about once a day I see my bgp session flap with a 'cease' notification. My interface never goes down, just the bgp session over the interface. I've had the telco check and they say that the line is running clean. I don't see any errors on my interface.
Is there anything that I can have the folks on the far side router debug to figure out why their side is sending me the 'cease' code? Is there anything I can do to find out why I'm seeing the 'cease' code?
This is what I see on my side when the problem occurs:
Oct 26 21:17:06: %BGP-3-NOTIFICATION: received from neighbor 22.214.171.124 6/6 (cease) 0 bytes
Oct 26 21:17:06: %BGP-5-ADJCHANGE: neighbor 126.96.36.199 Down BGP protocol initialization
Oct 26 21:17:11: %BGP_SESSION-5-ADJCHANGE: neighbor 188.8.131.52 IPv4 Unicast topology base removed from session Peer closed the session
Oct 26 21:17:11: %BGP_SESSION-5-ADJCHANGE: neighbor 184.108.40.206 IPv4 Multicast topology base removed from session Capability changed
Oct 26 21:17:51: %BGP-5-ADJCHANGE: neighbor 220.127.116.11 Up
The first line means the far side router at 18.104.22.168 told my router 22.214.171.124 to shutdown my bgp session because of some 'other configuration change'. My physical interface is a ten gig link on a 7604. I'm running 12.2(33)SRD3 on a SUP720.
You log message already shows the code 6/6..meaning 6 is the cease notificayion and /6 indicate the subcode..please find
the list of reasons along with sub code
|1||Maximum Number of Prefixes Reached|
|6||Other Configuration Change|
|7||Connection Collision Resolution|
|8||Out of Resources|
In your case it is due to other config changes. Something config changes happen at far end
Hope this is useful
I see that the code is 'other configuration change'. What could this possibly be? I have asked the group who manages the far side router which is sending me the 'cease' notification to check their logs. They don't see any config changes being made at the time. Any more details about what can cause a cisco router to send this 'other configuration change' code? Is it always bgp configuration changes? Could it possibly be send because of configuration changes other than BGP?
it is always bgp changes and not global changes. Anyway if remote site is not managed by you it is very difficult to
know what happened at other end.
Moreover it is not always easy to know that remote guys saying true or not (as a last assumption). You can show them your log message
and say this is the only reason for flap,
From log shared by you we cannot dig more into this.
Hello, what does subcode 4 - Administrative Reset means? I have the following log:
Jun 7 15:35:46.543: %BGP-3-NOTIFICATION: sent to neighbor 172.31.254.1 6/4 (Administrative Reset) 0 bytes
It is originated if the neighbor has shutdown (administrative shutdown) the peering.