5

I have a test environment set up with two Juniper vSRX instances and a L2 network trunked between them and can reach each other on the IP addresses I'm trying to peer them on.

vSRX 1 has an external BGP session and full tables and vSRX 2 is bare; I'm trying to configure an iBGP mesh between them. Both vSRX's have all of their BGP config in a routing instance and not in the base.

I've replaced a publicly routable subnet with 10.0.0.1 in the below configurations.

vSRX 1:

instance-type virtual-router;
interface ge-0/0/0.200;
routing-options {
...
    router-id 10.0.0.1;
    autonomous-system [external-as-number];
}
protocols {
    bgp {
        traceoptions {
            file bgp size 1m files 5;
            flag all;
        }
        log-updown;
        group ibgp-ipv4 {
            type internal;
            local-address 10.0.0.1;
            family inet {
                unicast;
            }
            neighbor 10.0.0.2;
        }
    }
}

vSRX 2:

instance-type virtual-router;
interface ge-0/0/0.200;
interface ge-0/0/1.300;
routing-options {
...
    router-id 10.0.0.2;
    autonomous-system [external-as-number];
}
protocols {
    bgp {
        traceoptions {
            file bgp size 1m files 5;
            flag all;
        }
        log-updown;
...
        group ibgp-ipv4 {
            type internal;
            local-address 10.0.0.2;
            family inet {
                unicast;
            }
            neighbor 10.0.0.1;
        }
    }
}

I've checked firewall policies and have a global catch all policy for bgp to be allowed anywhere

The BGP logs show this, but I can't see any sign of why the TCP session is closed:

task_process_events_internal: connect ready for BGP_[external-as-number]_[external-as-number].10.0.0.2
bgp_connect_complete: error connecting to 10.0.0.2 (Internal AS [external-as-number]): Socket is not connected
bgp_close_socket: peer 10.0.0.2 (Internal AS [external-as-number])
task_close: close socket 43 task BGP_[external-as-number]_[external-as-number].10.0.0.2
task_reset_socket: task BGP_[external-as-number]_[external-as-number].10.0.0.2 socket 43
bgp_event: peer 10.0.0.2 (Internal AS [external-as-number]) old state Connect event OpenFail new state Idle
bgp_event: peer 10.0.0.2 (Internal AS [external-as-number]) old state Idle event Start new state Active

Am I missing something obvious here, or should the session be establishing, even without import / exports etc?

Regards

Improve this question
4

If you're using a vSRX, you will need to add your interfaces into a security zone, and ensure that host-inbound traffic allows BGP eg:

set security zones security-zone PEERING interfaces ge-0/0/0.200
set security zones security-zone PEERING host-inbound-traffic protocols bgp
Improve this answer
2
  • Thanks Benjamin! That worked, although I'm not sure how the external BGP session on vSRX 2 was working without bgp in the host-inbound-traffic for it's respective security zone. – notFound Aug 27 '18 at 23:28
  • you may have been using an interface that was already in a security zone (like trust, which allows every protocol by default), or else the box is operating in packet-mode. – Benjamin Dale Aug 28 '18 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.