I think you are correct. It looks a bug or something! Thank you for your time testing the scenario and pointing out the same issue in learning network. ... View more

@paul driver wrote: Hello @Amjad Abdullah wrote: @paul driver wrote:     So to summarize any route in bgp showing x.x.x.x (inaccessible) means that bgp of that rtr doesn't have a valid path to the advertised nexthop of the prefix its has received   Thanks Paul. You are absolutely correct. But my issue is with the router "witherspoon" itself. nex-hop-self should (or, is supposed to) fix the issue for other routers in AS2. But rtr witherspoon should have a valid route to network 11.11.11.11 in its bgp table simply because it has a static route for that one. Correct me if I am wrong? And yes, I meant 11.11.11.11 in my previous post, not 22.22.22.22. Thanks for pointing that. Yes Witherspoon itself should have a valid bgp route to 11.11.11.11 via its next hop 1.1.1.1 providing you do have a valid path to 1.1.1.1 be it by a static or dynamic entry’s  Thank you Paul. Yes, 1.1.1.1 is accessible (I have static route configured). So, I wonder why it says "inaccessible" in 'show ip bgp'? I can ping 1.1.1.1! it also says "no best path' which makes me confused? Is there anything that prevents BGP table from accepting static routes? I think the BGP updates work as expected, first rtr tells the other rtr (in a different AS) about the network 11.11.11.0, the router that receives the update add it to the BGP table but not to the  routing tabling claiming that the route to 1.1.1.1 is inaccessible (although it is accessible in terms of reachability). I added a static route in witherspoon toward 11.11.11.11, but it still says "inaccessible" after clearing the bgp process :) ... View more

Has anyone had any 'possible' solution for this issue??!  ... View more

You had an empty post my friend. If you wanted to say something and it was erased by mistake, please write it again. ... View more

Can anybody reproduce the issue?! I think it is interesting! I hope it is not buggy issue so we don't waste our investigations! BTW, I am using c3640-jk9s-mz.124-16 IOS image. ... View more

@paul driver wrote:     So to summarize any route in bgp showing x.x.x.x (inaccessible) means that bgp of that rtr doesn't have a valid path to the advertised nexthop of the prefix its has received   Thanks Paul. You are absolutely correct. But my issue is with the router "witherspoon" itself. nex-hop-self should (or, is supposed to) fix the issue for other routers in AS2. But rtr witherspoon should have a valid route to network 11.11.11.11 in its bgp table simply because it has a static route for that one. Correct me if I am wrong? And yes, I meant 11.11.11.11 in my previous post, not 22.22.22.22. Thanks for pointing that. ... View more

Here is the config of the two routers and some other output commands that you may find useful.     hostname Bullock ! interface Loopback0 ip address 1.1.1.1 255.255.255.0 ! interface Loopback1 ip address 11.11.11.11 255.255.255.0 ! interface FastEthernet0/0 description toward Witherspoon ip address 192.168.12.1 255.255.255.0 duplex auto speed auto ! router bgp 1 no synchronization bgp log-neighbor-changes network 11.11.11.0 mask 255.255.255.0 neighbor 2.2.2.2 remote-as 2 neighbor 2.2.2.2 ttl-security hops 2 no auto-summary ! no ip http server no ip http secure-server ip route 2.2.2.0 255.255.255.0 FastEthernet0/0 hostname Witherspoon ! interface Loopback0 ip address 2.2.2.2 255.255.255.0 ! interface FastEthernet0/0 description Toward Bullock ip address 192.168.12.2 255.255.255.0 duplex auto speed auto ! interface FastEthernet1/0 ip address 192.168.24.2 255.255.255.0 duplex auto speed auto ! interface FastEthernet2/0 ip address 192.168.23.2 255.255.255.0 duplex auto speed auto ! router ospf 1 log-adjacency-changes passive-interface FastEthernet0/0 network 0.0.0.0 255.255.255.255 area 0 ! router bgp 2 no synchronization bgp log-neighbor-changes neighbor 1.1.1.1 remote-as 1 neighbor 1.1.1.1 ttl-security hops 2 neighbor 1.1.1.1 update-source Loopback0 neighbor 3.3.3.3 remote-as 2 neighbor 3.3.3.3 update-source Loopback0 neighbor 4.4.4.4 remote-as 2 neighbor 4.4.4.4 update-source Loopback0 neighbor 5.5.5.5 remote-as 2 neighbor 5.5.5.5 update-source Loopback0 no auto-summary ! no ip http server no ip http secure-server ip route 1.1.1.0 255.255.255.0 FastEthernet0/0 Witherspoon#sh ip bgp summary BGP router identifier 2.2.2.2, local AS number 2 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 1.1.1.1 4 1 10 9 3 0 0 00:05:52 1 3.3.3.3 4 2 11 11 3 0 0 00:07:25 0 4.4.4.4 4 2 46 48 3 0 0 00:42:14 0 5.5.5.5 4 2 46 48 3 0 0 00:42:04 0 Witherspoon# Witherspoon#sh ip bgp 11.11.11.11 BGP routing table entry for 11.11.11.0/24, version 0 Paths: (1 available, no best path) Not advertised to any peer 1 1.1.1.1 (inaccessible) from 1.1.1.1 (11.11.11.11) Origin IGP, metric 0, localpref 100, valid, external Witherspoon# Witherspoon#show ip route C 192.168.12.0/24 is directly connected, FastEthernet0/0 1.0.0.0/24 is subnetted, 1 subnets S 1.1.1.0 is directly connected, FastEthernet0/0 2.0.0.0/24 is subnetted, 1 subnets C 2.2.2.0 is directly connected, Loopback0 3.0.0.0/32 is subnetted, 1 subnets O 3.3.3.3 [110/2] via 192.168.23.3, 00:12:17, FastEthernet2/0 O 192.168.45.0/24 [110/2] via 192.168.24.4, 00:12:17, FastEthernet1/0 4.0.0.0/32 is subnetted, 1 subnets O 4.4.4.4 [110/2] via 192.168.24.4, 00:12:18, FastEthernet1/0 C 192.168.24.0/24 is directly connected, FastEthernet1/0 5.0.0.0/32 is subnetted, 1 subnets O 5.5.5.5 [110/3] via 192.168.24.4, 00:12:18, FastEthernet1/0 [110/3] via 192.168.23.3, 00:12:18, FastEthernet2/0 O 192.168.56.0/24 [110/3] via 192.168.24.4, 00:12:20, FastEthernet1/0 [110/3] via 192.168.23.3, 00:12:20, FastEthernet2/0 C 192.168.23.0/24 is directly connected, FastEthernet2/0 O 192.168.35.0/24 [110/2] via 192.168.23.3, 00:12:20, FastEthernet2/0 Witherspoon#   ... View more

Thanks for your reply. I am using ssl-security (as a replacement of the multihop command) which will increase the TTL to 2. Shouldn't this do the trick of the multi-hop issue? or you are meaning something else? ... View more

Thanks. I will do in the first change. I don't unfortunately have the config handy right now. ... View more

Thanks Paul for your reply. I didn't probably get your point (forgive my ignorance). So, I'll re-describe the situation below and you reply me based on this description. OK?   The router in AS1 has a static route to the loopback0 interface of router Witherspoon in AS2. so it knows how to reach it. The router Witherspoon has a static route pointing to the loopback0 interface of router in AS1. So that should be OK (IMHO). Now, the router Witherspoon can see the update of network 22.22.22.22 (I can see it in "show ip bgp"). That means the update is find and it reaches the router Whitherspoon without any problem. My problem is that the router Witherspoon marks this route as inaccessible and doesn't put it in the routing table. What I don't understand is what does it exactly mean by "not accessible"? How can the router 1.1.1.1 inaccessible? I can ping it successfully from the router Witherspoon (from both physical and loopback as a source). What the word "inaccessible" here means then? Although it is proven to be reachable?   ... View more

Thank you my friend. I have ttl-security configured for two hops. I tried to increase it also to 3 hops but it didn't work either. ... View more

Hi Samrai, I didn't come across this specific scenario with Local mode APs. Most attacks won't take place until your WLANs are enabled (association flood for example). Are you concerned about a specific attack that you want the wIPS to detect while your WLANs are not broadcasting?   You may use the APs in monitor mode (which doesn't broadcast SSIDs) for wIPS if you are going to utilize the AP without WLANs. (You may need to check the licensing requirements for the same). HTH   Amjad ... View more