BGP problem

burleyman · ‎03-16-2009

On my router I am getting thew following notifications....

2821#*Mar 16 07:48:33.443 EDT: %BGP-3-NOTIFICATION: received from neighbor 166.53.126.165 2/8 (open: unknown subcode) 3 bytes 000101

2821#*Mar 16 07:49:06.211 EDT: %BGP-5-ADJCHANGE: neighbor 166.153.126.165 Up

*Mar 16 07:49:07.003 EDT: %BGP-3-NOTIFICATION: received from neighbor 166.53.126.165 3/1 (update malformed) 0 bytes

2821#*Mar 16 07:49:07.003 EDT: %BGP-5-ADJCHANGE: neighbor 166.53.126.165 Down BGP Notification received

2821#*Mar 16 07:49:41.027 EDT: %BGP-3-NOTIFICATION: received from neighbor 166.53.126.165 2/8 (open: unknown subcode) 3 bytes 000101

Here is my show ip bgp sum output..

2821#show ip bgp sum

BGP router identifier 10.254.11.225, local AS number 65021

BGP table version is 525, main routing table version 525

88 network entries using 11616 bytes of memory

88 path entries using 4576 bytes of memory

66/33 BGP path/bestpath attribute entries using 9768 bytes of memory

20 BGP AS-PATH entries using 480 bytes of memory

0 BGP route-map cache entries using 0 bytes of memory

0 BGP filter-list cache entries using 0 bytes of memory

Bitfield cache entries: current 2 (at peak 4) using 60 bytes of memory

BGP using 26500 total bytes of memory

BGP activity 210/122 prefixes, 332/244 paths, scan interval 60 secs

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

166.53.126.165 4 15270 9694 17370 0 0 0 00:12:53 Idle

168.36.144.245 4 65000 3836 3750 525 0 0 2d11h 84

and here is my config

interface Loopback0

description 2821 Loopback

ip address 10.254.11.225 255.255.255.255

!

interface GigabitEthernet0/0

ip address 10.11.1.225 255.255.255.0

duplex auto

speed auto

!

interface GigabitEthernet0/1

ip address 166.53.126.166 255.255.255.252

duplex auto

speed auto

!

interface Serial0/1/0

no ip address

encapsulation frame-relay IETF

service-module t1 timeslots 1

frame-relay lmi-type cisco

!

interface Serial0/1/0.100 point-to-point

bandwidth 64

ip address 168.36.144.246 255.255.255.252

snmp trap link-status

frame-relay interface-dlci 100 IETF

!

router bgp 65021

no synchronization

bgp log-neighbor-changes

network 10.11.1.0 mask 255.255.255.0

network 10.11.112.0 mask 255.255.255.0

network 10.11.212.0 mask 255.255.255.0

network 10.254.11.225 mask 255.255.255.255

neighbor 166.53.126.165 remote-as 15270

neighbor 166.53.126.165 description XXXX

neighbor 166.53.126.165 version 4

neighbor 166.53.126.165 soft-reconfiguration inbound

neighbor 166.53.126.165 route-map XXXX-WEIGHT in

neighbor 166.53.126.165 unsuppress-map ADV2XXXX

neighbor 168.36.144.245 remote-as 65000

neighbor 168.36.144.245 description YYYYY

neighbor 168.36.144.245 route-map YYYYY-WEIGHT in

maximum-paths 2

no auto-summary

Giuseppe Larosa · ‎03-16-2009

Hello Michael,

the BGP peer is trying to propose something different then expected

/8 (open: unknown subcode) 3 bytes

for example the other router could try to use multi protocol BGP to exchange information in multiple address families.

so the session is kept idle

and the first update is treated as malformed:

*Mar 16 07:49:07.003 EDT: %BGP-3-NOTIFICATION: received from neighbor 166.53.126.165 3/1 (update malformed) 0 bytes

Contact the other router administrator and check with them the configuration

Hope to help

Giuseppe

burleyman · ‎03-16-2009

Thanks I will do that. What should I bee looking for that maybe wrong.

Mike

Giuseppe Larosa · ‎03-16-2009

Hello Mike,

I don't think there is any error on your side check with them that their router is configured for simple BGP4

also known as

address-family ipv4 unicast

Hope to help

Giuseppe

eborcher · ‎03-16-2009

Hi,

We have seen this happen before when the number of routes advertised by your router is > ( greater> than the maximum-prefixes allowed on your peer ( 166.53.126.165 )

What version of IOS are you running ?

You could try to bring up the session by advertising 0 routes and see if it comes up then.

-Erich