Issue with BGP TTL Security Check

From: Toh Soon, Lim (tohsoon28@gmail.com)
Date: Sun Nov 04 2007 - 15:02:50 ART


Hi Group,

Need help on this scenario.

R9 is connected to R6 via a multilink. R9 has an eBGP peering with R6, both
using their loopback addresses which are advertised in OSPF. R9 learns a BGP
route from R6 but is not selecting it as best path, as follows:

R9#sh ip bgp 200.0.0.7/32
BGP routing table entry for 200.0.0.7/32, version 0
Paths: (1 available, no best path)
  Not advertised to any peer
  6 7
    200.0.0.6 (inaccessible) from 200.0.0.6 (200.0.0.6)
      Origin IGP, localpref 100, valid, external

R9#sh ip ro os
     200.0.0.0/32 is subnetted, 2 subnets
O 200.0.0.6 [110/2] via 150.50.6.6, 00:12:05, Multilink1

R9#p 200.0.0.6

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.0.0.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

R9#sh run | s bgp
router bgp 9
 no synchronization
 bgp router-id 200.0.0.9
 bgp log-neighbor-changes
 neighbor 200.0.0.6 remote-as 6
 neighbor 200.0.0.6 ttl-security hops 2 <-- R6 has the command "neighbor
200.0.0.9 ttl-security hops 2"
 neighbor 200.0.0.6 update-source Loopback0
 no auto-summary

R9#sh ip b s
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down
State/PfxRcd
200.0.0.6 4 6 18 17 1 0 0 00:13:33 1

Why is R9 complaining the next-hop 200.0.0.6 is inaccessible whereas in fact
it is accessible? I suspect it has something to do with the command
"neighbor 200.0.0.6 ebgp-multihop 2". Issue is resolved after I replaced
this command with "neighbor 200.0.0.6 ebgp-multihop 255".

Can't figure out why. Can anyone help?

Thank you.

B.Rgds,
Lim TS



This archive was generated by hypermail 2.1.4 : Sat Dec 01 2007 - 06:37:28 ART