Verification

Verification

BIG-IP

Tunnels

Run on each unit for its own tunnels:

tmsh

show net tunnels tunnel xc-ddos-c1t1-v4
show net tunnels tunnel xc-ddos-c1t1-v6
show net tunnels tunnel xc-ddos-c1t2-v4
show net tunnels tunnel xc-ddos-c1t2-v6
show net tunnels tunnel xc-ddos-c2t1-v4
show net tunnels tunnel xc-ddos-c2t1-v6
show net tunnels tunnel xc-ddos-c2t2-v4
show net tunnels tunnel xc-ddos-c2t2-v6
list net tunnels tunnel xc-ddos-c1t1-v4 all-properties

Self IPs

tmsh

list net self xc-ddos-*

Path Check

From each unit:

tmsh

# BIG-IP-A tunnels
ping xXC_C1_T1_INNER_V4x source xBIGIP_C1_T1_INNER_V4x
ping xXC_C2_T1_INNER_V4x source xBIGIP_C2_T1_INNER_V4x

# BIG-IP-B tunnels
ping xXC_C1_T2_INNER_V4x source xBIGIP_C1_T2_INNER_V4x
ping xXC_C2_T2_INNER_V4x source xBIGIP_C2_T2_INNER_V4x

BGP

In imish on each unit:

imish

show ip bgp summary
show ipv6 bgp summary
show ip bgp
show ipv6 bgp

# BIG-IP-A neighbors
show ip bgp neighbors xXC_C1_T1_INNER_V4x
show ip bgp neighbors xXC_C2_T1_INNER_V4x
show ip bgp neighbors xXC_C1_T1_INNER_V4x advertised-routes
show ip bgp neighbors xXC_C1_T1_INNER_V4x received-routes

# BIG-IP-B neighbors
show ip bgp neighbors xXC_C1_T2_INNER_V4x
show ip bgp neighbors xXC_C2_T2_INNER_V4x
show ip bgp neighbors xXC_C1_T2_INNER_V4x advertised-routes
show ip bgp neighbors xXC_C1_T2_INNER_V4x received-routes

show ip route
show ipv6 route

Troubleshooting checklist

If BGP does not establish:

1. Verify the GRE tunnel is up: show net tunnels tunnel should show state up.
2. Confirm allow-service includes tcp:179 on the inner self IP.
3. Ping the remote inner IP through the tunnel.
4. Check BGP password matches on both sides (common cause of NOTIFICATION errors).
5. Verify prefix-lists and route-maps are applied correctly.
6. Check show ip bgp neighbors <IP> for the last error/reset reason.
7. On each HA unit, verify the unit’s own tunnels are up and its own BGP neighbors are configured (not the other unit’s).

XC Console

Navigate to DDoS and Transit Services > DDoS Protection > Visibility to see:

• Traffic by network, zone, application.
• Blocked vs. allowed traffic.
• Attack details and scrubbing actions.