BGP not adding to route table , pfSense -> Cisco , restarts every 15 minutes
-
not sure where to post this, I am having a couple issues with OpenBGPD.
I am connecting to Verizons network(cisco) to put my verizon tablets behind our firewall. And I am down to the last step, BGP . It connects, but the route never gets added.
also, this is being done via GRE and IPsec transport. I can ping both sides of the GRE connection for both internal IPs x.x.x.x and y.y.y.y
my config is this
This file was created by the package manager. Do not edit!
AS 12345
fib-update yes
network 0.0.0.0/0
group "Verizon" {
remote-as 1234
neighbor x.x.x.x {
descr "Verizon Las Vegas NV"
announce all
set nexthop x.x.x.x
}
neighbor y.y.y.y {
descr "Verizon Tempe AZ"
announce all
set nexthop y.y.y.y
}
}
deny from any
deny to any
allow from x.x.x.x
allow x.x.x.x
allow from y.y.y.y
allow to y.y.y.yOpenBGPD Summary
Neighbor AS MsgRcvd MsgSent OutQ Up/Down State/PrfRcvd
Verizon Tempe AZ 1234 38 36 0 00:05:27 1
Verizon Las Vegas NV 1234 38 37 0 00:05:27 1also, the bgp connection resets exactly every 15 minutes.
neighbor y.y.y.y (Verizon Tempe AZ): write error: Operation not permitted
neighbor y.y.y.y (Verizon Tempe AZ): write error: Operation not permitted
neighbor y.y.y.y (Verizon Tempe AZ): state change Established -> Idle, reason: Fatal error
neighbor x.x.x.x (Verizon Las Vegas NV): write error: Operation not permitted
neighbor x.x.x.x (Verizon Las Vegas NV): write error: Operation not permitted
neighbor x.x.x.x (Verizon Las Vegas NV): state change Established -> Idle, reason: Fatal error
route z.z.z.z/24 vanished before delete
check_reload_status: Reloading filter
neighbor y.y.y.y (Verizon Tempe AZ): state change Idle -> Connect, reason: Start
neighbor x.x.x.x (Verizon Las Vegas NV): state change Idle -> Connect, reason: Start
neighbor x.x.x.x (Verizon Las Vegas NV): state change Connect -> OpenSent, reason: Connection opened
neighbor y.y.y.y (Verizon Tempe AZ): state change Connect -> OpenSent, reason: Connection opened
neighbor x.x.x.x (Verizon Las Vegas NV): state change OpenSent -> OpenConfirm, reason: OPEN message received
neighbor x.x.x.x (Verizon Las Vegas NV): state change OpenConfirm -> Established, reason: KEEPALIVE message received
neighbor y.y.y.y (Verizon Tempe AZ): state change OpenSent -> OpenConfirm, reason: OPEN message received
neighbor y.y.y.y (Verizon Tempe AZ): state change OpenConfirm -> Established, reason: KEEPALIVE message received -
15 minute reset solved, not sure why, I added 2 items
local-address x.x.x.b
multihop 315 minute reset problem went away.
so one problem left. bgp route z.z.z.z not getting added …
HIGHFIVE MYSELF NO FRIENDS !
-
Still no solution yet, but I do have a new symptom . If I manualy add the route, and BGP sends a route update, then the route I had manualy added disapears. But or coarse the new one does not appear.
Also, I tried launching bgpd as root from SSH, and the results are not different.
I added a Depends on GRE line (which is absent from the web interface), and again no differnce.
I am stating to wonder if this is a bug. I am running the 64 bit distro. Does anyone out there have a working 64bit install with BGP?
Also, I am starting to wonder if anyone on PFsense has a correctly working BGP, I have read a couple BGP tutorials, and each time the user manualy added the route, but that make no sense?
Also, due to the lack of responses I am wondering if I am in the right forum section, moderator thoughts?
2.0.1-RELEASE (amd64)
built on Mon Dec 12 18:16:13 EST 2011
FreeBSD 8.1-RELEASE-p6 -
I don't have a working BGP install yet - I am just waiting on the first ISP to get their config stuff ready (Shaw). Once that is done I will be multi-homed with Telus and Shaw (Alberta, Canada). I am running x86 versions. I have been watching all of the BGP threads though, and I'm not sure why no one has replied to yours, especially admins, although sometimes it can take a while, though your OP is 12 days old - I imagine it can take time to browse every thread and post started.
-
Good to know someone is out there, thank you acherman.
For what it is worth looking back on this project BGP is fairly easy, as things go, once you understand all the terms used… Working with Verizon , translated Cisco network, not much of the language they used lined up... so once I figured out what they were saying it was not too difficult to get connected to their network. If you end up having to use GRE over Ipsec transport, like I did, be aware you will have to patch the interface, as pfSense is missing some cisco compatibility options.
Also, having been thru every turtorial I could find on bgp for pfSense, I am of the oppinion that many of the guys who write them don't know what they are doing .
Good Luck on your effort.
-
Solved !
so fortunately I stumbled across this post http://forum.pfsense.org/index.php?topic=54243.0
I had enabled RIP when I was transitioning from Watchguard to pfSense. So I turned it off as it is needed no more, and BGP routes now appear , YAY ! ;D
-
Good job! Thanks for the update and the words of advice. Much appreciated.
Aaron