Technical Tip: BGP Prefix Withdrawn entries in BGP logs

If the BGP has a route missing in the routing table, it is necessary to run the following commands to collect the logs:

diagnose debug disable

diagnose debug reset

diagnose ip router bgp all enable

diagnose ip router bgp level info

diagnose debug enable

BGP: 10.1.1.92-Outgoing [DECODE] Update: NLRI Len(4)
BGP: 10.1.1.92-Outgoing [FSM] State: Established Event: 27
BGP: 10.1.1.92-Outgoing [RIB] Update: Received Prefix 10.25.69.0/23 path_id 0
BGP: [DAMP] bgp_rfd_rt_withdraw(): No dampening reqd
BGP: [DAMP] bgp_rfd_rt_withdraw(): Route State: NONE, ret=0
BGP: [DAMP] bgp_rfd_rt_update(): Route State: NONE, ret=0

BGP: 10.1.1.92-Outgoing [FSM] State: Established Event: 34
BGP: 10.1.1.92-Outgoing [ENCODE] Msg-Hdr: Type 2
BGP: 10.1.1.92-Outgoing [ENCODE] Attr IP-Unicast: Tot-attr-len 24
BGP: 10.1.1.92-Outgoing [ENCODE] Update: Msg #2033 Size 51
BGP: [RIB] Scanning BGP Network Routes for VRF 0...
BGP: 10.1.1.92-Outgoing [FSM] State: Established Event: 34
BGP: 10.1.1.92-Outgoing [ENCODE] Msg-Hdr: Type 2
BGP: 10.1.1.92-Outgoing [ENCODE] Update Withdrawn: Prefix 10.25.69.0/23
BGP: 10.1.1.92-Outgoing [ENCODE] Update: Msg #1907 Size 27

This log shows that the route has been withdrawn from the routing table, and the BGP peer is sending out the update.

This could be possible because of three reasons:

1. Explicit withdraw: UPDATE message with Withdrawn Routes field containing the prefix (most common), which designates destinations for a previously advertised route.
   This action effectively marks the associated route as unavailable for use.
   
   

2. Replacement Route: New UPDATE with same NLRI but different attributes (or unreachable NEXT_HOP)

   A BGP speaker can advertise a replacement route containing the same Network Layer Reachability Information (NLRI) as the route being withdrawn. By sharing this replacement route, the speaker signals that the previous route is no longer available.
   
   

3. Session Reset / TCP FIN: Closing the connection between BGP speakers results in the implicit removal from service of all routes that were previously advertised between the pair of speakers. This action signifies the withdrawal of all routes shared between those specific peers.

These methods enable BGP speakers to effectively communicate the unavailability of routes to their peers, ensuring efficient routing within the network.