Page MenuHomeVyOS Platform

prefix-list and/or route-map not configured before referencing BGP neighbor is configured (BGP session established before filters applied)
Closed, DuplicatePublicBUG


Our VyOS config is relatively large:

  • dozens of BGP sessions
  • dozens of route-maps and prefix-lists
  • potentially tens of thousands of entries in route-maps and prefix-lists (auto-generated via bgpq3)

After a reboot of a router (with multiple transit and peering sessions), we found numerous peerings would not come up. We still have a couple down, and they are showing as tripped because:

Connections established 1; dropped 1
Last reset 04:44:43, due to NOTIFICATION received (Cease/Maximum Number of Prefixes Reached)

Cloudflare NOC emailed to say:

- IP: - Manchester, GB - Number of prefixes received when sessions went down: 401.

This seemed strange to us, because the affected peers above have the same prefix-list out and route-map out applied that they had before a reboot. And the same prefix-list out and route-map out as many other peers, so should only be receiving ~20 prefixes right now:

show ip bgp neigh advertised-routes
Total number of prefixes 14

I assume, therefore that just like in T944, the BGP neighbor is established before when any referenced route-map and prefix-list is configured.


Difficulty level
Unknown (require assessment)
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

maznu created this task.Sep 29 2019, 9:23 AM
maznu updated the task description. (Show Details)
pasik added a subscriber: pasik.Sep 29 2019, 11:23 AM
njh added a subscriber: njh.Feb 4 2020, 9:47 AM

To reproduce it in a test lab.
R1 Originate 1000 prefixes
R2 import 1000 and export 40 prefixes to R3
R3 prefix-limit 40 prefixes.

reboot R2
After rebooting on R3

Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd     4      65002      50      44        0    0    0 00:00:02 Idle (PfxCt)

maznu added a comment.May 6 2020, 12:44 PM

The good news is that this can be fixed with:

set protocols bgp 65432 parameters default no-ipv4-unicast

…and making sure you specify ipv4-unicast with route-maps and prefix-lists on all peers.

I believe this is the default now for 1.3?

@maznu I think this will be the default only after BGP switches to a new XML/python format.

I confirm that this can be mitigated by:

  1. add to ALL ipv4 peers "address-family ipv4-unicast" set
set protocols bgp xxxxxx neighbor x.x.x.x address-family ipv4-unicast
  1. disable default ipv4 peering
set protocols bgp xxxxxx parameters default no-ipv4-unicast

Duplicated with T1945