Description

This article explains a common cause of intermittent BGP flapping when BGP sessions are established over IPsec VPN tunnels.

Symptoms

BGP peering sessions flap intermittently when running over a VPN tunnel.

Solution

In many cases, BGP flaps are not caused by issues within BGP itself but are a result of instability in the underlying IPsec VPN tunnel. If the VPN tunnel experiences interruptions, renegotiations, or downtime, the BGP session built on top of it will also reset.
 

To troubleshoot this issue, correlate the timing of BGP flaps with VPN tunnel events by reviewing IPsec and IKE logs. If VPN logs show events such as:

  • Dead Peer Detection (DPD) failures
  • Negotiation failures
  • SA teardown and re-establishment
  • Rekey events or loss of connectivity with the peer

and these events align with BGP session resets, it indicates that the VPN instability is causing the BGP flapping.

In such cases, focus on stabilizing the VPN tunnel by addressing root causes such as network reachability, peer responsiveness, configuration mismatches, or intermittent connectivity. 

Modification History

2024-08-05 : Article Created