BGP peering doesn't come up even when configured with same password

[ghermocilla]

Hi,

I'm getting this message.

%TCP-6-BADAUTH: Invalid MD5 digest

even i I configured the same password for both routers.

I'm using Cisco IOS XE Software, Version 03.14.01.S for ASR1001 router.

Both routers are connected to same switch and on the same vlan.

Thanks in advanced.

[Peter Paluch]

Hello,

First, make sure that these two routers are able to establish a BGP peering when you remove the password setting from both routers.

If this works, try reapplying the password configuration but make absolutely sure that you do not enter a whitespace after the last character of the password, e.g.:

neighbor 1.2.3.4 password somepassword<space><Enter>

Correctly, the password should be configured as

neighbor 1.2.3.4 password somepassword<Enter>

These are difficult to diagnose as the whitespaces do not show up in the configuration.

Best regards,
Peter

[ghermocilla]

Hi Peter,

Yes, BGP is established when there is no password setting.

I noticed something, so when I removed the password the BGP then established then I put the password and still ok.

but when I try to bounced the connection I still get bad authentication issues.

take note that password are properly inputted.

so I'm guessing that there's a bug or something for this command.

thanks.

[Vinit Jain]

Can you set a lower TCP mss negotiation value (global configuration not the one on the interface). Also, check the BGP mss negotiation and TCP mss negotiation value.

show ip bgp nei <nei-ip>

show tcp brief <<< get the tcb value for the BGP neighbor TCP session

show tcp tcb <tcb_value>

I recall working on a defect, where similar issue was noticed. Could you please share what is teh software version you are using - show version | in image

Hope this helps.

Regards

Vinit

[ghermocilla]

Hi Vinit,

I've checked the mss config and its 1460 and i think its juts fine.

As for the image we use this,

asr1001-universalk9.03.14.01.S.155-1.S1-std.bin

Do you know any bugs or issues regarding this?

Because I'm wondering why its not working when you set a password.

[Vinit Jain]

Are you running the same version / device at both ends. Can u share the software version of the peering router.

[ghermocilla]

Yes, we're running the same version on both routers.

I've captured the output of sh ip bgp neighbors

* I omitted some details for security purposes

  BGP version 4,
  BGP state = Established, up for 3d17h
  Last read 00:00:02, last write 00:00:09, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable (disabled)
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
    Enhanced Refresh Capability: advertised and received
    Multisession Capability:
    Stateful switchover support enabled: NO for session 1
  Message statistics:
    InQ depth is 0
    OutQ depth is 0

                         Sent       Rcvd
    Opens:                  1          1
    Notifications:          0          0
    Updates:           375523     564479
    Keepalives:             2          2
    Route Refresh:          0          0
    Total:             375529     564494
  Do log neighbor state changes (via global configuration)
  Default minimum time between advertisement runs is 0 seconds

 For address family: IPv4 Unicast

  BGP table version 25955661, neighbor version 25955661/0
  Output queue size : 0
  Index 6, Advertise bit 1
  6 update-group member
  Inbound soft reconfiguration allowed
  NEXT_HOP is always this router for eBGP paths
  Slow-peer detection is disabled
  Slow-peer split-update-group dynamic is disabled
                                 Sent       Rcvd
  Prefix activity:               ----       ----
    Prefixes Current:          434394     507149 (Consumes 60858240 bytes)
    Prefixes Total:           1248586    1543384
    Implicit Withdraw:         507902     749041
    Explicit Withdraw:         306290     287194
    Used as bestpath:             n/a     160161
    Used as multipath:            n/a          0

                                   Outbound    Inbound
  Local Policy Denied Prefixes:    --------    -------
    Bestpath from this peer:         613375        n/a
    Total:                           613375          0
  Number of NLRIs in the update sent: max 1041, min 0
  Last detected as dynamic slow peer: never
  Dynamic slow peer recovered: never
  Refresh Epoch: 1
  Last Sent Refresh Start-of-rib: never
  Last Sent Refresh End-of-rib: never
  Last Received Refresh Start-of-rib: never
  Last Received Refresh End-of-rib: never
                                       Sent       Rcvd
        Refresh activity:              ----       ----
          Refresh Start-of-RIB          0          0
          Refresh End-of-RIB            0          0

  Address tracking is enabled,
  Connections established 3; dropped 2
  Last reset 3d17h, due to Active open failed
  Interface associated: (none) (peering address in same link)
  Transport(tcp) path-mtu-discovery is enabled
  Graceful-Restart is disabled
  SSO is disabled
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Connection is ECN Disabled, Mininum incoming TTL 0, Outgoing TTL 255
Connection tableid (VRF): 0
Maximum output segment queue size: 50

Enqueued packets for retransmit: 0, input: 0  mis-ordered: 0 (0 bytes)

Event Timers (current time is 0x153C2BC60):
Timer          Starts    Wakeups            Next
Retrans         74797          2             0x0
TimeWait            0          0             0x0
AckHold        194963     118073             0x0
SendWnd             0          0             0x0
KeepAlive           0          0             0x0
GiveUp              0          0             0x0
PmtuAger       320799     320798     0x153C2BF42
DeadWait            0          0             0x0
Linger              0          0             0x0
ProcessQ            0          0             0x0

iss:   63326131  snduna:   93540711  sndnxt:   93540711
irs: 2593169965  rcvnxt: 2638484545

sndwnd:  15984  scale:      0  maxrcvwnd:  16384
rcvwnd:  15411  scale:      0  delrcvwnd:    973

SRTT: 1000 ms, RTTO: 1003 ms, RTV: 3 ms, KRTT: 0 ms
minRTT: 0 ms, maxRTT: 1000 ms, ACK hold: 200 ms
uptime: 322507452 ms, Sent idletime: 2538 ms, Receive idletime: 2738 ms
Status Flags: active open
Option Flags: nagle, path mtu capable
IP Precedence value : 6

Datagrams (max data segment is 1460 bytes):
Rcvd: 274171 (out of order: 0), with data: 206449, total data bytes: 45314579
Sent: 239044 (retransmit: 2, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 81571, total data bytes: 30214579

 Packets received in fast path: 0, fast processed: 0, slow path: 0
 fast lock acquisition failures: 0, slow path: 0
TCP Semaphore      0x7F7D195E0480  FREE