Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Sanjay_S
Advisor
Jump to solution

BGP routes are not in the route table

Hi All,

I am facing issues with the bgp routes. I am able to see the imported routes with the show route all command but i am not able to see any of the routes in the route table(route -n). Could you please suggest me on this as soon as possible please.

Below is the config in place.

set as zzzzz
set router-id x.x.x.x

set bgp external remote-as xxxxx on
set bgp external remote-as xxxxx description Primary Peer
set bgp external remote-as xxxxx export-routemap "Inside_Routes" preference 1 on
set bgp external remote-as xxxxx import-routemap "MPLSRoutes-IN" preference 1 on
set bgp external remote-as xxxxx peer y.y.y.y on
set bgp external remote-as xxxxx peer y.y.y.y ping on
set bgp external remote-as xxxxx peer y.y.y.y export-routemap "Inside_Routes" preference 1 on
set bgp external remote-as xxxxx peer y.y.y.y import-routemap "MPLSRoutes-IN" preference 1 on
set bgp external remote-as xxxxy on
set bgp external remote-as xxxxy description SecondaryPeer
set bgp external remote-as xxxxy export-routemap "Inside_Routes" preference 2 on
set bgp external remote-as xxxxy import-routemap "MPLSRoutes-IN" preference 2 on
set bgp external remote-as xxxxy peer z.z.z.z on
set bgp external remote-as xxxxy peer z.z.z.z aspath-prepend-count 3
set bgp external remote-as xxxxy peer z.z.z.z ping on

set routemap MPLSRoutes-IN id 3 on
set routemap MPLSRoutes-IN id 3 allow
set routemap MPLSRoutes-IN id 3 match as xxxxx on
set routemap MPLSRoutes-IN id 3 match as xxxxy on
set routemap MPLSRoutes-IN id 3 match interface eth3 on
set routemap Inside_Routes id 4 on
set routemap Inside_Routes id 4 allow
set routemap Inside_Routes id 4 match as xxxxx on
set routemap Inside_Routes id 4 match as xxxxy on
set routemap Inside_Routes id 4 match network 10.10.10.10/32 exact
set routemap Inside_Routes id 4 match protocol static

1 Solution

Accepted Solutions
the_rock
Legend
Legend

I had similar issue with one customer and the only way to fix it was rebooting the firewalls after extensive troubleshooting and debugs with TAC. Odd thing in that scenario was that even though BGP config was there, it was stating from clish and BGP was not running...very strange.

View solution in original post

0 Kudos
11 Replies
Timothy_Hall
Legend Legend
Legend

If the route is showing up in the configuration (show route all) but not showing up in the live routing table, usually that means that the advertised nexthop gateway is not directly reachable through any of the firewall's interfaces.  This exact scenario (which can certainly be confusing) was covered in my Gaia 3.10 Immersion course, here are the relevant pages:

GaiaRoute1.jpg

 

GaiaRoute2.jpg

It is also possible that your have a problem with your defined routemap and the learned routes are being "hidden" as a result, see here: sk87420: BGP routes are not shown in the output of 'show route' command, but are shown as 'hidden' i...

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
Sanjay_S
Advisor

Thank you Timothy for the clear explanation on this. I can confirm the next hop if part of the subnet configured on one of the interfaces. Also verified the route map configuration on sk87420 still the issue doesn't seem to be resolved. Raised with TAC and waiting for the update. 

0 Kudos
the_rock
Legend
Legend

I had similar issue with one customer and the only way to fix it was rebooting the firewalls after extensive troubleshooting and debugs with TAC. Odd thing in that scenario was that even though BGP config was there, it was stating from clish and BGP was not running...very strange.

0 Kudos
Sanjay_S
Advisor

Even Checkpoint suggesting to restart the route daemon as you suggested the_rock :). I have requested customer a window to perform this. Will let the chain knows the outcome. In the meanwhile could you please suggest on what i need to do if i need to advertise the default route to the peer based on t he above config shared?

0 Kudos
the_rock
Legend
Legend

I hate to tell you this, but I dont think restarting the routing deamon will do anything here...reboot might be needed.

0 Kudos
Sanjay_S
Advisor

Sure Rock will any install the latest hotfix so it will be rebooted. Will check the outcome and update this chain.

0 Kudos
Sanjay_S
Advisor

Hi All,

I do not see anything mentioned in the dynamic routing configuration for advertising the default route to the peer. Could you please suggest me on that. I went through the below community page but here it is mentioned that R80 doesn't support the 0.0.0.0/0 syntax.

https://community.checkpoint.com/t5/Security-Gateways/Gaia-R80-10-BGP-default-route/td-p/52156

0 Kudos
Sanjay_S
Advisor

Any suggestions on this please?

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Redistributing from static or another protocol with appropriate filter list should work just fine or are you looking for something else?

CCSM R77/R80/ELITE
0 Kudos
Sanjay_S
Advisor

Hi Chris,

Rebooting the firewall fixed the issue:)

Thanks for all your support.

the_rock
Legend
Legend

Personally, what I always do is first look at /var/log/routed.log file on the firewall. If you see inconsistent messages there, thats your best clue that reboot is needed if restarting the routing daemon fails.

 

Cheers,

 

Andy

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events