Redistribution Loop: show ip route When Two Protocols Bounce the Same Prefix

Cisco routing · Techclick CLI troubleshooting lab

A prefix flips OSPF-to-BGP-to-OSPF. CPU climbs. Traceroute is a circle.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco routing for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Mutual redistribution without tags or filters loops. Tag on the way out, deny tagged on the way back.

Why this ticket shows up

Each protocol trusts the other. Without a tag, the same prefix is re-injected forever.

Symptoms operators actually see

• Route source flips

• TTL expiry in a loop

• CPU high on two ABRs/ASBRs

• No route-map tags

CLI first — copy this block

Run these on the Cisco routing device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show ip route 10.9.0.0
show ip ospf database external 10.9.0.0
show ip bgp 10.9.0.0
show route-map
debug ip routing

How to read that output

If the same prefix is OSPF external on one box and BGP on the other, and they redistribute both ways, you have a loop.

Triage order

1. Identify both redistribution points

2. Apply tags (e.g. tag 110 for OSPF-origin)

3. Deny tagged prefixes from being redistributed back

4. Clear the routes

5. Confirm a single source

Classic traps

What you see	Real cause	Fix
Add a better metric	It will still loop	Tag/filter
Break one protocol entirely	You can keep both	Filter
Leave debug ip routing on	Console flood	Off after proof

Proof the ticket is closed

• One administrative source

• Stable route

• No circular traceroute

Say this in an interview

Mutual redistribution without tags is a loop factory. I tag out and deny back.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/