Ruijie Community

Title: Troubleshooting BGP flapping [Print this page]
Author: Crystal    Time: 2018-4-9 10:17
Title: Troubleshooting BGP flapping
BGP route flapping occurs, routes areconstantly added and deleted, LSAs are constantly refreshed, and the CPU usageis high.
Note: BGP route flapping is classified intoflapping of routes originated by a local device and flapping of routesadvertised by a neighbor. If BGP route flapping suppression is enabled, theroute flapping advertisement from an EBGP neighbor will be suppressed and theroute will not be sent to the routing table.

Author: admin    Time: 2018-4-9 19:03
Possible Causes
Flapping of a route originated by a localdevice is often caused by flapping of a local IGP route or directly-connectedroute. You can locate the fault by referring to the related manual; otherwise,the fault may be a software fault.
Causes for flapping of routes advertised bya neighbor are complex. Routes advertised by a neighbor can be learned by theBGP route table only after the routes are processed locally; therefore, thefault may be caused by flapping of local IGP routes, flapping of neighborroutes, or software faults.
Troubleshooting ProcedureStep1: Check whether the number of packets advertised by aneighbor is abnormal.
Run the show ip bgp summary command for multiple times to check whether thenumber of packets advertised by the neighbor increases normally.
                              
The default BGP keepalive timeout durationis 60 seconds, that is, a packet is normally received every second. If theincrease speed of packets received by the neighbor obviously exceeds thisfrequency, it indicates that flapping of routes advertised by the neighboroccurs.
You can also run the show ip bgp neighbor command to display the detailed packetstatistics about the neighbor as follows:
If the received UPDATE packets continuallyincrease, it indicates that the neighbor device constantly advertises routeupdates, which causes local route flapping.
Step2: Check whether flapping occurs in local routecalculation.
If it is confirmed that the route flappingis not caused by neighbor advertisement in the previous step, it indicates thatflapping occurs in local route calculation.
Run the show ip bgp A.B.C.D command to check the BGP flapping route. Runthe show command for multiple timesto check the status change before and after the flapping occurs. There are twosituations:  
1)    Thenext hop of the BGP route constantly switches between the valid and invalidstates, which is often caused by flapping on the next hop route (IGP route).
You can run the show ip route A.B.C.D command to display the status of the IGProute corresponding to the next hop of the BGP route. Run the show command for multiple times tocheck whether flapping occurs.
2)    TheBGP route has multiple next hops, and the best route switches between themultiple next hops.
a)    Thisfault may also be caused by the valid status change of the next hop of the BGProute. You can run the show ip routeA.B.C.D command to check the IGP route corresponding to the next hop forverification.
b)    The BGProute is constantly updating, which affects the original calculation result.
Compare multiple output results of the show ip bgp A.B.C.D command to checkwhether the route changes. If the route changes, check whether the neighbordevice advertises route updates. If the route change is not caused by routeupdates advertised by the neighbor device, there are two possible causes:  
1)    Thelocal device is configured with route redistribution. Redistributed routes areconstantly added and deleted. You can enable debug ip bgp nsm for verification.
2)    Thereare software bugs, which causes that BGP constantly modifies route attributeswhen scanning routing tables. In this case, you need to run the show ip bgp A.B.C.D command to displaythe attributes that are constantly changed. Contact related support personnel.
Step3: Check whether the route flapping is caused byneighbor advertisement.
If the route flapping is caused by neighboradvertisement, you need to locate the fault on the neighbor device and checkwhether the neighbor device constantly advertises route update. There are alsotwo situations:  
1)    Theneighbor device receives route updates from higher-layer devices. You need tolocate the fault upward layer by layer.
2)   Thelocal route calculation of the neighbor device changes. You need to locate thefault by repeating step 2.
Step4:Fault Information Collection
Collect log information (pay attention tothe time switch and the time accuracy) for fault analysis.
[Device debugging information, configuration,hardware and software versions, device logs and operation logs]
Collecting basic information
show version
show version slots
show run
show log
show ip interface brief
show interface status
show interface counter sum   
show interface counter  rate
show interfaces counters errors
show interfaces counters
show arp counter
show arp
show arp detail
show mac-address-table
show mac-address-table counter
show ip route
show ip route count
show memory
dir
show vlan
show cpu
show cpu-protect mb
show cpu-protect
show cpu-protect slot X (For S76, S86 and S12000 switches, CPP statisticsmust to be collected for twice for each line card.)
show spanning-tree
show spanning-tree summary
Collecting BGP information
show ip bgp neighbor A.B.C.D
show bgp ipv4 unicast neighbor
show bgp ipv6 unicast neighbor
show bgp vpnv4 unicast all neighbor
show ip bgp summary
show ip/ipv6 route
show bgp ipv4 unicast A.B.C.D
show bgp ipv6 unicast X:X::X::X/XX
show bgp vpnv4 unicast all A.B.C.D





Welcome to Ruijie Community (https://community.ruijienetworks.com/) Powered by Discuz! X3.2