SDWAN Spoke Does not receive all best routes from the HUB via iBGP

[LoueyS]

Hi everyone,

I am working on an SDWAN topology with 1 hub and 3 spokes (Spoke 1, spoke 2, spoke 3) routed via iBGP with the hub as Route reflector server. All spokes are RR clients.

The actual issue is that the Hub is advertising all the best routes to the spokes but spoke 2 does not receive the route of spoke 1 and spoke 1 does not receive the route of spoke 2. Spoke 3 receives all the routes and spoke1 and spoke 2 receive the spoke 3 routes.

I don't see any route-map or filter on spoke 1 or Spoke 2, I have done a soft bgp clear but still have the same issue. This make ADVPN shortcut never goes up between spoke 1 and 2.

have you ever faced the same issue ?

Kind regards

[akristof]

Hello,

Thank you for your question. If spoke3 is receiving all routes, then HUB should be doing it's job and the problem should be on spoke1/spoke2. I would first verify configs - if the BGP is same on all devices and if the ipsec tunnel config is the same.

And then verify the BGP and routing-table. I would verify this:

get router info routing-table all

get router info routing-table data

get router info bgp network

get router info bgp neighbor X.X.X.X received-routes (soft-reconfiguration needs to be enabled).

This will at least tell you if spoke is receive route, but maybe not installing it in the routing-table. If you don't see route even received, then enable BGP debug, restart BGP and see:

diag ip router bgp level info

diag ip router bgp nsm enable

diag ip router bgp all enable

diag debug console time en

diag debug en

exec router clear bgp ip x.x.x.x (neighbor ip).

And then see if some routes are not suppressed or some other problem.

diag debug disable - to disable debug when you finish

[LoueyS]

Hi Adrian,

Thank you so much for your answer. Actually I enabled soft-reconfiguration and find the route in "received-routes" so the spoke is receiving the route from the HUB. The problem is that I don't find any route-map of prefix list that could filter the routes.

Have an idea of what the issue can be ?

Kind regards

[akristof]

Hi,

In that case, check couple of things. I still recommend check routing-table database to see if it is just not the best route. Other then this, run the debug for BGP, bring neighbor down and see if there is some message why routes are not injected into routing-table/bgp table. If you will attach output let me know which route is not in routing-table we can check if there are some hints.

[LoueyS]

Hi Adrian,

I made a debug in spoke 2 with reseting the neighbor  (RR server) and I got this :

Prefix "spoke 1" path-id 0 denied due to originator is us.

I don't understand why he is considering that this prefix carries his own id. 

Do you have an idea about that ?

I confirm is that route is the best route (indicated in received-routes)

Regards

[akristof]

Hi,

For some reasons Fortigate act like this would not be route-reflector scenario. Can you share with me BGP config from this spoke and from HUB?

[LoueyS]

Hi,

Here is the bgp config for the spoke :

and from the HUB :

[akristof · Accepted solution]

Hi,

Let's try this. Can you configure on Spoke router-id that will be some other ID, for example IP of the tunnel. I am suspecting that there might be some duplicate router-id withing your AS.

[LoueyS]

Hi Adrian,

I changed the router-id for the spoke it works, I can find the spoke 1 route in the bgp table. Which I don't understand is that no router-id was configured in all the spokes and spoke 3 was receiving all routes. So normally there is no router-id duplication.

Thank you for your help !

Regards

[LoueyS]

Hi Adrian,

It works by changing the spoke router-id. I dont understand why because no router-id was configured in the spokes. And spoke 3 was receiving all routes without any problem.

Thanks a lot for your help.

Regards