300-410 BGP Troubleshooting — 20 Questions

Question 1

A network engineer is troubleshooting a BGP peering issue between two directly connected routers, R1 and R2. R1 is configured with 'neighbor 10.1.1.2 remote-as 65002' and 'neighbor 10.1.1.2 update-source Loopback0', while R2 uses 'neighbor 10.1.1.1 remote-as 65001' and 'neighbor 10.1.1.1 update-source Loopback0'. The loopback interfaces are not advertised into any IGP, and there is no static route for the loopback addresses. The BGP session remains in Idle state. What is the most likely cause?

Accepted Answer

The BGP session is stuck in Idle because the neighbor statements reference loopback interfaces that are not reachable.. BGP requires reachability to the neighbor's update-source address. Since the loopback addresses are not reachable via any routing protocol or static route, the TCP connection fails, keeping the session in Idle state.

Answer

The BGP session is stuck in Idle because the remote-as values are mismatched.

Answer

The BGP session is stuck in Idle because the update-source command is not allowed on directly connected interfaces.

Answer

The BGP session is stuck in Idle because the neighbor statements must use the directly connected interface IP addresses.

Question 2

An engineer is troubleshooting a missing BGP route on R3. R3 has an eBGP session with R4 (AS 65004) and an iBGP session with R1 (AS 65003). R4 advertises a prefix 192.168.1.0/24 to R3, and R3's BGP table shows the route with next-hop 10.1.4.4. However, R3 does not install this route in its routing table. The output of 'show ip bgp 192.168.1.0/24' on R3 shows the route as valid but not best. What is the most likely cause?

Accepted Answer

The route is not installed because the next-hop 10.1.4.4 is not reachable via any routing table entry.. For an eBGP route to be installed, the next-hop must be reachable via an IGP or static route. If the next-hop is not reachable, BGP marks the route as valid but not best.

Answer

The route is not installed because BGP synchronization is enabled and the IGP does not have the route.

Answer

The route is not installed because the prefix length is too long for the routing table.

Answer

The route is not installed because R3 has a higher administrative distance for eBGP routes.

Question 3

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 in AS 65001 is configured to redistribute connected routes into BGP. The route 10.10.10.0/24 is learned via BGP on R2 (AS 65002), but R2's iBGP neighbor R3 (AS 65002) does not receive this route. R2 and R3 have a full iBGP mesh, and the BGP session is established. The output of 'show ip bgp' on R2 shows the route with the 'r' flag (RIB-failure). What is the most likely cause?

Accepted Answer

The route is marked as RIB-failure because a route with a lower administrative distance already exists in the routing table for the same prefix.. RIB-failure indicates that BGP learned a route but it was not installed in the routing table because a better route (e.g., from an IGP or static) already exists. This prevents the route from being advertised to iBGP peers.

Answer

The route is marked as RIB-failure because the next-hop is unreachable.

Answer

The route is marked as RIB-failure because BGP synchronization is enabled and the IGP does not have the route.

Answer

The route is marked as RIB-failure because the prefix is being filtered by an outbound route map.

Question 4

An engineer is troubleshooting a BGP peering problem between two routers, R1 (AS 65001) and R2 (AS 65002), connected via a firewall. The BGP session is flapping every few seconds. The engineer notices that the TCP connection is established, but BGP OPEN messages are not exchanged. The firewall logs show that TCP port 179 is allowed, but packets with the BGP marker (0xFFFFFFFF) are being dropped. What is the most likely cause?

Accepted Answer

The firewall is dropping BGP packets because the BGP marker (0xFFFFFFFF) is being flagged as a potential attack or malformed packet.. BGP uses a 16-byte marker (all 0xFF) in its messages. Some firewalls or intrusion prevention systems may misinterpret this as a malformed packet and drop it, preventing BGP from establishing.

Answer

The BGP session is flapping because the keepalive timer is set too low on both routers.

Answer

The BGP session is flapping because the routers have mismatched BGP AS numbers.

Answer

The BGP session is flapping because the firewall is performing TCP sequence number randomization, breaking the BGP session.

Question 5

A network engineer is troubleshooting missing BGP routes on R3. R1 (AS 65001) is an eBGP peer of R2 (AS 65002), and R2 is an iBGP peer of R3 (AS 65002). R1 advertises the prefix 172.16.1.0/24 to R2. On R2, 'show ip bgp' shows the prefix with next-hop 10.1.1.1 (R1's interface). R3's BGP table does not contain this prefix. R2 and R3 are not route reflectors, and there are no other iBGP peers. What is the most likely cause?

Accepted Answer

R2 does not have the 'neighbor 10.1.1.3 activate' command under the BGP configuration for the iBGP session.. In iBGP, by default, routes learned from an iBGP peer are not advertised to other iBGP peers (split horizon). Since R2 learned the route from eBGP, it should advertise it to R3. However, if R3 learned the route via iBGP from another source, it might not be advertised. But the scenario implies R2 is not advertising to R3. The most common cause is that R2 has a route-map or filter blocking the advertisement, or the next-hop is unreachable from R3. However, given the information, the likely issue is that R2 does not have the route in its BGP table as best, or the next-hop is not reachable. But the stem says R2 shows the prefix. The correct answer is that R2 is not advertising because the next-hop (10.1.1.1) is not reachable from R3, but that would affect R3's ability to use the route, not R2's advertisement. Actually, R2 will advertise to iBGP peers regardless of next-hop reachability on the receiver. So the issue must be that R2 is not advertising due to a missing 'neighbor R3 activate' or a filter. The most plausible is that the network statement or redistribution is missing on R2 for the prefix? No, R2 has it. Let me re-read: R2's BGP table shows the prefix. The missing route on R3 could be due to R2 not having the 'neighbor 10.1.1.3 activate' under the BGP process, or a route-map blocking. The stem does not mention any filters. The most common cause in such scenarios is that the BGP session between R2 and R3 is not configured to exchange prefixes (missing activate).

Answer

R2 is not advertising the route because the next-hop 10.1.1.1 is not reachable from R3.

Answer

R2 is not advertising the route because BGP synchronization is enabled and the IGP does not have the route.

Answer

R2 is not advertising the route because the prefix is being filtered by an inbound route-map on R3.

Question 6

An engineer is troubleshooting a BGP route selection issue. Router R1 receives two paths for prefix 10.0.0.0/8: one from eBGP peer R2 (AS 65002) with weight 0, local preference 100, and AS path 65002; and another from eBGP peer R3 (AS 65003) with weight 0, local preference 200, and AS path 65003 65004. R1's BGP table shows the path from R3 as the best route. The engineer wants the path from R2 to be preferred. What should the engineer do?

Accepted Answer

Configure a route-map on R1 to set local preference 150 for routes from R2.. BGP selects the best path based on several attributes. Local preference is checked before AS path length. To prefer the R2 path, the engineer can increase its local preference (e.g., via route-map) or decrease the local preference of the R3 path. Since local preference is higher for R3, lowering it or raising R2's will make R2 preferred.

Answer

Configure a route-map on R1 to prepend two additional AS numbers to the AS path from R3.

Answer

Configure a route-map on R1 to set weight 100 for routes from R2.

Question 7

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) has an eBGP session with R2 (AS 65002). R1 is advertising the prefix 192.168.1.0/24 to R2. On R2, the route appears in the BGP table but is not installed in the routing table. The output of 'show ip bgp 192.168.1.0/24' on R2 shows the route as valid, best, but with the 'r' flag (RIB-failure). The routing table on R2 shows a static route for 192.168.1.0/24 with administrative distance 1. What is the most likely cause?

Accepted Answer

The BGP route is not installed because a static route with a lower administrative distance exists for the same prefix.. RIB-failure occurs when BGP tries to install a route but a route with a lower administrative distance already exists. Here, the static route (AD 1) is preferred over the eBGP route (AD 20).

Answer

The BGP route is not installed because the next-hop is unreachable.

Answer

The BGP route is not installed because BGP synchronization is enabled.

Answer

The BGP route is not installed because the prefix length is too long.

Question 8

An engineer is troubleshooting a BGP peering issue between two routers, R1 and R2, connected via a serial link. The BGP session is established, but routes are not being exchanged. The engineer checks the BGP configuration and sees that both routers have the 'neighbor' commands correctly configured. The output of 'show ip bgp summary' shows the session is in the Established state, but the prefix counts are zero. What is the most likely cause?

Accepted Answer

Neither router has any network statements or redistribution commands configured to inject prefixes into BGP.. If the BGP session is established but no prefixes are exchanged, the most common cause is that there are no networks configured under the BGP process or no redistribution. Alternatively, outbound filters could be blocking all prefixes. The stem says routes are not being exchanged, so the issue is on the advertisement side.

Answer

The BGP session is using MD5 authentication, but the passwords do not match.

Answer

The routers have mismatched BGP versions.

Answer

The update-source command is missing, causing the session to use the wrong interface.

Question 9

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) is an eBGP peer of R2 (AS 65002). R1 is advertising the prefix 10.0.0.0/8 to R2. R2 has an iBGP session with R3 (AS 65002). R3's BGP table shows the prefix 10.0.0.0/8 with next-hop 10.1.1.1 (R1's interface). However, R3 does not install this route in its routing table. The output of 'show ip route 10.0.0.0' on R3 shows no route. The engineer checks the routing table on R3 and sees that the interface connected to 10.1.1.0/24 is down. What is the most likely cause?

Accepted Answer

The next-hop 10.1.1.1 is not reachable because the directly connected interface is down.. For BGP to install a route, the next-hop must be reachable. If the interface to the next-hop is down, the route is considered unreachable and will not be installed.

Answer

The route is not installed because BGP synchronization is enabled.

Answer

The route is not installed because the prefix is being filtered by an inbound route-map on R3.

Answer

The route is not installed because the administrative distance of the route is too high.

Question 10

A network engineer runs the following command on Router R1:

R1# show bgp summary

BGP router identifier 10.1.1.1, local AS number 65001
BGP table version is 15, main routing table version 15
2 network entries using 288 bytes of memory
2 path entries using 160 bytes of memory
2/1 BGP path/bestpath attribute entries using 288 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 736 total bytes of memory
BGP activity 4/2 prefixes, 4/2 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.12.2       4        65002    1023    1047       15    0    0 00:12:34        0
192.168.1.2     4        65003       0       0        0    0    0 never    Active

Based on this output, what is the problem with the BGP session to 192.168.1.2?

Accepted Answer

The BGP session to 192.168.1.2 has never been established and is in Active state, likely due to a lack of TCP connectivity.. The neighbor 192.168.1.2 is in Active state, meaning R1 is trying to establish a TCP connection but is not receiving a response. This could be due to reachability issues, incorrect AS number, or ACL blocking. The session has never been up (Up/Down: never).

Answer

The neighbor 192.168.1.2 is not reachable.

Answer

The neighbor 192.168.1.2 is in Idle state due to a misconfigured AS number.

Answer

The BGP session to 192.168.1.2 is established but not exchanging prefixes.

Question 11

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.1.1.0/24
BGP routing table entry for 10.1.1.0/24, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.1 from 0.0.0.0 (10.1.1.1)
      Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, which statement is correct?

Accepted Answer

The route 10.1.1.0/24 is locally originated and is the best path.. The output shows a locally originated network (10.1.1.0/24) with next hop 10.1.1.1 (the router itself). It is marked as valid, sourced, and best, meaning it is injected into BGP and will be advertised to peers.

Answer

The route 10.1.1.0/24 was learned from an eBGP peer.

Answer

The route 10.1.1.0/24 has a weight of 100.

Answer

The route 10.1.1.0/24 is not being advertised to any peer.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip bgp neighbors 10.1.12.2
BGP neighbor is 10.1.12.2,  remote AS 65002, external link
  BGP version 4, remote router ID 10.2.2.2
  BGP state = Idle
  Last read 00:00:00, last write 00:00:00, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable (disabled)
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
    Enhanced Refresh Capability: advertised
    Multisession Capability:
  State is never active
  Message statistics:
    InQ depth is 0
    OutQ depth is 0

Based on this output, what is the most likely cause of the BGP session being in Idle state?

Accepted Answer

The BGP neighbor is administratively shut down (neighbor shutdown).. Idle state typically indicates that BGP is not attempting to connect, often due to a configuration issue such as a missing neighbor statement, incorrect AS number, or a shutdown. The 'State is never active' suggests the session has never transitioned to Active, pointing to a configuration problem.

Answer

The neighbor 10.1.12.2 is not reachable via IP routing.

Answer

The remote AS number is misconfigured.

Answer

The BGP update timer is too long.

Question 13

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.2.2.0/24
BGP routing table entry for 10.2.2.0/24, version 5
Paths: (1 available, best #1, table default)
  Not advertised to any peer
  Refresh Epoch 1
  65002
    10.1.12.2 from 10.1.12.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what is a potential issue with this route?

Accepted Answer

The route is not being advertised to any BGP peer, possibly due to outbound filtering.. The route is valid and best, but it is 'Not advertised to any peer'. This could be due to outbound filtering, such as a route-map, prefix-list, or the neighbor not being configured to receive the route. The route is learned from an eBGP peer but not being propagated.

Answer

The route has a low local preference of 100.

Answer

The next hop 10.1.12.2 is unreachable.

Answer

The route is not installed in the routing table.

Question 14

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.3.3.0/24
BGP routing table entry for 10.3.3.0/24, version 10
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65003 65004
    10.1.13.3 from 10.1.13.3 (10.3.3.3)
      Origin IGP, metric 0, localpref 100, valid, external
      rx pathid: 0, tx pathid: 0
  Refresh Epoch 1
  65005
    10.1.15.5 from 10.1.15.5 (10.5.5.5)
      Origin IGP, metric 0, localpref 200, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, why is the path via 10.1.15.5 chosen as best?

Accepted Answer

Because it has a higher local preference of 200.. BGP selects the best path based on several criteria. Here, both paths are external, valid, and have the same weight (default 0). The path via 10.1.15.5 has a higher local preference (200 vs 100), which is the first tiebreaker after weight. Therefore, it is chosen as best.

Answer

Because it has a shorter AS path (65005 vs 65003 65004).

Answer

Because it has a lower metric (0 vs 0).

Answer

Because it was learned from a lower neighbor IP address.

Question 15

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 advertised-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 2

Based on this output, what can be concluded about the route 10.2.2.0/24?

Accepted Answer

The route 10.2.2.0/24 is being advertised back to the neighbor from which it was learned, which is incorrect.. The route 10.2.2.0/24 is being advertised to the neighbor 10.1.12.2 with next hop 10.1.12.2 itself. This indicates that R1 is advertising a route it learned from the same neighbor back to it, which is a classic case of BGP split-horizon or route advertisement causing a potential loop. However, since it is advertised, it may be due to missing AS-path filtering or a misconfiguration.

Answer

The route 10.2.2.0/24 is locally originated.

Answer

The route 10.2.2.0/24 has a weight of 0.

Answer

The route 10.2.2.0/24 is not valid.

Question 16

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.4.4.0/24
BGP routing table entry for 10.4.4.0/24, version 8
Paths: (1 available, best #1, table default)
  Not advertised to any peer
  Refresh Epoch 1
  65006
    10.1.16.6 from 10.1.16.6 (10.6.6.6)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what is the most likely reason the route is not advertised to any peer?

Accepted Answer

There is an outbound route-map or prefix-list filtering the route.. The route is valid and best, but not advertised. This could be due to outbound filtering (route-map, prefix-list) applied to the BGP neighbor, or the neighbor might not be configured to receive this prefix. Another possibility is that the route is suppressed by a policy.

Answer

The route has a local preference of 100, which is too low.

Answer

The BGP session to the neighbor is down.

Answer

The route is not in the routing table.

Question 17

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 received-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 1

Based on this output, what can be inferred about the BGP session?

Accepted Answer

The BGP session is established and the neighbor is advertising one prefix.. The output shows that R1 has received one prefix (10.2.2.0/24) from neighbor 10.1.12.2. The prefix is valid and best. This indicates the BGP session is established and exchanging routes.

Answer

The BGP session is not established.

Answer

The BGP session is in Active state.

Answer

The BGP session is in Idle state.

Question 18

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.5.5.0/24
BGP routing table entry for 10.5.5.0/24, version 12
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65007
    10.1.17.7 from 10.1.17.7 (10.7.7.7)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what does the 'r' in the status codes indicate if present? (Not shown here, but the engineer notices a similar route with 'r' status.)

Accepted Answer

The route is a RIB-failure, meaning it is not installed in the routing table because another route with a lower administrative distance exists.. The 'r' status code stands for RIB-failure, meaning the route is valid in BGP but not installed in the routing table because a route with a lower administrative distance (e.g., from OSPF or EIGRP) already exists.

Answer

The route is suppressed by a route-map.

Answer

The route is not valid due to next-hop unreachability.

Answer

The route is dampened.

Question 19

Given the following BGP configuration on router R1:

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65002
 neighbor 10.1.1.2 route-map SET-MED out
!
route-map SET-MED permit 10
 match ip address prefix-list LOOPBACKS
 set metric 100
!
route-map SET-MED permit 20
!
ip prefix-list LOOPBACKS permit 192.168.0.0/24

What is the effect of this configuration?

Accepted Answer

All routes are advertised to 10.1.1.2; the 192.168.0.0/24 route has MED 100, others have no MED.. The route-map SET-MED has two sequences. Sequence 10 matches prefix-list LOOPBACKS (192.168.0.0/24) and sets MED to 100. Sequence 20 permits everything else without setting MED, so other routes are advertised with their original MED.

Answer

Only the 192.168.0.0/24 route is advertised to 10.1.1.2, with MED 100.

Answer

All routes are advertised with MED 100 because the route-map is applied outbound.

Answer

Only the 192.168.0.0/24 route is advertised with no MED because the set metric is ignored.

Question 20

Consider the following BGP configuration on router R2:

router bgp 65002
 bgp router-id 2.2.2.2
 neighbor 10.2.2.1 remote-as 65001
 neighbor 10.2.2.1 route-map FILTER in
!
route-map FILTER deny 10
 match ip address prefix-list BLOCKED
!
route-map FILTER permit 20
!
ip prefix-list BLOCKED permit 10.0.0.0/8 le 32

Which statement is true about routes received from 10.2.2.1?

Accepted Answer

Routes with prefix 10.0.0.0/8 or more specific are denied; all others are permitted.. The route-map FILTER is applied inbound. Sequence 10 denies any route matching prefix-list BLOCKED (10.0.0.0/8 and more specific). Sequence 20 permits all other routes. Routes with 10.x.x.x are denied.

Answer

All routes are accepted because the deny statement is misconfigured.

Answer

Only routes exactly matching 10.0.0.0/8 are denied; other 10.x.x.x routes are permitted.

Answer

The route-map is applied outbound, so it affects routes sent to 10.2.2.1.