1. Home
  2. Cisco Systems
  3. New BGP setup

New BGP setup

I am trying to set up a new BGP config. Very basic. We will have two T-1's from two different ISPs. This is a 2811, version 12.3(11)T3. I just have the one peer set up for now. The other is due to be installed in the next 3 weeks.

These are the lines I added to my running config:

! router bgp mypublicASN no synchronization bgp log-neighbor-changes network x.x.x.0 mask 255.255.255.0 neighbor y.y.y.45 remote-as 3356 neighbor y.y.y.45 route-map localonly out no auto-summary ! ! ip as-path access-list 9 permit ^$ ! ! route-map localonly permit 10 match as-path 9 !

Now, I do have ACLs on both in and out on the interface facing my peer. So I dutifully added a permit to 179. I do see the hit count increase on the incoming ACL but not on the outgoing ACL. I have even tried taking both ACLs off. Still when I debug BGP I see that the peer times out and no connection is made. Can someone spot my obvious mistake? The ISP is double checking their router and config, but I thought I would ask here.

Thanks,

Gordon Montgomery Living Scriptures, Inc snipped-for-privacy@lsi.com (anti spam - replace lsi with livingscriptures) (801) 627-2000

Reply to
Gordon Montgomery
Loading thread data ...

Daft question, but can you ping the peer address? Is it directly connected or should you be using multihop? What state is your session in? IDLE, ACTIVE etc?

Chris.

Reply to
Chris

Well, like many times with large carriers, a couple of hours after they swore that everything on their end was correct but "they would look into it", it magically started working.

But to answer your questions, yes it was directly connected and I could ping the peer router. I believe the session state was ACTIVE. I notice now that it is working, when I do a sh ip bgp nei , it shows the peer id as a completely different ip address. Must be some sort of BGP forwarding I know nothing about.

Thanks for trying to help.

Gordon

Gordon Montgomery Living Scriptures, Inc snipped-for-privacy@lsi.com (anti spam - replace lsi with livingscriptures) (801) 627-2000

Reply to
Gordon Montgomery

make sure to have inbound prefix filter to block your assigned address block

should have MD5 password configured for all BGP sessions - nei password

make sure you disable CDP on interface facing ISP

Reply to
Merv

Thanks, I will look into those things.

Gordon

Gordon Montgomery Living Scriptures, Inc snipped-for-privacy@lsi.com (anti spam - replace lsi with livingscriptures) (801) 627-2000

Reply to
Gordon Montgomery

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.