default route 0.0.0.0/1 and 0.0.0.0/15 in our EIGRP Routing Domain

[eric.guo]

Hi All,

We observed below  default route entries in our Routing table after  our one major link was  down and multiplex EIGRP neighbour ship were reset on many routers, the routing entries were propagated between whole EIGRP domain, including redistribution happened different EIGRP AS. It could be temporary stage? As these entries are disappeared finally. 

D     0.0.0.0/1 [90/35840] via 10.x.x.x, 00:03:33, Vlan780

D     0.0.0.0/7 .....
D     0.0.0.0/15 [90/57088] via 10.y.y.y.y, 00:04:02, Vlan775

Could someone see these symptom before ? and able to explain it ?

thanks,

Eric

[Peter Paluch]

Eric,

Most certainly, those "partial" default routes are not expected, and they should not be a result of any temporary or transient EIGRP convergence.

If these routes are gone by now, however, it might be very difficult to find out where they came from, as we cannot trace them back to their origin.

However, if we exclude the possibility of a software defect, the only explanation is that these routes must have been either redistributed into EIGRP, or created as a result of some atypical summarization. Summarization appears to be more likely as the routes have been EIGRP internal. Still, it does not entirely explain why the routes have eventually disappeared.

By any chance, based on your historical records of how the routing tables looked like, have you been able to trace at least one of these bogus partial default routes to the router that appeared to originate them? If so, would it be possible to post its complete sanitized configuration here, along with "show version" output?

Best regards,
Peter

[eric.guo]

Hi Peter,

thank you for helping me deep into this case now.

As these routes were showing up on multiplex routers, it is difficult to copy these configuration to you.

I copid some router version for your reference.

=========================

DC-VSS#sh version
Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9-M), Version 15.1(2)SY4a, RELEASE SOFTWARE (fc1)

=======================

#sh version
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(2)SY5, RELEASE SOFTWARE (fc7)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.

==========================

Access1>sh version
Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Thu 21-Jul-11 01:44 by prod_rel_team

thanks,

Eric 

[Peter Paluch]

Hi Eric,

As these routes were showing up on multiplex routers, it is difficult to copy these configuration to you.

Of course - I did not ask for the configurations of all routers; I was interested whether you have been able to identify the particular router that first injected these partial default routes into EIGRP, and I was hoping I can see the configuration of that router.

As your routers are IOS-based, I am afraid we are out of luck. These routers maintain very little history records to understand where the offending routes came from. Our only chance at this point is to check the show ip eigrp events on your routers to see if there is any wisdom recorded there we could use, but frankly, I am not overly optimistic about this.

Best regards,
Peter