Course contents

Module 6: Troubleshooting and PracticeLesson 6.1 (1 of 6 in this module)38 of 43 in the BGP course

Troubleshooting BGP

BGP faults come in two kinds: the session will not come up, or it is up and a route is missing. They have different causes and different commands. Decide which kind you have, then follow the order.

Advanced · 15 min read

You'll learn to read the BGP neighbour state to find why a session fails, and trace a missing route through advertise, receive, filter, select and install.

Two questions in order

First ask: is the session Established? If not, no route will move, so work on the session. If it is, ask: where does the route stop? The same order works on any BGP network.

Troubleshoot a missing route in five questions
Troubleshoot a missing route in five questionsFive questions in order: is the neighbour Established, is the prefix in the BGP table, is it the best path, is it in the routing table, does traffic follow it. Each no answer points to the next thing to check.1. Is the neighbour Established?show ip bgp summaryyesnoRead the state: Idle, Active, OpenSent.Check TCP 179, addresses, AS, password.2. Is the prefix in the BGP table?show ip bgp 203.0.113.0yesnoNot received or filtered. Check network,activate, and the in and out filters.3. Is the path marked best (>)?show ip bgp 203.0.113.0yesnoAnother path wins or the next hop is unusable.Compare attributes in the same output.4. Is it in the routing table?show ip route 203.0.113.0yesnoRIB failure: a better route wins.Use show ip bgp rib-failure.5. Does traffic follow it?ping and traceroute from the sourcenoCheck the return path, ACLs and thefar-end routes with traceroute.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Work from the session towards the forwarding table. Stop at the first no, fix it and ask the question again.

Read the neighbour state

BGP neighbour states and what a stuck state points to
BGP neighbour states and what a stuck state points toSix rows: Idle, Connect, Active, OpenSent, OpenConfirm and Established, each with its meaning and the usual cause when a session stays there.StateWhat it meansIf it stays hereIdleNo TCP connection yetNo route, shutdown, max-prefixConnectWaiting for the TCP handshakeHandshake not completingActiveTCP attempts keep being retriedWrong address, ACL, update-sourceOpenSentOPEN sent, waiting for the peer'sPeer closes: bad AS or router IDOpenConfirmOPEN accepted, waiting for KEEPALIVERare: check NOTIFICATIONs, timersEstablishedRoutes are exchangedOnly here are UPDATEs exchanged

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Active does not mean working. It means the router is still trying, and failing, to open the TCP connection.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp summary | begin Neighbor
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.0.2.1       4        64501       0       0        1    0    0 00:05:02 Active
10.255.0.2      4        64500      44      44        5    0    0 00:38:10        2
The iBGP neighbour is fine and has sent two prefixes. The ISP A neighbour shows Active with zero messages in either direction, so the TCP connection is not opening.

For a session that is Idle or Active, check in this order:

  1. Reachability. Can R1 ping the neighbour address, from the right source? For loopback sessions use ping 10.255.0.2 source Loopback0.
  2. The neighbour statement. Does the address match what the other side expects, and is the remote AS correct on both sides? A wrong AS gives a NOTIFICATION message and is visible in the log.
  3. update-source and ebgp-multihop. A loopback session needs update-source on both ends, and an eBGP loopback session needs multihop.
  4. TCP port 179. An ACL or firewall in the path may block it. A one-sided filter makes the session open from one direction only.
  5. Authentication and timers. A BADAUTH log message means a password mismatch.
show ip bgp neighbors 192.0.2.1 show logging | include BGP ping 192.0.2.1 source GigabitEthernet0/0

The three commands that solve most session faults.

The session is up and a route is missing

Follow the route through its life. At each point ask the router what it holds.

Follow the route hop by hop
Follow the route hop by hopAsk where the route stops.Advertised?sender sideReceived?show ip bgpAccepted?filtersBest?path selectionInstalled?RIB

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Advertised, received, accepted, best, installed. The first no is the fault.
  1. Is it advertised? On the sender: show ip bgp neighbors X advertised-routes.
  2. Is it received? On the receiver: show ip bgp neighbors X routes for accepted routes, and received-routes if soft-reconfiguration is on.
  3. Is it valid? In show ip bgp, a missing * means the next hop is unreachable.
  4. Did it win? A > marks the best path. If another path won, ask which step decided it.
  5. Was it installed? show ip bgp rib-failure lists best paths that did not enter the routing table.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp rib-failure
Network            Next Hop                      RIB-failure   RIB-NH Matches
203.0.113.0/24     192.0.2.1             Higher admin distance             n/a
BGP chose this path but the routing table keeps a route from another source with a lower administrative distance. eBGP is 20 and iBGP is 200, so an OSPF route at 110 beats an iBGP path.

Technical reference: Cisco, Troubleshooting BGP. Output above is illustrative.

Check your understanding

Predict · scenario 1

A neighbour shows Active with zero messages. What does that tell you?

Predict · scenario 2

show ip bgp has a route with * but no >. Which best explains it?

Predict · scenario 3

Which command shows BGP best paths that failed to install in the routing table?

FAQ

What does Active mean?
Active does not mean working. It means the router is actively trying to open a TCP connection to the neighbour and has not succeeded. Look for reachability, the neighbour address, ACLs or a missing remote configuration.
What does Idle mean?
The router is not trying. Common causes are an administratively shut neighbour, no route to the neighbour address, or waiting after a failure.
A route is in the BGP table but not in the routing table. Why?
Another source has a lower administrative distance, for example an IGP route, or the BGP next hop is unreachable. show ip bgp rib-failure lists such routes.