BGP Command : soft-reconfiguration inbound & soft in

When you apply policy changes, they are only applied on routes that are learned after the policy changes have been enacted. This is because BGP is most frequently implemented on links that connect to other ASes - and you can't just force an ISP or another organization to resend their BGP routing table to you. You can force this by running "clear ip bgp *" (every BGP neighbor) or "clear ip bgp A.B.C.D" - but these clear commands actually tear down connections between neighbors and cause communication to cease until the neighbor relations are rebuilt. In the real world where BGP is run - this is a bad thing.

When you perform the "neighbor A.B.C.D soft-reconfiguration inbound" router command - it shuts down the connection (just like a hard reset). When the neighbor resends you it's routing table, BGP stores a copy of the received routing table in memory. This 2nd copy takes up memory, but it serves a useful purpose. Now, when you apply policy changes to a neighbor or out a particular interface, you can configure "clear ip bgp * (or A.B.C.D) soft in" and run the saved copy of the neighbor's routes through your new bgp policy filters. You can make policy changes all you want and your neighbor never has to resend you its routing table, and you never have to tear down the connection between you and disrupt network communication. 

EIGRP, OSPF, RIP, IGRP - If you apply a policy change (ACL, Distribute List, Route Map, whatever) - that change takes place instantly (instantly + the time to propogate the change and implement the policy). BGP acts differently - it waits until it receives new routes through its new filters. That's why the "soft-reconfiguration inbound" command was created.

R6#sh ip bgp nei 46.46.46.46 received-routes
% Inbound soft reconfiguration not enabled on 46.46.46.46


R6(config-router)#neighbor 46.46.46.46 soft-reconfiguration inbound

R6#sh ip bgp nei 46.46.46.46 received-routes

BGP table version is 3, local router ID is 6.6.6.6

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*>i4.4.4.4/32       46.46.46.46              0    100      0 i

Total number of prefixes 1

Find out Linux CPU Utilization on Checkpoint Firewall

1. Top Command

top - 10:57:46 up 3 min,  2 users,  load average: 1.24, 0.86, 0.35
Tasks:  66 total,   3 running,  63 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.0%us,  0.3%sy,  0.0%ni, 99.0%id,  0.7%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:   1032044k total,   565316k used,   466728k free,    13536k buffers
Swap:  2128604k total,        0k used,  2128604k free,   238368k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
 5523 root      15   0 98584  31m  14m S  0.3  3.1   0:00.97 SVRServer
    1 root      15   0  1648  536  468 S  0.0  0.1   0:00.50 init
    2 root      RT  -5     0    0    0 S  0.0  0.0   0:00.00 migration/0
    3 root      15   0     0    0    0 S  0.0  0.0   0:00.00 ksoftirqd/0
    4 root      RT  -5     0    0    0 S  0.0  0.0   0:00.00 watchdog/0
    5 root      10  -5     0    0    0 S  0.0  0.0   0:00.00 events/0
    6 root      10  -5     0    0    0 S  0.0  0.0   0:00.00 khelper
    7 root      11  -5     0    0    0 S  0.0  0.0   0:00.00 kthread
    8 root      RT  -5     0    0    0 D  0.0  0.0   0:00.00 kmem_kthread
   11 root      10  -5     0    0    0 S  0.0  0.0   0:00.04 kblockd/0
   12 root      20  -5     0    0    0 S  0.0  0.0   0:00.00 kacpid
  176 root      19  -5     0    0    0 S  0.0  0.0   0:00.00 cqueue/0
  179 root      19  -5     0    0    0 S  0.0  0.0   0:00.00 khubd
  181 root      10  -5     0    0    0 S  0.0  0.0   0:00.00 kseriod
  244 root      24   0     0    0    0 S  0.0  0.0   0:00.00 pdflush
  245 root      15   0     0    0    0 S  0.0  0.0   0:00.02 pdflush

2. mpstat Command to display each CPU individually utilization

# mpstat
Linux 2.6.18-92cp (CP-FW-1)     05/08/13

10:36:06     CPU   %user   %nice    %sys %iowait    %irq   %soft  %steal   %idle    intr/s
10:36:06     all    8.03    0.00    1.35    0.27    0.03    0.18    0.00   90.14    526.71


# mpstat -P ALL
Linux 2.6.18-92cp (CP-FW-1)     05/08/13

10:36:47     CPU   %user   %nice    %sys %iowait    %irq   %soft  %steal   %idle    intr/s
10:36:47     all    8.03    0.00    1.35    0.27    0.03    0.18    0.00   90.14    526.71
10:36:47       0    7.72    0.00    1.36    0.27    0.03    0.20    0.00   90.42    272.65
10:36:47       1    8.35    0.00    1.35    0.27    0.02    0.16    0.00   89.85    254.06


3. sar Command to display today's CPU activity

# sar
Linux 2.6.18-92cp (CP-FW-1)     05/08/13

00:00:01          CPU     %user     %nice   %system   %iowait    %steal     %idle
00:10:01          all      8.42      0.00      1.65      0.29      0.00     89.64
00:20:01          all      8.47      0.00      1.62      0.33      0.00     89.57
00:30:01          all     10.95      0.00      1.61      0.28      0.00     87.16
00:40:01          all      8.42      0.00      1.64      0.30      0.00     89.64
00:50:01          all      8.43      0.00      1.66      0.26      0.00     89.66
01:00:01          all      8.44      0.00      1.60      0.26      0.00     89.70
01:10:02          all      8.43      0.00      1.67      0.33      0.00     89.57
01:20:01          all      8.44      0.00      1.66      0.25      0.00     89.65
01:30:01          all     10.86      0.00      1.69      0.31      0.00     87.14
01:40:01          all      8.41      0.00      1.63      0.33      0.00     89.62
01:50:01          all      8.41      0.00      1.60      0.29      0.00     89.70
02:00:01          all      8.40      0.00      1.59      0.27      0.00     89.75
02:10:01          all      8.40      0.00      1.64      0.30      0.00     89.67
02:20:01          all      8.40      0.00      1.58      0.28      0.00     89.74
02:30:01          all     10.86      0.00      1.63      0.25      0.00     87.26
02:40:01          all      8.41      0.00      1.62      0.24      0.00     89.73
02:50:01          all      8.41      0.00      1.64      0.34      0.00     89.61
03:00:01          all      8.40      0.00      1.59      0.29      0.00     89.71
03:10:01          all      8.42      0.00      1.60      0.29      0.00     89.68
03:20:01          all      8.41      0.00      1.58      0.31      0.00     89.69
03:30:01          all     10.94      0.00      1.64      0.31      0.00     87.11
03:40:01          all      8.42      0.00      1.62      0.24      0.00     89.72
03:50:01          all      8.42      0.00      1.60      0.36      0.00     89.62
04:00:01          all      8.39      0.00      1.60      0.29      0.00     89.72
04:10:01          all      8.40      0.00      1.62      0.26      0.00     89.72
04:20:01          all      8.40      0.00      1.60      0.30      0.00     89.70
04:30:01          all     10.90      0.00      1.73      0.30      0.00     87.07
04:40:01          all      8.43      0.00      1.67      0.27      0.00     89.63
04:50:01          all      8.43      0.00      1.67      0.28      0.00     89.62
05:00:01          all      8.45      0.00      1.94      0.31      0.00     89.29
05:10:01          all      8.55      0.00      1.99      0.32      0.00     89.15
05:20:02          all      8.47      0.00      1.94      0.30      0.00     89.29
05:30:01          all     10.91      0.00      1.74      0.27      0.00     87.09
05:40:01          all      8.49      0.00      2.19      0.27      0.00     89.05
05:50:01          all      8.43      0.00      1.64      0.26      0.00     89.68
06:00:01          all      8.41      0.00      1.71      0.29      0.00     89.58
06:10:01          all      8.43      0.00      1.61      0.27      0.00     89.69
06:20:01          all      8.41      0.00      1.61      0.28      0.00     89.70
06:30:01          all     10.92      0.00      1.65      0.36      0.00     87.08
06:40:01          all      8.53      0.00      2.00      0.30      0.00     89.16
06:50:01          all      8.42      0.00      1.71      0.33      0.00     89.55
07:00:01          all      8.43      0.00      1.59      0.27      0.00     89.71
07:10:01          all      8.44      0.00      1.60      0.28      0.00     89.69
07:20:01          all      8.42      0.00      1.63      0.27      0.00     89.68
07:30:01          all     10.84      0.00      1.61      0.31      0.00     87.24
07:40:01          all      8.44      0.00      1.61      0.27      0.00     89.69
07:50:01          all      8.45      0.00      1.63      0.27      0.00     89.66
08:00:01          all      8.46      0.00      1.65      0.25      0.00     89.64
08:10:01          all      8.41      0.00      1.60      0.29      0.00     89.70
08:20:01          all      8.39      0.00      1.60      0.30      0.00     89.71
08:30:01          all     10.88      0.00      1.61      0.29      0.00     87.22
08:40:01          all      8.42      0.00      1.65      0.27      0.00     89.66
08:50:01          all      8.42      0.00      1.59      0.28      0.00     89.71
09:00:01          all      8.41      0.00      1.60      0.25      0.00     89.73
09:10:01          all      8.43      0.00      1.60      0.30      0.00     89.67
09:20:01          all      8.41      0.00      1.64      0.29      0.00     89.66
09:30:02          all     10.86      0.00      1.62      0.25      0.00     87.27
09:40:01          all      8.50      0.00      1.61      0.32      0.00     89.58
09:50:01          all      8.44      0.00      1.59      0.33      0.00     89.63
10:00:01          all      8.41      0.00      1.63      0.28      0.00     89.68
10:10:01          all      8.39      0.00      1.60      0.33      0.00     89.67
10:20:01          all      8.42      0.00      1.58      0.28      0.00     89.72
10:30:01          all     10.87      0.00      1.63      0.37      0.00     87.13
Average:          all      8.86      0.00      1.66      0.29      0.00     89.19

sar -u 2 5 to display comparison of CPU utilization; 2 seconds apart; 5 times,

# sar -u 2 5

Linux 2.6.18-92cp (CP-FW-1)     05/08/13

10:38:11          CPU     %user     %nice   %system   %iowait    %steal     %idle

10:38:13          all      0.25      0.00      1.50      0.25      0.00     98.00

10:38:15          all      0.25      0.00      1.00      0.25      0.00     98.50

10:38:17          all      0.25      0.00      1.00      0.25      0.00     98.50

10:38:19          all      0.25      0.00      1.00      0.25      0.00     98.50

10:38:21          all      0.25      0.00      1.75      0.00      0.00     98.00

Average:          all      0.25      0.00      1.25      0.20      0.00     98.30

4. PS command to find out who is monopolizing or eating the CPUs

# ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10

82.0 12192 admin    fw ctl affinity -l -v

%CPU   PID USER     COMMAND

 0.4  5052 admin    /bin/searchd

 0.3  5322 admin    cpd

 0.1 11353 admin    /bin/clish

 0.1  6609 admin    DAService > /opt/CPda/bin/DA.out

 0.1  5054 admin    /bin/monitord

 0.1  3896 admin    [kjournald]

 0.0 24478 admin    /sbin/agetty 9600 ttyS0 vt100

 0.0 24471 admin    /bin/bash /bin/console_agetty

# ps -eo pcpu,pid,user,args | sort -r -k1 | less

%CPU   PID USER     COMMAND

 0.4  5052 admin    /bin/searchd

 0.3  5322 admin    cpd

 0.1 11353 admin    /bin/clish

 0.1  6609 admin    DAService > /opt/CPda/bin/DA.out

 0.1  5054 admin    /bin/monitord

 0.1  3896 admin    [kjournald]

 0.0 24478 admin    /sbin/agetty 9600 ttyS0 vt100

 0.0 24471 admin    /bin/bash /bin/console_agetty

 0.0 19410 admin    /bin/lvmcmd_d

 0.0 19409 nobody   /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

 0.0 19407 nobody   /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

 0.0 19406 nobody   /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

 0.0 19405 nobody   /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

 0.0 19400 admin    /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

 0.0 12314 admin    [less]

 0.0 12313 admin    sort -r -k1

 0.0 12312 admin    ps -eo pcpu,pid,user,args

 0.0 11468 admin    /bin/bash

 0.0 11363 admin    /bin/clishd serving 11353 

 0.0 11302 admin    sshd: admin@pts/2   

 0.0 10036 admin    sleep 3600

 0.0  6728 admin    /sbin/agetty 9600 tty3

 0.0  6723 admin    /sbin/agetty 9600 tty2

 0.0  6721 admin    /sbin/agetty 9600 tty1

 0.0  6601 admin    rtmd

 0.0  5921 admin    in.geod 0

 0.0  5920 admin    dtlsd 0

 0.0  5874 admin    vpnd 0

 0.0  5871 admin    in.aufpd 0

 0.0  5870 admin    in.asessiond 0

 0.0  5652 admin    /bin/routed -N

 0.0  5637 admin    fwd

 0.0  5625 nobody   ci_http_server -j -f /opt/CPsuite-R75.40/fw1/conf/cihs.conf

 0.0  5618 admin    /bin/csh -f /opt/CPsuite-R75.40/fw1/bin/avi_del_tmp_files

 0.0  5612 admin    /opt/CPsuite-R75.40/fw1/bin/cphamcset

 0.0  5344 admin    mpdaemon /opt/CPshrd-R75.40/log/mpdaemon.elg /opt/CPshrd-R75.40/conf/mpdaemon.conf

 0.0  5308 admin    /opt/CPshrd-R75.40/bin/cpwd

 0.0  5275 admin    /opt/CPshrd-R75.40/bin/cprid

 0.0  5255 admin    /bin/csh -fb /opt/CPshrd-R75.40/bin/cprid_wd

 0.0  5216 admin    crond

 0.0  5202 admin    xinetd -stayalive -pidfile /var/run/xinetd.pid

 0.0  5178 admin    /usr/sbin/sshd -4

 0.0  5139 admin    /usr/sbin/acpid

 0.0  5106 admin    /bin/clish -p

 0.0  5105 admin    /bin/frontstage

 0.0  5103 admin    /bin/clishd default server

 0.0  5051 admin    /bin/confd

 0.0  5031 admin    /bin/pm

 0.0  4648 admin    klogd -x -c 1

 0.0  4643 admin    syslogd -m 0 -z 515 -f /var/run/syslog.conf

 0.0  4620 admin    auditd

 0.0  4484 admin    [fw_worker_1]

 0.0  4419 admin    [fw_worker_0]

 0.0  3893 admin    [kjournald]

 0.0   512 admin    /sbin/udevd -d

 0.0   479 admin    [kauditd]

 0.0   452 admin    [kjournald]

 0.0   444 admin    [ksnapd]

 0.0   425 admin    [scsi_eh_1]

 0.0   424 admin    [scsi_eh_0]

 0.0   420 admin    [ata_aux]

 0.0   419 admin    [ata/1]

 0.0   418 admin    [ata/0]

 0.0   383 admin    [kpsmoused]

 0.0   217 admin    [aio/1]

5. iostat command to report CPU statistics and input/output statistics for devices and partitions since last reboot. 

# iostat
Linux 2.6.18-92cp (CP-FW-1)     05/08/13

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           8.03    0.00    1.56    0.27    0.00   90.14

Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
sda              23.67         0.10       203.59    1382468 2879161118
dm-0             15.87         0.05       126.96     681826 1795461872
dm-1             47.55         0.05        76.63     694258 1083698632
dm-2              0.00         0.00         0.00        392          0
dm-3              0.00         0.00         0.00        392          0
dm-4              0.00         0.00         0.00        392          0
dm-5              0.00         0.00         0.00        392          0
dm-6              0.00         0.00         0.00         56          8

# iostat -xtc 5 3  - gives you three outputs every 5 seconds. 

Linux 2.6.18-92cp (CP-FW-1)     05/08/13

Time: 10:44:13

avg-cpu:  %user   %nice %system %iowait  %steal   %idle

           8.03    0.00    1.56    0.27    0.00   90.14

Time: 10:44:18

avg-cpu:  %user   %nice %system %iowait  %steal   %idle

           0.30    0.00    0.80    0.40    0.00   98.50

Time: 10:44:23

avg-cpu:  %user   %nice %system %iowait  %steal   %idle

           0.30    0.00    0.90    0.10    0.00   98.70

Check Cisco Device Interface Throughput with load-interval Command

BGP_1#sh int g0/1   
GigabitEthernet0/1 is up, line protocol is up 
  Hardware is iGbE, address is e02f.6d05.c401 (bia e02f.6d05.c401)
  Internet address is 6.99.9.30/32
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full Duplex, 1Gbps, media type is RJ45
  output flow-control is unsupported, input flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 1463000 bits/sec, 530 packets/sec
  5 minute output rate 2452000 bits/sec, 417 packets/sec
     21277230 packets input, 3855639781 bytes, 0 no buffer
     Received 716 broadcasts (0 IP multicasts)

Check "load" numbers. These are defaulted to a rolling average of 5 minutes and displayed as a factor of 255 (2^8, but counting from 0 not one). So a load of 255/255 would be completely saturated.

You can change this 5 minute default to a 30 second rolling average by going to the interface in question and issuing the command "load-interval 30" This a very useful process when deploying BGP. The tx/rx of course is transmit load versus receive load, which can also be extremely handy in understanding certain traffic issues (BGP load sharing for example).

BGP_1#sh run int g0/1

Building configuration...

Current configuration : 179 bytes

!

interface GigabitEthernet0/1

 description Link with Cogeco BGP

 ip address 6.99.9.30 255.255.255.255

 load-interval 30

 duplex auto

 speed auto

end

BGP_1#show interfaces g0/1

GigabitEthernet0/1 is up, line protocol is up 

  Hardware is iGbE, address is e02f.6d05.c401 (bia e02f.6d05.c401)

  Internet address is 6.99.9.30/32

  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full Duplex, 1Gbps, media type is RJ45

  output flow-control is unsupported, input flow-control is unsupported

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 00:00:06, output 00:00:00, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  30 second input rate 1227000 bits/sec, 469 packets/sec

  30 second output rate 2202000 bits/sec, 357 packets/sec

     21629047 packets input, 3970567808 bytes, 0 no buffer

     Received 727 broadcasts (0 IP multicasts)

BGP_1#show interfaces g0/1 | in drops|bits

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

  30 second input rate 1366000 bits/sec, 562 packets/sec

  30 second output rate 3790000 bits/sec, 524 packets/sec

     0 unknown protocol drops

VRRP and Object Tracking

Having following requirements to configure First Hop Redundancy Protocol for one environment:
1. Use least public ip addresses
2. Track Internet facing interface and BGP routes
3. Primary router is high priority and will be kept active as possible as it can.


Configuration: 



track 1 interface GigabitEthernet0/1 line-protocol
!
track 2 ip route 0.0.0.0 0.0.0.0 reachability
!
track 3 list boolean and
 object 1
 object 2

BGP_1#sh run int g0/0
Building configuration...

Current configuration : 298 bytes
!
interface GigabitEthernet0/0
 ip address 99.46.16.162 255.255.255.192
 shutdown
 duplex auto
 speed auto
 vrrp 1 ip 99.46.16.162
 vrrp 1 timers advertise 3
 vrrp 1 timers learn
 vrrp 1 priority 120
 vrrp 1 authentication cisco
 vrrp 1 track 3 decrement 30
end
BGP_1#sh run int g0/1
Building configuration...

Current configuration : 161 bytes
!
interface GigabitEthernet0/1
 description Link with Cogeco BGP
 ip address 6.9.9.130 255.255.255.252
 ip access-group 100 in
 duplex auto
 speed auto
end

Verification:

BGP_1#show track 
Track 1
  Interface GigabitEthernet0/1 line-protocol
  Line protocol is Up
    1 change, last change 00:07:27
  Tracked by:
    VRRP GigabitEthernet0/0 1
Track 2
  IP route 0.0.0.0 0.0.0.0 reachability
  Reachability is Up (BGP)
    2 changes, last change 00:02:34
  First-hop interface is GigabitEthernet0/1
Track 3
  List boolean and
  Boolean AND is Up
    4 changes, last change 00:02:34
    object 1 Up
    object 2 Up
  Tracked by:
    VRRP GigabitEthernet0/0 1


BGP_1#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 6.9.9.129 to network 0.0.0.0

B*    0.0.0.0/0 [20/0] via 6.9.9.129, 11:05:07
      66.0.0.0/8 is variably subnetted, 4 subnets, 3 masks
C        6.9.9.128/30 is directly connected, GigabitEthernet0/1
L        6.9.9.130/32 is directly connected, GigabitEthernet0/1
C        66.199.44.240/29 is directly connected, GigabitEthernet0/3
L        66.199.44.241/32 is directly connected, GigabitEthernet0/3
S     99.46.16.0/24 [1/0] via 66.199.44.242