PIX 525 BGP drop

[khaile]

The ACL hit count show nothing

access-list capture1 line 1 permit tcp host 172.68.101.1 eq bgp any (hitcnt=0)

access-list capture1 line 2 permit tcp any host 172.68.101.1 eq bgp (hitcnt=0)

were as the router shows me

Jan 16 07:40:25: %BGP-5-ADJCHANGE: neighbor 10.176.251.24 Down Peer closed the session

Jan 16 07:40:25: %BGP-5-ADJCHANGE: neighbor 172.68.150.23 Down Peer closed the session

Jan 16 07:41:04: %BGP-5-ADJCHANGE: neighbor 172.68.150.23 Up

Jan 16 07:41:11: %BGP-5-ADJCHANGE: neighbor 10.176.251.24 Up

at the mean time I see the following from the PIX log

2004-01-16 07:40:23 Local4.Info 172.68.101.254 Jan 16 2004 07:40:23: %PIX-6-106015: Deny TCP (no connection) from 172.68.150.23/179 to 172.68.101.1/11032 flags PSH ACK on interface outside

2004-01-16 07:40:23 Local4.Info 172.68.101.254 Jan 16 2004 07:40:23: %PIX-6-106015: Deny TCP (no connection) from 172.68.150.23/179 to 172.68.101.2/18097 flags PSH ACK on interface outside

2004-01-16 07:40:23 Local4.Info 172.68.101.254 Jan 16 2004 07:40:23: %PIX-6-106015: Deny TCP (no connection) from 172.68.150.23/179 to 172.68.101.1/11032 flags PSH ACK on interface outside

this happens once every 48 or so hours, any idea would be appriciated.

Note: the FW=172.68.101.254 internal router= 172.68.101.1 and external router= 172.68.150.23

[ramesh.krishnan]

try out giving the port number intead of "bgp"...FYI its tcp port 179.

ramesh

[shannong]

Is that a capture ACL? If so, to what interface did you apply it? The Pix only captures traffic on the input of an interface and not on the output.Is there any NAT involved for the BGP peer addresses? Have you changed the hello interval? How many hops away are the neighbors?

I notice the remote peers closed the session actively and at the same time. This means that they probably lost their keepalives to the interal router for some reason and sent a teardown message.

The best way to troubleshoot this is make sure all devices have synchronized time and catch all firewall logs along with debugging BGP on the router. This will tell us why it is tearing down? ie, timeouts, BGP software error followed with a reset, etc

[khaile]

Thank you very much guys for your help. I've found out late on Friday that the couse of this problem is clearing Xlate. Whenever, I clear xlate the BGP fells. During the weekend I leave the network to run without touching it and so far no BGP error. In addition, I check the logfile for port 179 and did not find any. However, I'm surprise that xlate causes such a problem, so in the near future or until I got resolution, I may not clear xlate anymore. Any help would be appriciated. thanks again