BGP neighborship flapping

[raut.pawan]

Hi ,

We have issue BGP neighborship With Service provider flapping 2-3 times in day.

We have two BGP VPN VRF family configured and on same WAN ckt. BGP neighbor in one VRF family is stable more than 6 months but BGP neighbor in another VRF family is flapping 2-3 times in day. Can any one tell me the caused?

Router logs as below

003953: Aug  1 05:48:42.580 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003954: Aug  1 05:48:42.580 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003955: Aug  1 05:48:42.592 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003956: Aug  1 05:49:23.756 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
003957: Aug  1 05:50:09.621 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003958: Aug  1 05:50:09.621 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003959: Aug  1 05:50:09.625 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003960: Aug  1 05:50:16.741 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
003961: Aug  1 05:51:26.509 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003962: Aug  1 05:51:26.509 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003963: Aug  1 05:51:26.517 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003964: Aug  1 05:51:38.370 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
003965: Aug  1 05:52:35.118 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003966: Aug  1 05:52:35.118 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003967: Aug  1 05:52:35.126 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003968: Aug  1 05:52:44.942 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
003969: Aug  1 05:54:29.892 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003970: Aug  1 05:54:29.892 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003971: Aug  1 05:54:29.904 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003972: Aug  1 05:54:48.716 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
003973: Aug  1 05:56:17.413 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003974: Aug  1 05:56:17.413 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003975: Aug  1 05:56:17.421 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003976: Aug  1 05:56:51.709 UTC: %BGP-3-NOTIFICATION: received from neighbor 10.5.5.1 active 2/8 (no supported AFI/SAFI) 3 bytes 000000
003977: Aug  1 05:56:51.709 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification received
003978: Aug  1 05:57:01.245 UTC: %BGP-3-NOTIFICATION: received from neighbor 10.5.5.1 active 2/8 (no supported AFI/SAFI) 3 bytes 000000
003979: Aug  1 05:57:01.245 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification received
003980: Aug  1 05:57:01.301 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
003981: Aug  1 05:58:15.262 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003982: Aug  1 05:58:15.262 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003983: Aug  1 05:58:15.270 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003984: Aug  1 05:59:11.547 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
003985: Aug  1 06:00:02.871 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Down BGP Notification sent
003986: Aug  1 06:00:02.871 UTC: %BGP-3-NOTIFICATION: sent to neighbor 10.5.5.1 4/0 (hold time expired) 0 bytes
003987: Aug  1 06:00:02.879 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 10.5.5.1 IPv4 Unicast vpn vrf office topology base removed from session  BGP Notification sent
003988: Aug  1 06:00:16.563 UTC: %BGP-5-ADJCHANGE: neighbor 10.5.5.1 vpn vrf office Up
 

[Peter Paluch]

Hi Raul,

I would suggest trying to discuss this issue with your WAN service provider. He may provide some debugging information visible at his router which you do not see.

There is also the question of whether both VRFs, even though provided over a single WAN circuit, are terminated at the same PE - because, at least in theory, they do not need to. It could be possible that both VRFs are terminated at different PEs and one of them is perhaps overloaded, or the amount of traffic flowing through the respective VRF is somehow impacting the ability of your router and the PE router to communicate without packet losses. I assume that the 10.5.5.1 is the directly connected IP address of the neighbor (i.e. not a remote IP address, nor a loopback) and that there is no way this IP address could be routed through some other route, possibly getting blackholed.

Can you actually post the configuration of your BGP process and the interface or subinterface in the VRF that exhibits the flapping? Also, what kind of WAN circuit technology are you using?

Best regards,
Peter