Encounter a persistent issue where BGP task replication remains indefinitely stuck in the "InProgress" state. This problem surfaces when Non-Stop Routing (NSR) is enabled, and BGP key chain authentication is configured on Juniper PTX Series routers. The symptoms include BGP not establishing on the backup routing engine, evidenced by the "Idle" state. Examination of logs reveals continuous occurrences of JSR backup registration failures with the error "Returned Generic Error Invalid Argument." This anomaly is associated with the use of TCP keychain, which is not supported in the current release.
Below is a bgp config with auth key chain applied.
set protocols bgp group ibgp-spine-ipv4-route-reflectors type internal set protocols bgp group ibgp-spine-ipv4-route-reflectors description "Spines IPv4" set protocols bgp group ibgp-spine-ipv4-route-reflectors local-address 10.220.1.3 set protocols bgp group ibgp-spine-ipv4-route-reflectors authentication-algorithm md5 set protocols bgp group ibgp-spine-ipv4-route-reflectors authentication-key-chain SPINE-to-RR set protocols bgp group ibgp-spine-ipv4-route-reflectors export pol-ibgp-export set protocols bgp group ibgp-spine-ipv4-route-reflectors neighbor 10.220.1.2 set protocols bgp group ibgp-spine-ipv4-route-reflectors neighbor 10.220.1.1 show configuration security authentication-key-chains key-chain SPINE-to-RR key 2 { secret "$9$OIM5BEyleWXxdyrYgJZji"; ## SECRET-DATA start-time "2021-5-10.05:31:00 +0530"; algorithm md5; }
BGP task replication is stuck in the "InProgress" state.
jtac-ptx10008-scapa-r2002-re0> show task replication Stateful Replication: Enabled RE mode: Master Protocol Synchronization Status BGP InProgress IS-IS Complete PIM Complete MPLS Complete RSVP Complete SPRING-TE Complete
BGP is not established on the backup routing engine.
labroot@jtac-ptx10008-scapa-r2002-re0> show bgp summary | match est 10.220.1.1 137 351 351 0 10 2:34:29 Establ 2011:301:1020::1 137 344 348 0 4 2:34:33 Establ {master} labroot@jtac-ptx10008-scapa-r2002-re0> request routing-engine login other-routing-engine Last login: Sun Dec 10 15:08:33 2023 from 128.0.0.4 --- JUNOS 21.4R3-S4.8-EVO Linux (none) 4.8.28-WR2.2.1_standard-gad6c183 #1 SMP PREEMPT Thu Jun 16 11:35:51 PDT 2022 x86_64 x86_64 x86_64 GNU/Linux {backup} labroot@jtac-ptx10008-scapa-r2002-re1> show bgp summary | match "10.220.1.1|2011:301:1020::1" 10.220.1.1 137 0 0 0 0 1:01:15 Idle 2011:301:1020::1 137 0 0 0 0 1:01:15 Idle
Continuous logs of JSR backup registration failures with the error "Returned Generic Error Invalid Argument."
Dec 10 15:07:46.971 jtac-ptx10008-scapa-r2002-re1 rpd[18028]: JTASK_SYSTEM: JSR backup registration failed for task BGP_137.2011:301:1020::1 error:Returned Generic Error Invalid argument Dec 10 15:07:46.971 jtac-ptx10008-scapa-r2002-re1 rpd[18028]: JTASK_SYSTEM: socket(10, 1) Dec 10 15:07:46.971 jtac-ptx10008-scapa-r2002-re1 rpd[18028]: libjsr:jsr_register_backup:534 connect failed. errno 115 Dec 10 15:07:47.372 jtac-ptx10008-scapa-r2002-re1 rpd[18028]: JTASK_SYSTEM: JSR backup registration failed for task BGP_137.10.220.1.1 error:Returned Generic Error Invalid argument Dec 10 15:07:47.372 jtac-ptx10008-scapa-r2002-re1 rpd[18028]: JTASK_SYSTEM: socket(2, 1) Dec 10 15:07:47.372 jtac-ptx10008-scapa-r2002-re1 rpd[18028]: libjsr:jsr_register_backup:534 connect failed. errno 115
NSR with TCP keychain authentication is available on PTX routers (PTX10003, PTX10004, PTX10008, and PTX10016) starting from 22.1R1-evo. If your current version is lower than 22.1R1, BGP NSR won't function correctly with TCP keychain authentication. To address this, either upgrade to the supported version or, alternatively, disable TCP keychain authentication for BGP to ensure proper NSR functionality.
Reference: Juniper Release Notes - Keychain Mechanism Support