Troubleshooting Tip: Common issue when trying to advertise a subnet to BGP peers

Description

This article describes the common issues encountered when trying to advertise a subnet to BGP peers.

Scope

All firmware versions (BGP specific defined by the RFC 4271).

Solution

The BGP network command has a different use compared to the network command used by IGPs. This command is not used to enable BGP on interfaces (as a matter of fact, there is no such concept in BGP, as there is in IGPs), but it is used to inject routes from the routing table to the BGP table so they can be advertised to BGP peers. For this to happen, an exact route for the prefix that needs to be advertised should be installed in the routing table on the BGP-speaking router.

A very common mistake, while configuring such a scenario, is when the BGP network command does not reference the exact prefix for a route which is installed in the routing table, or such a route to this prefix is not installed in the routing table, at all.

The BGP network command must reference the exact prefix for which a route is currently installed in the routing table of the BGP-speaking router. When such a route for the exact prefix is not installed in the routing table, a workaround is to use a black hole route (outgoing interface null0, in other Vendors context) to this prefix. This way, the route in question will be installed in the routing table, and it will be injected into the BGP table and advertised to BGP peers.

CLI configuration:

config router bgp
    config network
        edit 0
            set prefix 10.0.0.0/8
        end
    end

config router static
    edit 0
        set blackhole enable
        set dst 10.0.0.0 255.0.0.0
    next
end

Caution: Size the blackhole route to match the advertised prefix exactly, not broader. A wider blackhole can silently drop traffic for real subnets that fall inside it. More-specific real routes still win on longest-prefix-match, but only if they are actually present and correctly installed.

Verification of configuration and troubleshooting:

If the route exists but the peer still does not see it:

This is the second most common follow-up issue. Work through these in order:

• Confirm BGP itself sees it as a candidate: get router info bgp network

• Confirm it is actually being sent to the specific peer: get router info bgp neighbors <peer-ip> advertised-routes

• Check for an outbound route-map, prefix-list, or distribute-list on that neighbor filtering it out, a very common second-order cause. Look under 'config neighbor <ip>' for 'set route-map-out', and check the referenced config router route-map / prefix-list objects.

• Confirm the config change actually took effect: 'execute router clear bgp ip <peer-ip> soft out' (preferred, no session reset) or 'execute router clear bgp ip <peer-ip>' (full reset for that neighbor).

Related article:

Technical Tip: Advertise a BGP route not present in the routing table using network-import-check