Frequent BGP Peer flaps

sameer.mulgund · ‎07-21-2009

One of our customer is having BGP peering with service provider network. However customer is observing frequent BGP peer flaps on their router. At customer end media is terminated as ethernet and provider end also the same. Suppliers have confirmed no issues with media as BERT was clean. Provider has checked their end but are not finding any issues. As per provider they are receiving notification from customer for BGP. Customer end logs observed as below -

000721: Jul 7 08:12:41.676 BST: %BGP-5-ADJCHANGE: neighbour xx.xx.xx.xx Down BGP Notification sent

000722: Jul 7 08:12:41.676 BST: %BGP-3-NOTIFICATION: sent to neighbour xx.xx.xx.xx 4/0 (hold time expired) 0 bytes

000723: Jul 7 08:13:23.218 BST: %BGP-3-NOTIFICATION: sent to neighbour xx.xx.xx.xx 4/0 (hold time expired) 0 bytes

000724: Jul 7 08:13:54.648 BST: %BGP-5-ADJCHANGE: neighbour xx.xx.xx.xx up

000725: Jul 7 10:09:03.506 BST: %BGP-3-NOTIFICATION: received from neighbour xx.xx.xx.xx 4/0 (hold time expired) 0 bytes

000726: Jul 7 10:09:03.506 BST: %BGP-5-ADJCHANGE: neighbour xx.xx.xx.xx Down BGP Notification received

000727: Jul 7 10:09:48.637 BST: %BGP-3-NOTIFICATION: sent to neighbour xx.xx.xx.xx 4/0 (hold time expired) 0 bytes

000728: Jul 7 10:10:35.640 BST: %BGP-3-NOTIFICATION: sent to neighbour xx.xx.xx.xx 4/0 (hold time expired) 0 bytes

000729: Jul 7 10:11:22.543 BST: %BGP-3-NOTIFICATION: sent to neighbour xx.xx.xx.xx 4/0 (hold time expired) 0 bytes

000730: Jul 7 10:11:57.645 BST: %BGP-5-ADJCHANGE: neighbour xx.xx.xx.xx up

Provider has disabled QoS policy from their ethernet interface.Also, they are able to ping the peer during the flap also.

Kindly suggest what could be the problem here.

Giuseppe Larosa · ‎07-21-2009

Hello Sameer,

have the provider configure a QoS template that provides a traffic class for BGP traffic.

Depending on platforms there is an hidden system queue for routing traffic, but some high end devices miss it and require an explicit configuration to protect messages

Hope to help

Giuseppe

sameer.mulgund · ‎07-21-2009

Thanks for the response.

Customer has not put any traffic on this link/circuit i.e. there is no load on the link. It's 45Mbps circuit.

Earlier PE interface showed some input drops and Flushes but after removing the service policy there are no further drops or flushes. Provider has increased the hold Q to 4096 but still flaps are seen.

Danilo Dy · ‎07-21-2009

Did you try ping with high datagram size like 1500?

45Mbps an ATM circuit? It could be an MTU or L2 issue, check them.

sameer.mulgund · ‎07-21-2009

Hi Medan

It's DS3 circuit but handed over as ethernet at PE and CE. MTU at both ends is 1500. Provider did a extended ping with 1500 datagram size and all went clean. No drops observed.

PE#ping vrf xxxxxxxxxx

Protocol [ip]:

Target IP address: xx.xx.xx.xx

Repeat count [5]: 1000

Datagram size [100]: 1500

Timeout in seconds [2]:

Extended commands [n]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 1000, 1500-byte ICMP Echos to xx.xx.xx.xx, timeout is 2 seconds:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!

Success rate is 100 percent (1000/1000), round-trip min/avg/max = 1/2/12 ms