07-06-2020 08:45 AM
Hi, does anyone know of a mechanism that allows for the protection of the management plane on a C1900 router, I seem to have an issue where when a link it overly utilised BGP drops out.
site1#sh int gi0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is CN Gigabit Ethernet, address is 0027.e3f4.a300 (bia 0027.e3f4.a300)
Description: ** IP Connect EFM ETHA12970263 EFMC401093 ICUK516721 VPNN901058 **
Internet address is 10.12.1.94/30
MTU 1500 bytes, BW 2000 Kbit/sec, DLY 1000 usec,
reliability 255/255, txload 228/255, rxload 13/255 ------------------------------------------------------- High TC load
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
Keepalive set (10 sec)
Full Duplex, 10Mbps, media type is RJ45
output flow-control is unsupported, input flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters 00:19:19
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 9385 -------------------------------------- High output drops
Queueing strategy: Class-based queueing
Output queue: 10/1000/9367 (size/max total/drops)
30 second input rate 109000 bits/sec, 206 packets/sec ------------------------------------------------------------ 109 Kbps
30 second output rate 1795000 bits/sec, 161 packets/sec ---------------------------------------------------------- 1.7 Mbps
214743 packets input, 15108620 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
172380 packets output, 232920093 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
- Policy map on WAN interface:
site1#sh policy-map int gi0/0 out
GigabitEthernet0/0
Service-policy output: Parent-Shaper
Class-map: class-default (match-any)
198409 packets, 268938975 bytes
30 second offered rate 652000 bps, drop rate 28000 bps
Match: any
Queueing
queue limit 64 packets
(queue depth/total drops/no-buffer drops) 2/10115/0
(pkts output/bytes output) 188294/254970198
shape (average) cir 1799096, bc 25188, be 0
target shape rate 1799096
Service-policy : Outbound-to-MPLS
queue stats for all priority classes:
Queueing
queue limit 64 packets
(queue depth/total drops/no-buffer drops) 0/0/0
(pkts output/bytes output) 0/0
Class-map: ce_mgmt_bundled_output (match-any)
272 packets, 58951 bytes
30 second offered rate 1000 bps, drop rate 0000 bps
Match: access-group 199
272 packets, 58951 bytes
30 second rate 1000 bps
Queueing
queue limit 64 packets
(queue depth/total drops/no-buffer drops) 0/0/0
(pkts output/bytes output) 272/58951
police:
cir 8000 bps, bc 8000 bytes, be 16000 bytes
conformed 257 packets, 50225 bytes; actions:
set-dscp-transmit 63
exceeded 15 packets, 8726 bytes; actions:
set-dscp-transmit 63
violated 0 packets, 0 bytes; actions:
set-dscp-transmit 63
conformed 1000 bps, exceeded 0000 bps, violated 0000 bps
bandwidth 20 kbps
Exp-weight-constant: 3 (1/8)
Mean queue depth: 0 packets
dscp Transmitted Random drop Tail drop Minimum Maximum Mark
pkts/bytes pkts/bytes pkts/bytes thresh thresh prob
63 272/58951 0/0 0/0 20 32 1/10
Class-map: ce_ef_output (match-any)
0 packets, 0 bytes
30 second offered rate 0000 bps, drop rate 0000 bps
Match: dscp cs5 (40) ef (46)
0 packets, 0 bytes
30 second rate 0 bps
police:
cir 392000 bps, bc 2000 bytes, be 2000 bytes
conformed 0 packets, 0 bytes; actions:
set-dscp-transmit ef
exceeded 0 packets, 0 bytes; actions:
set-dscp-transmit ef
violated 0 packets, 0 bytes; actions:
drop
conformed 0000 bps, exceeded 0000 bps, violated 0000 bps
Priority: 392 kbps, burst bytes 9800, b/w exceed drops: 0
Class-map: class-default (match-any)
198137 packets, 268880024 bytes
30 second offered rate 652000 bps, drop rate 18000 bps
Match: any
Queueing
queue limit 64 packets
(queue depth/total drops/no-buffer drops) 1/10115/0 ---------------------------------------------------- 10115 drops
(pkts output/bytes output) 188022/254911247
bandwidth 1369 kbps
Exp-weight-constant: 6 (1/64)
Mean queue depth: 0 packets
class Transmitted Random drop Tail drop Minimum Maximum Mark
pkts/bytes pkts/bytes pkts/bytes thresh thresh prob
0 183723/254142045 9950/13745670 165/223107 22 59 1/5
1 0/0 0/0 0/0 22 59 1/5
2 0/0 0/0 0/0 22 59 1/5
3 0/0 0/0 0/0 22 59 1/5
4 0/0 0/0 0/0 22 59 1/5
5 0/0 0/0 0/0 22 59 1/5
6 4301/769529 0/0 0/0 74 118 1/10
7 0/0 0/0 0/0 22 59 1/5
07-06-2020 08:54 AM
Hello @paul-d ,
you can extend your ACL 199 to include BGP using
access-list 199 permit tcp any any eq bgp
access-list 199 permit tcp any eq bgp any
As you don't know which side will be using the well known TCP port 179.
However, to be effective this kind of change has to be performed on both sides of the link.
Hope to help
Giuseppe
07-06-2020 09:10 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide