BGP neighbor reset

770801tvdhaar · ‎09-13-2007

We connect to our ISP via BGP and get full routing from them. They scheduled a reboot of their neighbor one morning and when I got in I saw that all the neighbors went down the same time as the ISP that scheduled. We have 5 other ISP's connected and this didn't cause any issues as they were only down for 1 minute, but this is worrying that this can happen, here is a cut from my logs

Sep 13 05:25:56.769 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Down BGP Notification sent

Sep 13 05:25:56.769 cet: %BGP-3-NOTIFICATION: sent to neighbor xxx.xxx.xxx.xxx 4/0 (hold time expired) 0 bytes

Sep 13 05:26:11.837 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Down BGP Notification sent

Sep 13 05:26:11.837 cet: %BGP-3-NOTIFICATION: sent to neighbor xxx.xxx.xxx.xxx 4/0 (hold time expired) 0 bytes

Sep 13 05:26:11.837 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Down BGP Notification sent

Sep 13 05:26:11.837 cet: %BGP-3-NOTIFICATION: sent to neighbor xxx.xxx.xxx.xxx 4/0 (hold time expired) 0 bytes

Sep 13 05:26:11.837 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Down BGP Notification sent

Sep 13 05:26:11.837 cet: %BGP-3-NOTIFICATION: sent to neighbor xxx.xxx.xxx.xxx 4/0 (hold time expired) 0 bytes

Sep 13 05:26:47.481 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Up

Sep 13 05:27:06.093 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Up

Sep 13 05:27:18.357 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Up

Sep 13 05:28:06.077 cet: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Up

Has this happened to anyone or does someone know what's the root cause?

nambi_gct · ‎09-13-2007

Hi, From this message it seems your BGP neighbor is not sending keep alives peridically and that is the reason your router resets the BGP connection.

Is this happening continuously?or once in a while.If you see this message frequently you need to inform your ISP about this.It is an issue from your peer.

royalblues · ‎09-13-2007

What is the Media you use to connect to the ISP routers?

Narayan

770801tvdhaar · ‎09-13-2007

I'm using Singlemode fibre and there are no erros on the interface.

Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseLH

input flow-control is off, output flow-control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:00, output never, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 5306000 bits/sec, 7893 packets/sec

5 minute output rate 97000 bits/sec, 92 packets/sec

L3 in Switched: ucast: 9121899187 pkt, 668924558106 bytes - mcast: 0 pkt, 0 bytes

L3 out Switched: ucast: 292625164 pkt, 55614714007 bytes - mcast: 0 pkt, 0 bytes

9121899837 packets input, 859838684422 bytes, 0 no buffer

Received 1549 broadcasts (0 IP multicasts)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 input packets with dribble condition detected

294115942 packets output, 61660870578 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

VictorAKur · ‎09-13-2007

Did you have a look at the CPU load and memory at the time of the fall by any chance?

770801tvdhaar · ‎09-13-2007

No I didn't and this wouldn't even pop up on any monitoring because it was only for 1 minute.

Maybe if I setup traps.