Description

BGP neighborship does not come online because teh md5 authentication key is lost in kernel table.

Symptoms

On EX4100-VC we observed that BGP neighbor with md5 enabled will not come online after reboot.

 

After reboot:

 

{master:1}

root@LAB> show bgp summary

Threading mode: BGP I/O

Default eBGP mode: advertise - accept, receive - accept

Groups: 2 Peers: 2 Down peers: 2

Table         Tot Paths Act Paths Suppressed   History Damp State   Pending

inet.0              

                       0         0         0         0         0         0

Peer                    AS     InPkt    OutPkt   OutQ  Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...

x.x.x.x             64522         0         0      0      0       4:25 Connect

 

{master:1}

root@LAB> set cli timestamp

Jul 31 20:36:48

CLI timestamp set to: %b %d %T

 

{master:1}

root@LAB> start shell

Jul 31 20:36:50

root@nycrnylu-ios01:RE:1% cat /var/etc/keyadmin.conf

tcp 179 0.0.0.0 x.x.x.x md5 instance TEST 0x52407370623372727943683333736563406b65

root@LAB:RE:1% keyadmin dump >>>>>>>>>>>>>>>>> nothing was observed in kernel

root@LAB:RE:1%

 

Can be recovered by using below command;

 

root@LAB:RE:1% /usr/sbin/keyadmin revise /var/etc/keyadmin.conf

 

After recovery;

 

 root@LAB:RE:1% keyadmin dump >>>>>>>>>>>>>>>>>>>>> keys were observed for each neighbor

type=11(tcp) spi/port=179 algorithm=252(md5) state=0x1 MATURE

key type=1, auth type=1

 key (len=19): 52407370623372727943683333736563406b65

src: 0.0.0.0

dst: x.x.x.x

dest plen:32:

instance (len=8):      TEST

 

 

root@LAB:RE:1% cli

{master:1}

root@LAB> set cli timestamp

Jul 31 20:37:45

CLI timestamp set to: %b %d %T

 

{master:1}

root@LAB> show bgp summary

Jul 31 20:37:47

Threading mode: BGP I/O

Default eBGP mode: advertise - accept, receive - accept

Groups: 2 Peers: 2 Down peers: 0

Table         Tot Paths Act Paths Suppressed   History Damp State   Pending

inet.0              

                       1         1         0         0         0         0

Peer                    AS     InPkt    OutPkt   OutQ  Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...

x.x.x.x              64522         4         2      0      0         10 Establ

 TEST.inet.0: 1/1/1/0

 

{master:1}

root@LAB>

 

Solution

Can be recovered by using below command;

root@LAB:RE:1% /usr/sbin/keyadmin revise /var/etc/keyadmin.conf

Modification History

DRAFT