General BGP issue and need a help with it

[blason]

Hi Team,

I need a help with BGP and my setup is as below. There is no cisco routers involved however I need a help on BGP issue. I have a router installed at my end and I have two ISPs terminated on those. I have then configured two IPsec tunnels with Azure and I am running BGP over IPsec. 

However I noticed here that 192.168.40.0/23 route is only advertised from 169.254.21.9 and if I check routes on 169.254.21.13 I am seeing 192.168.40.0/23 is learned from Azure. However the subnet belongs to me.

show ip bgp neighbors 169.254.21.1 received-routes
Default local pref 100, local AS 65506
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @nnn nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.0.0/16      169.254.21.1                           0 65515 i
***> 10.11.44.0/22    169.254.21.1                           0 65515 i**

While for other Peer

show ip bgp neighbors 169.254.22.1 received-routes
Default local pref 100, local AS 65506
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @nnn nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.0.0/16      169.254.22.1                           0 65515 i
*> 10.11.44.0/22    169.254.22.1                           0 65515 65515 65515 65515 i
*> 192.168.40.0/23  169.254.22.1             0             0 65515 65506 i

If notice here 192.168.40.0/23 which is my subnet getting advertised by Azure and is sending it to me. Even If I look at the path its been received via 65515 which is Azure and then mine. This is pretty surprising and Azure if receiving with igp.

Hence wanted to know even if I am advertising the routes in Global BGP; how can I ensure that routes are being advertised to both my neighbors?
And if not how would I advertise with specific neighbor like cisco?

Hence my issue is if 169.254.21.1 goes down my traffic stops completely and I suspect is; since 192.168.40.0/23 is being learned from azure; Azure it not sending the traffic back.

Can someone please help me on this issue?

TIA 

Blason R

[paul driver]

Hello
If you are summarizing into the azure peers its possible the origin of the that summary can be lost.
You should not be receiving through BGP a prefix you originally advertised as the protocol has built loop avoidance to negate such action with its as-path sequence which records what ASNs the prefix traverses as it passes through networks.

So unless you specially include the as-set to be retained when you summarize the as-path origin information is not recorded which could cause a loop.
post output  -

sh ip route 192.168.40.0/23

[Georg Pauwen]

Hello,

what are you getting from

AS 65506 (show ip bgp neighbors 169.254.22.13 received-routes) ?

And since you say you don't have Cisco equipment, what brand/type/model is the firewall ?

[blason]

Here is what it looks like

show ip bgp neighbors 169.254.22.1 received-routes

Default local pref 100, local AS 65506
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @nnn nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.0.0/16      169.254.22.1                           0 65515 i
*> 10.11.44.0/22    169.254.22.1                           0 65515 65515 65515 65515 i
*> 192.168.10.0/24  169.254.22.1                           0 65515 65505 i
*> 192.168.11.0/24  169.254.22.1                           0 65515 i
*> 192.168.40.0/23  169.254.22.1             0             0 65515 65506 i

Total number of prefixes 5 (4 filtered)

Again as I said I am receiving routes from 169.254.22.1 which is  advertised by me; which is 192.168.40.0/23

[blason]

This is vyatta fork - called vyos. All commands are similar however I need a help on BGP since I am not pro in BGP

[MHM Cisco World]

I dont full understand your issue since none of device is cisco 
but 
you broke loop prevent of BGP 

loop prevent in iBGP, the full mash and split horizon, this make iBGP advertise prefix it originate or receive from eBGP, iBGP peer never readvertise prefix recieve from iBGP

lopp prevent in eBGP, the AS-PATH must never contain AS of receiver, i.e. R1-R2, if R2 receive prefix with AS-PATH contain it AS then this prefix must drop. 

[blason]

OK - Thanks. How do I do it in my scenario then? Since I am receiving 192.168.40.0/23 again through other link or ebgp configured. Any specific hint; I can then convert then to my device's command.

[MHM Cisco World]

*> 192.168.40.0/23  169.254.22.1             0             0 65515 65506 i

You mention you receive same prefix but,

show ip bgp

dont show prefix with next-hop 0.0.0.0 (meaning this router originate this prefix)?
I think that there is delay in withdraw prefix 
your router withdraw prefix but the other Peer still have this prefix and advertise it to you and BLACKHOLE or LOOP is form.
solution is make other Peer only advertise the prefix it origiante not prefix learn from other peer. 
or do path filter for any prefix receive from Peer where any prefix with AS-PATH contain your AS will be drop. 
this way you can stop the LOOP. 

[blason]

Yes the peer router sends that prefix back to me. Since the Peers are Azure VNet not sure if they have this kind of settings available. Can I drop using

route-map

import? on my other interface? Please suggest

[MHM Cisco World]

route-map

import under VRF make the router drop all prefix, 
we need fine filter for prefix, only prefix that have my OWN AS in AS-PATH will drop.
for cisco 

Router1(config)#ip as-path access-list 25 permit _65506_

 then add this as-path filter to

route-map

IN from your Azure peer.

route-map

must be DENY 

[Harold Ritter]

Hi @MHM Cisco World ,

The output provided is for the

show ip bgp nei 169.254.22.1 received-routes

It doesn't mean that the VYOS router doesn't reject it. It only means that it is being received from the peer. We need to see what the

show ip bgp 192.168.40.0/23

tells us.

Regards,

[MHM Cisco World]

Yes I see, but still the path is select as best path.
so he still need AS-PATH filter 

[Harold Ritter]

Hi @blason ,

Can you please share the

show ip bgp 192.168.40.0/23

output with us?

Regards,

[blason]

Here is the output

show ip bgp 192.168.40.0/23
BGP routing table entry for 192.168.40.0/23
Paths: (1 available, best #1, table default)
  Advertised to non peer-group peers:
  169.254.21.1
  Local
    0.0.0.0 from 0.0.0.0 (111.125.226.237)
      Origin IGP, metric 0, weight 32768, valid, sourced, local, best (First path received)
      Last update: Mon Apr  4 09:23:46 2022

[Harold Ritter]

Thanks @blason ,

That show it is only being advertised to one peer. Would it be possible to share the vyos bgp configuration with us?

Regards,