Monitor the BGP Service

The Cumulus NetQ UI enables operators to view the health of the BGP service on a network-wide and a per session basis, giving greater insight into all aspects of the service. This is accomplished through two card workflows, one for the service and one for the session. They are described separately here.

Monitor the BGP Service (All Sessions)

With NetQ, you can monitor the number of nodes running the BGP service, view switches with the most established and unestablished BGP sessions, and view alarms triggered by the BGP service. For an overview and how to configure BGP to run in your data center network, refer to Border Gateway Protocol - BGP.

BGP Service Card Workflow

The small BGP Service card displays:

Item	Description
	Indicates data is for all sessions of a Network Service or Protocol
Title	BGP: All BGP Sessions, or the BGP Service
	Total number of switches and hosts with the BGP service enabled during the designated time period
	Total number of BGP-related alarms received during the designated time period
Chart	Distribution of new BGP-related alarms received during the designated time period

The medium BGP Service card displays:

Item	Description
Time period	Range of time in which the displayed data was collected; applies to all card sizes
	Indicates data is for all sessions of a Network Service or Protocol
Title	Network Services | All BGP Sessions
	Total number of switches and hosts with the BGP service enabled during the designated time period
	Total number of BGP-related alarms received during the designated time period
Total Nodes Running chart	Distribution of switches and hosts with the BGP service enabled during the designated time period, and a total number of nodes running the service currently. Note: The node count here may be different than the count in the summary bar. For example, the number of nodes running BGP last week or last month might be more or less than the number of nodes running BGP currently.
Total Open Alarms chart	Distribution of BGP-related alarms received during the designated time period, and the total number of current BGP-related alarms in the network. Note: The alarm count here may be different than the count in the summary bar. For example, the number of new alarms received in this time period does not take into account alarms that have already been received and are still active. You might have no new alarms, but still have a total number of alarms present on the network of 10.
Total Nodes Not Est. chart	Distribution of switches and hosts with unestablished BGP sessions during the designated time period, and the total number of unestablished sessions in the network currently. Note: The node count here may be different than the count in the summary bar. For example, the number of unestablished session last week or last month might be more of less than the number of nodes with unestablished sessions currently.

The large BGP service card contains two tabs.

The Sessions Summary tab displays:

Item	Description
Time period	Range of time in which the displayed data was collected; applies to all card sizes
	Indicates data is for all sessions of a Network Service or Protocol
Title	Sessions Summary (visible when you hover over card)
	Total number of switches and hosts with the BGP service enabled during the designated time period
	Total number of BGP-related alarms received during the designated time period
Total Nodes Running chart	Distribution of switches and hosts with the BGP service enabled during the designated time period, and a total number of nodes running the service currently. Note: The node count here may be different than the count in the summary bar. For example, the number of nodes running BGP last week or last month might be more or less than the number of nodes running BGP currently.
Total Nodes Not Est. chart	Distribution of switches and hosts with unestablished BGP sessions during the designated time period, and the total number of unestablished sessions in the network currently. Note: The node count here may be different than the count in the summary bar. For example, the number of unestablished session last week or last month might be more of less than the number of nodes with unestablished sessions currently.
Table/Filter options	When the Switches with Most Sessions filter option is selected, the table displays the switches and hosts running BGP sessions in decreasing order of session count-devices with the largest number of sessions are listed first When the Switches with Most Unestablished Sessions filter option is selected, the table switches and hosts running BGP sessions in decreasing order of unestablished sessions-devices with the largest number of unestablished sessions are listed first
Show All Sessions	Link to view data for all BGP sessions in the full screen card

The Alarms tab displays:

Item	Description
Time period	Range of time in which the displayed data was collected; applies to all card sizes
(in header)	Indicates data is for all alarms for all BGP sessions
Title	Alarms (visible when you hover over card)
	Total number of switches and hosts with the BGP service enabled during the designated time period
(in summary bar)	Total number of BGP-related alarms received during the designated time period
Total Alarms chart	Distribution of BGP-related alarms received during the designated time period, and the total number of current BGP-related alarms in the network. Note: The alarm count here may be different than the count in the summary bar. For example, the number of new alarms received in this time period does not take into account alarms that have already been received and are still active. You might have no new alarms, but still have a total number of alarms present on the network of 10.
Table/Filter options	When the selected filter option is Switches with Most Alarms, the table displays switches and hosts running BGP in decreasing order of the count of alarms-devices with the largest number of BGP alarms are listed first
Show All Sessions	Link to view data for all BGP sessions in the full screen card

The full screen BGP Service card provides tabs for all switches, all sessions, and all alarms.

Item	Description
Title	Network Services | BGP
	Closes full screen card and returns to workbench
Time period	Range of time in which the displayed data was collected; applies to all card sizes; select an alternate time period by clicking
	Displays data refresh status. Click to pause data refresh. Click to resume data refresh. Current refresh rate is visible by hovering over icon.
Results	Number of results found for the selected tab
All Switches tab	Displays all switches and hosts running the BGP service. By default, the device list is sorted by hostname. This tab provides the following additional data about each device: Agent State: Indicates communication state of the NetQ Agent on a given device. Values include Fresh (heard from recently) and Rotten (not heard from recently). Version: Software version number of the NetQ Agent on a given device. This should match the version number of the NetQ software loaded on your server or appliance; for example, 2.2.0. ASIC Core BW: Maximum sustained/rated bandwidth. Example values include 2.0 T and 720 G. Model: Chip family. Example values include Tomahawk, Trident, and Spectrum. Model Id: Identifier of networking ASIC model. Example values include BCM56960 and BCM56854. Ports: Indicates port configuration of the switch. Example values include 32 x 100G-QSFP28, 48 x 10G-SFP+, and 6 x 40G-QSFP+. Vendor: Manufacturer of the chip. Example values include Broadcom and Mellanox. CPU Arch: Microprocessor architecture type. Values include x86_64 (Intel), ARMv7 (AMD), and PowerPC. Max Freq: Highest rated frequency for CPU. Example values include 2.40 GHz and 1.74 GHz. Model: Chip family. Example values include Intel Atom C2538 and Intel Atom C2338. Nos: Number of cores. Example values include 2, 4, and 8. Disk Total Size: Total amount of storage space in physical disks (not total available). Example values: 10 GB, 20 GB, 30 GB. License State: Indicator of validity. Values include ok and bad. Memory Size: Total amount of local RAM. Example values include 8192 MB and 2048 MB. OS Vendor: Operating System manufacturer. Values include Cumulus Networks, RedHat, Ubuntu, and CentOS. Version: Software version number of the OS. Example values include 3.7.3, 2.5.x, 16.04, 7.1. Version Id: Identifier of the OS version. For Cumulus, this is the same as the Version (3.7.x). Platform Date: Date and time the platform was manufactured. Example values include 7/12/18 and 10/29/2015. MAC: System MAC address. Example value: 17:01:AB:EE:C3:F5. Model: Manufacturer's model name. Examples values include AS7712-32X and S4048-ON. Number: Manufacturer part number. Examples values include FP3ZZ7632014A, 0J09D3. Revision: Release version of the platform Series: Manufacturer serial number. Example values include D2060B2F044919GD000060, CN046MRJCES0085E0004. Vendor: Manufacturer of the platform. Example values include Cumulus Express, Dell, EdgeCore, Lenovo, Mellanox. Time: Date and time the data was collected from device.
All Sessions tab	Displays all BGP sessions network-wide. By default, the session list is sorted by hostname. This tab provides the following additional data about each session: ASN: Autonomous System Number, identifier for a collection of IP networks and routers. Example values include 633284,655435. Conn Dropped: Number of dropped connections for a given session Conn Estd: Number of connections established for a given session DB State: Session state of DB Evpn Pfx Rcvd: Address prefix received for EVPN traffic. Examples include 115, 35. Ipv4, and Ipv6 Pfx Rcvd: Address prefix received for IPv4 or IPv6 traffic. Examples include 31, 14, 12. Last Reset Time: Date and time at which the session was last established or reset Objid: Object identifier for service OPID: Customer identifier. This is always zero. Peer ASN: Autonomous System Number for peer device Hostname: User-defined name for peer device Name: Interface name or hostname of peer device Router Id: IP address of router with access to the peer device Reason: Text describing the cause of, or trigger for, an event Rx and Tx Families: Address families supported for the receive and transmit session channels. Values include ipv4, ipv6, and evpn. State: Current state of the session. Values include Established and NotEstd (not established). Timestamp: Date and time session was started, deleted, updated or marked dead (device is down) Upd8 Rx: Count of protocol messages received Upd8 Tx: Count of protocol messages transmitted Up Time: Number of seconds the session has been established, in EPOCH notation. Example: 1550147910000 Vrf: Name of the Virtual Route Forwarding interface. Examples: default, mgmt, DataVrf1081 Vrfid: Integer identifier of the VRF interface when used. Examples: 14, 25, 37
All Alarms tab	Displays all BGP events network-wide. By default, the event list is sorted by time, with the most recent events listed first. The tab provides the following additional data about each event: Source: Hostname of network device that generated the event Message: Text description of a BGP-related event. Example: BGP session with peer tor-1 swp7 vrf default state changed from failed to Established Type: Network protocol or service generating the event. This always has a value of bgp in this card workflow. Severity: Importance of the event. Values include critical, warning, info, and debug.
Table Actions	Select, export, or filter the list. Refer to Table Settings.

View Service Status Summary

A summary of the BGP service is available from the Network Services card workflow, including the number of nodes running the service, the number of BGP-related alarms, and a distribution of those alarms.

To view the summary, open the small BGP Service card.

For more detail, select a different size BGP Service card.

View the Distribution of Sessions and Alarms

It is useful to know the number of network nodes running the BGP protocol over a period of time, as it gives you insight into the amount of traffic associated with and breadth of use of the protocol. It is also useful to compare the number of nodes running BGP with unestablished sessions with the alarms present at the same time to determine if there is any correlation between the issues and the ability to establish a BGP session.

To view these distributions, open the medium BGP Service card.

If a visual correlation is apparent, you can dig a little deeper with the large BGP Service card tabs.

View Devices with the Most BGP Sessions

You can view the load from BGP on your switches and hosts using the large Network Services card. This data enables you to see which switches are handling the most BGP traffic currently, validate that is what is expected based on your network design, and compare that with data from an earlier time to look for any differences.

To view switches and hosts with the most BGP sessions:

1. Open the large BGP Service card.

2. Select Switches With Most Sessions from the filter above the table.

   The table content is sorted by this characteristic, listing nodes running the most BGP sessions at the top. Scroll down to view those with the fewest sessions.

   

To compare this data with the same data at a previous time:

1. Open another large BGP Service card.

2. Move the new card next to the original card if needed.

3. Change the time period for the data on the new card by hovering over the card and clicking .

4. Select the time period that you want to compare with the original time. We chose Past Week for this example.

   

   

   You can now see whether there are significant differences between this time and the original time. If the changes are unexpected, you can investigate further by looking at another timeframe, determining if more nodes are now running BGP than previously, looking for changes in the topology, and so forth.

View Devices with the Most Unestablished BGP Sessions

You can identify switches and hosts that are experiencing difficulties establishing BGP sessions; both currently and in the past.

To view switches with the most unestablished BGP sessions:

1. Open the large BGP Service card.

2. Select Switches with Most Unestablished Sessions from the filter above the table.

   The table content is sorted by this characteristic, listing nodes with the most unestablished BGP sessions at the top. Scroll down to view those with the fewest unestablished sessions.

   

Where to go next depends on what data you see, but a couple of options include:

• Change the time period for the data to compare with a prior time.

  If the same switches are consistently indicating the most unestablished sessions, you might want to look more carefully at those switches using the Switches card workflow to determine probable causes. Refer to Monitor Switches.

• Click Show All Sessions to investigate all BGP sessions with events in the full screen card.

View Devices with the Most BGP-related Alarms

Switches or hosts experiencing a large number of BGP alarms may indicate a configuration or performance issue that needs further investigation. You can view the devices sorted by the number of BGP alarms and then use the Switches card workflow or the Alarms card workflow to gather more information about possible causes for the alarms.

To view switches with the most BGP alarms:

1. Open the large BGP Service card.

2. Hover over the header and click .

3. Select Switches with Most Alarms from the filter above the table.

   The table content is sorted by this characteristic, listing nodes with the most BGP alarms at the top. Scroll down to view those with the fewest alarms.

   

Where to go next depends on what data you see, but a few options include:

• Change the time period for the data to compare with a prior time.

  If the same switches are consistently indicating the most alarms, you might want to look more carefully at those switches using the Switches card workflow.

• Click Show All Sessions to investigate all BGP sessions with events in the full screen card.

View All BGP Events

The BGP Network Services card workflow enables you to view all of the BGP events in the designated time period.

To view all BGP events:

1. Open the full screen BGP Service card.

2. Click All Alarms tab in the navigation panel.

   By default, events are listed in most recent to least recent order.

   

Where to go next depends on what data you see, but a couple of options include:

• Sort the list by message to see how many devices have had the same issue.
• Open one of the other full screen tabs in this flow to focus on devices or sessions.
• Export the data for use in another analytics tool, by clicking and providing a name for the data file.

To return to your workbench, click in the top right corner.

View Details for All Devices Running BGP

You can view all stored attributes of all switches and hosts running BGP in your network in the full screen card.

To view all device details, open the full screen BGP Service card and click the All Switches tab.

To return to your workbench, click in the top right corner.

View Details for All BGP Sessions

You can view all stored attributes of all BGP sessions in your network in the full-screen card.

To view all session details, open the full screen BGP Service card and click the All Sessions tab.

To return to your workbench, click in the top right corner.

Use the icons above the table to select/deselect, filter, and export items in the list. Refer to Table Settings for more detail.

To return to original display of results, click the associated tab.

Monitor a Single BGP Session

With NetQ, you can monitor a single session of the BGP service, view session state changes, and compare with alarms occurring at the same time, as well as monitor the running BGP configuration and changes to the configuration file. For an overview and how to configure BGP to run in your data center network, refer to Border Gateway Protocol - BGP.

Granularity of Data Shown Based on Time Period

On the medium and large single BGP session cards, the status of the sessions is represented in heat maps stacked vertically; one for established sessions, and one for unestablished sessions. Depending on the time period of data on the card, the number of smaller time blocks used to indicate the status varies. A vertical stack of time blocks, one from each map, includes the results from all checks during that time. The results are shown by how saturated the color is for each block. If all sessions during that time period were established for the entire time block, then the top block is 100% saturated (white) and the not established block is zero percent saturated (gray). As sessions that are not established increase in saturation, the sessions that are established block is proportionally reduced in saturation. An example heat map for a time period of 24 hours is shown here with the most common time periods in the table showing the resulting time blocks.

BGP Session Card Workflow Summary

The small BGP Session card displays:

Item	Description
	Indicates data is for a single session of a Network Service or Protocol
Title	BGP Session
	Hostnames of the two devices in a session. Arrow points from the host to the peer.
,	Current status of the session, either established or not established

The medium BGP Session card displays:

Item	Description
Time period	Range of time in which the displayed data was collected; applies to all card sizes
	Indicates data is for a single session of a Network Service or Protocol
Title	Network Services | BGP Session
	Hostnames of the two devices in a session. Arrow points in the direction of the session.
,	Current status of the session, either established or not established
Time period for chart	Time period for the chart data
Session State Changes Chart	Heat map of the state of the given session over the given time period. The status is sampled at a rate consistent with the time period. For example, for a 24 hour period, a status is collected every hour. Refer to Granularity of Data Shown Based on Time Period.
Peer Name	Interface name on or hostname for peer device
Peer ASN	Autonomous System Number for peer device
Peer Router ID	IP address of router with access to the peer device
Peer Hostname	User-defined name for peer device

The large BGP Session card contains two tabs.

The Session Summary tab displays:

Item	Description
Time period	Range of time in which the displayed data was collected; applies to all card sizes
	Indicates data is for a single session of a Network Service or Protocol
Title	Session Summary (Network Services | BGP Session)
Summary bar	Hostnames of the two devices in a session. Current status of the session-either established , or not established
Session State Changes Chart	Heat map of the state of the given session over the given time period. The status is sampled at a rate consistent with the time period. For example, for a 24 hour period, a status is collected every hour. Refer to Granularity of Data Shown Based on Time Period.
Alarm Count Chart	Distribution and count of BGP alarm events over the given time period.
Info Count Chart	Distribution and count of BGP info events over the given time period.
Connection Drop Count	Number of times the session entered the not established state during the time period
ASN	Autonomous System Number for host device
RX/TX Families	Receive and Transmit address types supported. Values include IPv4, IPv6, and EVPN.
Peer Hostname	User-defined name for peer device
Peer Interface	Interface on which the session is connected
Peer ASN	Autonomous System Number for peer device
Peer Router ID	IP address of router with access to the peer device

The Configuration File Evolution tab displays:

Item	Description
Time period	Range of time in which the displayed data was collected; applies to all card sizes
	Indicates configuration file information for a single session of a Network Service or Protocol
Title	(Network Services | BGP Session) Configuration File Evolution
	Device identifiers (hostname, IP address, or MAC address) for host and peer in session. Click on to open associated device card.
,	Indication of host role, primary or secondary
Timestamps	When changes to the configuration file have occurred, the date and time are indicated. Click the time to see the changed file.
Configuration File	When File is selected, the configuration file as it was at the selected time is shown. When Diff is selected, the configuration file at the selected time is shown on the left and the configuration file at the previous timestamp is shown on the right. Differences are highlighted. Note: If no configuration file changes have been made, only the original file date is shown.

The full screen BGP Session card provides tabs for all BGP sessions and all events.

Item	Description
Title	Network Services | BGP
	Closes full screen card and returns to workbench
Time period	Range of time in which the displayed data was collected; applies to all card sizes
	Displays data refresh status. Click to pause data refresh. Click to resume data refresh. Current refresh rate is visible by hovering over icon.
Results	Number of results found for the selected tab
All BGP Sessions tab	Displays all BGP sessions running on the host device. This tab provides the following additional data about each session: ASN: Autonomous System Number, identifier for a collection of IP networks and routers. Example values include 633284,655435. Conn Dropped: Number of dropped connections for a given session Conn Estd: Number of connections established for a given session DB State: Session state of DB Evpn Pfx Rcvd: Address prefix for EVPN traffic. Examples include 115, 35. Ipv4, and Ipv6 Pfx Rcvd: Address prefix for IPv4 or IPv6 traffic. Examples include 31, 14, 12. Last Reset Time: Time at which the session was last established or reset Objid: Object identifier for service OPID: Customer identifier. This is always zero. Peer ASN: Autonomous System Number for peer device Hostname: User-defined name for peer device Name: Interface name or hostname of peer device Router Id: IP address of router with access to the peer device Reason: Event or cause of failure Rx and Tx Families: Address families supported for the receive and transmit session channels. Values include ipv4, ipv6, and evpn. State: Current state of the session. Values include Established and NotEstd (not established). Timestamp: Date and time session was started, deleted, updated or marked dead (device is down) Upd8 Rx: Count of protocol messages received Upd8 Tx: Count of protocol messages transmitted Up Time: Number of seconds the session has be established, in EPOC notation. Example: 1550147910000 Vrf: Name of the Virtual Route Forwarding interface. Examples: default, mgmt, DataVrf1081 Vrfid: Integer identifier of the VRF interface when used. Examples: 14, 25, 37
All Events tab	Displays all events network-wide. By default, the event list is sorted by time, with the most recent events listed first. The tab provides the following additional data about each event: Message: Text description of a BGP-related event. Example: BGP session with peer tor-1 swp7 vrf default state changed from failed to Established Source: Hostname of network device that generated the event Severity: Importance of the event. Values include critical, warning, info, and debug. Type: Network protocol or service generating the event. This always has a value of bgp in this card workflow.
Table Actions	Select, export, or filter the list. Refer to Table Settings.

View Session Status Summary

A summary of the BGP session is available from the BGP Session card workflow, showing the node and its peer and current status.

To view the summary:

1. Add the Network Services | All BGP Sessions card.

2. Switch to the full screen card.

3. Click the All Sessions tab.

4. Double-click the session of interest. The full screen card closes automatically.

5. Optionally, switch to the small BGP Session card.

   

   

View BGP Session State Changes

You can view the state of a given BGP session from the medium and large BGP Session Network Service cards. For a given time period, you can determine the stability of the BGP session between two devices. If you experienced connectivity issues at a particular time, you can use these cards to help verify the state of the session. If it was not established more than it was established, you can then investigate further into possible causes.

To view the state transitions for a given BGP session, on the medium BGP Session card:

1. Add the Network Services | All BGP Sessions card.

2. Switch to the full screen card.

3. Open the large BGP Service card.

4. Click the All Sessions tab.

5. Double-click the session of interest. The full screen card closes automatically.

   

The heat map indicates the status of the session over the designated time period. In this example, the session has been established for the entire time period.

From this card, you can also view the Peer ASN, name, hostname and router id identifying the session in more detail.

To view the state transitions for a given BGP session on the large BGP Session card, follow the same steps to open the medium BGP Session card and then switch to the large card.

From this card, you can view the alarm and info event counts, Peer ASN, hostname, and router id, VRF, and Tx/Rx families identifying the session in more detail. The Connection Drop Count gives you a sense of the session performance.

View Changes to the BGP Service Configuration File

Each time a change is made to the configuration file for the BGP service, NetQ logs the change and enables you to compare it with the last version. This can be useful when you are troubleshooting potential causes for alarms or sessions losing their connections.

To view the configuration file changes:

1. Open the large BGP Session card.

2. Hover over the card and click to open the BGP Configuration File Evolution tab.

3. Select the time of interest on the left; when a change may have impacted the performance. Scroll down if needed.

4. Choose between the File view and the Diff view (selected option is dark; File by default).

   The File view displays the content of the file for you to review.

   

   The Diff view displays the changes between this version (on left) and the most recent version (on right) side by side. The changes are highlighted, as seen in this example.

   

View All BGP Session Details

You can view all stored attributes of all of the BGP sessions associated with the two devices on this card.

To view all session details, open the full screen BGP Session card, and click the All BGP Sessions tab.

To return to your workbench, click in the top right corner.

View All Events

You can view all of the alarm and info events for the two devices on this card.

To view all events, open the full screen BGP Session card, and click the All Events tab.

To return to your workbench, click in the top right corner.