Checklist and troubleshooting

Before you turn it up

• Interfaces addressed and described; the provider's and IX's addresses and AS numbers double-checked.
• Your aggregate anchored with a blackhole route, and originated with network.
• An export route-map on every eBGP neighbor that permits only your prefixes. Check advertised-routes before telling anyone it's done.
• An import route-map on every neighbor: bogons, your own space, too-specifics, then set local preference.
• maximum-prefix on every neighbor.
• MD5 passwords where the provider or IX requires them.
• Route objects in the IRR and ROAs in RPKI for your prefix, so upstreams and route servers accept it (see the IRR and RPKI lessons).
• SSH bound to a management address, key login only, and an input firewall that allows SSH from management networks and BGP from neighbors only.
• commit, test, then save. On a remote router, use commit-confirm 5: if you lock yourself out, VyOS rolls back after five minutes unless you confirm.

When it doesn't work

Symptom	Look at	Usual cause
Session stuck in Active or Connect	show ip bgp summary, ping the neighbor	Wrong neighbor address or AS, interface down, MD5 mismatch, firewall dropping TCP 179
Session Established but PfxRcd 0	received-routes vs routes	Your import map denies everything, or the neighbor's export policy sends nothing
Session up, but the neighbor sees nothing from you	advertised-routes	Export map doesn't match your prefix, or there's no network statement
Neighbor sees your prefix, the internet doesn't	The upstream's looking glass, IRR and RPKI	Missing route object or ROA, so the upstream filters you
(Policy) or Idle (PfxCt) in the summary	show ip bgp neighbors <peer>	Policy missing where required, or maximum-prefix exceeded. Clear the session after fixing the cause
Routes in BGP but traffic goes the wrong way	show ip route <dest>, local preference	Missing or wrong local preference, or a more specific route elsewhere

Where next

This is a single router doing everything. The next step, in the following lesson, splits it into edge routers that talk to the outside world and a core that carries traffic inside your network.