Description

Seeing BGP connection attempts in the message log from neighbors not configured

Symptoms

Logs: 

Dec 26 16:34:18 MX02 rpd[13842]: bgp_peer_addr_ok: Connection attempt from unconfigured neighbor: 167.94.145.57+49728

 

Dec 26 16:34:18 MX02 rpd[13842]: bgp_listen_accept:7492: NOTIFICATION sent to 167.94.145.57+49728 (proto): code 6 (Cease) subcode 5 (Connection Rejected), Reason: Connection attempt from unconfigured neighbor: 167.94.145.57+49728

 

Dec 26 22:27:27 MX02 rpd[13842]: bgp_peer_addr_ok: Connection attempt from unconfigured neighbor: 205.210.31.108+50122

 

Dec 26 22:27:27 MX02 rpd[13842]: bgp_listen_accept:7492: NOTIFICATION sent to 205.210.31.108+50122 (proto): code 6 (Cease) subcode 5 (Connection Rejected), Reason: Connection attempt from unconfigured neighbor: 205.210.31.108+50122

 

Solution

The cause of the logs above is due to the incorrect IP configuration in the prefix list for BGP-IN.

 

As you can see, in the incorrect configuration; IP 192.16.40.82 was mistakenly configured in the firewall prefix-list. A prefix-list matches the IP source or destination prefixes in the named list. Since source or destination are allowed to be accepted for IP addresses in the list, any attempts for a connection towards the destination 192.16.40.82 went through, since it is an allowed IP. Thus, generating the log above indicates BGP attempts towards 192.16.40.82.
 

set routing-instances vr protocols bgp group point local-address 192.16.40.82

set routing-instances vr protocols bgp group point neighbor 192.16.40.81

 

Incorrect IP configuration: set policy-options prefix-list BGP-IN 192.16.40.82/32

Correct IP configuration: set policy-options prefix-list BGP-IN 192.16.40.81/32

 

set firewall family inet filter RE-IN term BGP from prefix-list BGP-IN

set firewall family inet filter RE-IN term BGP from protocol tcp

set firewall family inet filter RE-IN term BGP from port 179

set firewall family inet filter RE-IN term BGP then accept

Modification History

2024-02-21 : Article Created