[c-nsp] Cogent IOS upgrade == BGP-3, "update malformed"

[Charles Mills]

Try:

http://www.ciscosystems.com/en/US/docs/ios/12_0s/feature/guide/s_befasp.html


no bgp enforce-first-as under your BGP config (or turning it on)

I seem to remember a bug related to that.  Not at the office or near a
router to check exactly which it was but had a similar problem albeit with
another provider.

Good Luck

Chuck

On Sun, Aug 22, 2010 at 6:49 PM, randal k <cisconsp at data102.com> wrote:

> Cogent did an IOS upgrade to our local router, and immediately after our
> peering with them started flapping wildly - gets about 10 seconds and
> ~69,000 prefixes in and resets with the following:
>
> 729078: Aug 22 16:21:39 MDT: %BGP-3-NOTIFICATION: sent to neighbor A.B.C.D
> 3/1 (update malformed) 21 bytes 31FE420C 31FE58C8 124683E8 0206CC67 00
> 729079: Aug 22 16:21:39 MDT: BGP: A.B.C.D Bad attributes FFFF FFFF FFFF
> FFFF
> FFFF FFFF FFFF FFFF 0060 0200 0000 4140 0101 0040 020C 0205 00AE 0CB9 235A
> 2046 5BA0 4003 0426 6532 7580 0404 0000 5DE8 C008 0800 AE52 0800 AE55 FD31
> FE42 0C31 FE58 C812 4683 E802 06CC 6700 0000 0002 1854 1608 1854 1609
>
> I of course thought max as-path issues, but we already fixed that network
> wide and confirmed that it is already set to 100. Our transit_input
> route-map strips off everything; any idea what they could be sending us
> that
> would cause our router to kill the session? Anybody seen anything similar?
> We are thinking may something random with 4-byte ASNs or something
> community
> related; as such we've asked for a similar stripper on their output, and if
> that doesn't work, a code downgrade.
>
> They're on a 7609 running God-knows-what, we were on 12.4(13c) and upgraded
> to 12.4(24)T3, same issue.
>
> Thanks for any input ya'll may have!
> Randal
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
=====================================
Charles L. Mills
Westmoreland Co. ARES EC
Amateur Radio Callsign W3YNI
Email: w3yni1 at gmail.com