the interface.  I've had the telco check and they say that the line is running clean.  I don't see any errors on my interface. 

  Is there anything that I can have the folks on the far side router debug to figure out why their side is sending me the 'cease' code?  Is there anything I can do to find out why I'm seeing the 'cease' code?

This is what I see on my side when the problem occurs:

Oct 26 21:17:06: %BGP-3-NOTIFICATION: received from neighbor 1.1.1.1 6/6 (cease) 0 bytes

Oct 26 21:17:06: %BGP-5-ADJCHANGE: neighbor 1.1.1.1 Down BGP protocol initialization

Oct 26 21:17:11: %BGP_SESSION-5-ADJCHANGE: neighbor 1.1.1.1 IPv4 Unicast topology base removed from session  Peer closed the session

Oct 26 21:17:11: %BGP_SESSION-5-ADJCHANGE: neighbor 1.1.1.1 IPv4 Multicast topology base removed from session  Capability changed

Oct 26 21:17:51: %BGP-5-ADJCHANGE: neighbor 1.1.1.1 Up

The first line means the far side router at 1.1.1.1 told my router 1.1.1.2 to shutdown my bgp session because of some 'other configuration change'.  My physical interface is a ten gig link on a 7604.  I'm running 12.2(33)SRD3 on a SUP720. 

thanks,

Andy

[Mahesh Gohil]

Hi andrew,

You log message already shows the code 6/6..meaning 6 is the cease notificayion and /6 indicate the subcode..please find

the list of reasons along with sub code

Subcode	Meaning
1	Maximum Number of Prefixes Reached
2	Administrative Shutdown
3	Peer De-configured
4	Administrative Reset
5	Connection Rejected
6	Other Configuration Change
7	Connection Collision Resolution
8	Out of Resources

In your case it is due to other config changes. Something config changes happen at far end

Hope this is useful

Regards

Mahesh

[andrew.webster]

I see that the code is 'other configuration change'.  What could this possibly be?  I have asked the group who manages the far side router which is sending me the 'cease' notification to check their logs.  They don't see any config changes being made at the time.  Any more details about what can cause a cisco router to send this 'other configuration change' code?  Is it always bgp configuration changes?  Could it possibly be send because of configuration changes other than BGP?

thanks,

Andy

[Mahesh Gohil]

Hi andrew,

it is always bgp changes and not global changes. Anyway if remote site is not managed by you it is very difficult to

know what happened at other end.

Moreover it is not always easy to know that remote guys saying true or not (as a last assumption). You can show them your log message

and say this is the only reason for flap,

From log shared by you we cannot dig more into this.

Regards

Mahesh

[Jose Anda]

Hello, what does subcode 4 - Administrative Reset means? I have the following log:

Jun  7 15:35:46.543: %BGP-3-NOTIFICATION: sent to neighbor 172.31.254.1 6/4 (Administrative Reset) 0 bytes 

[Julio E. Moisa]

Hi

It is originated if the neighbor has shutdown (administrative shutdown) the peering.

[deepasree]

What about the code 3