BGP sessions down on cr2-esams
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	elukey
	Sep 11 2019, 2:00 PM

Description

BGP WARNING - AS12871/IPv6: Active (for 13d6h), AS28598/IPv6: Connect (for 22d20h)

elukey@re0.cr2-esams> show bgp summary | match 12871
80.249.208.32         12871       7496       7659       0       0 2d 14:26:57 Establ
80.249.208.64         12871          0          0       0       0 2d 14:27:25 Connect
2001:7f8:1::a501:2871:1       12871          0          0       0       1      1w6d6h Active
2001:7f8:1::a501:2871:2       12871     219419     224137       0       0     10w6d4h Establ

{master}
elukey@re0.cr2-esams> show bgp summary | match 28598
80.249.213.207        28598          0          0       0       0 2d 14:27:50 Connect
2001:7f8:1::a502:8598:1       28598          0          0       0       6     3w1d19h Connect

For AS 28598 we have already contacted their NOC but so far no answer. The former is interesting:

80.249.208.32 is listed in peering-db, meanwhile 80.249.208.64 is not (leftover/prev-config?)
2001:7f8:1::a501:2871:1 is listed in peering-db, but apparently :2 is used? (again, leftover?)

Event Timeline

elukey created this task.Sep 11 2019, 2:00 PM

Restricted Application added a project: SRE. · View Herald TranscriptSep 11 2019, 2:00 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

jbond subscribed.Sep 11 2019, 2:03 PM

jbond triaged this task as Medium priority.Sep 11 2019, 2:13 PM

I think it's safe to delete 28598 if they don't reply to your most recent email.

About 12871 you're correct, or they're migrating something. Best is to ask them, then delete the down sessions if no replies.

From AMS-IX ML:

Please remove your BGP sessions to the following IP’s:
AS12871
IPv4: 80.249.208.64
IPv6: 2001:7f8:1::a501:2871:1

Mentioned in SAL (#wikimedia-operations) [2019-09-16T20:55:00Z] <XioNoX> remove 2 sessions to AS12871 on cr2-esams - T232617

@jbond solved AS28598

elukey@re0.cr2-esams> show bgp summary | match 12871
80.249.208.32         12871          0          0       0       1     1w3d20h Active
2001:7f8:1::a501:2871:2       12871          0          0       0       1     1w3d20h Active

This is still alarming, but it should have been removed a while ago.. was it re-added?

Mentioned in SAL (#wikimedia-operations) [2019-10-08T15:30:47Z] <XioNoX> remove 2 more sessions to AS12871 on cr2-esams - T232617

Seems like they had 4 sessions in total.

BGP sessions down on cr2-esamsClosed, ResolvedPublicActions

Description

Event Timeline

BGP sessions down on cr2-esams
Closed, ResolvedPublic
Actions