BGP Route Advertisement Discrepancy in Secure Access Network Tunnels

• Issue
• Environment
• Resolution
• Step 1: Identify Specific Network Prefixes
• Step 2: Verify Timeline and Pattern
• Step 3: Document BGP Peer Configuration
• Step 4: Review Recent Configuration Changes
• Step 5: Examine Local Routing Table
• Step 6: Validate Secure Access Organization Configuration
• Cause
• Related Content

---

Issue

A Secure Access site-to-site network tunnel that uses Border Gateway Protocol (BGP) is experiencing a route advertisement discrepancy where a configured /23 network prefix is being learned by the BGP peer as a /24 prefix instead. The expected route is configured as a /23 subnet in Secure Access, but the BGP peer is receiving and learning this network with a /24 subnet mask, creating an inconsistency in the routing table between the two BGP peers.

Environment

Cisco Secure Access with Network Tunnels ((Internet Protocol Security (IPSec),, Site-to-Site)

• BGP routing protocol configuration

• Site-to-site VPN tunnel implementation

• Network prefix configuration with /23 and /24 subnets

Resolution

To resolve this BGP route advertisement discrepancy, these troubleshooting and verification sections outline steps that must be performed.

Step 1: Identify Specific Network Prefixes

Determine the exact /23 and /24 prefixes involved in the routing discrepancy. Document which side of the BGP peering relationship is advertising the /24 prefix instead of the expected /23 prefix.

Step 2: Verify Timeline and Pattern

Establish when the issue was first observed and determine whether the problem is continuous or occurs intermittently. This information helps identify potential triggers or patterns related to the routing behavior.

Step 3: Document BGP Peer Configuration

Gather detailed information about the BGP peer device configuration. Identify the specific Network Tunnel name configured in Secure Access that is experiencing this routing discrepancy.

Step 4: Review Recent Configuration Changes

Investigate any recent changes that could have contributed to the issue, including:

• Configuration modifications

• Routing policy updates

• Network Address Translation (NAT) configuration changes

• Software version updates

• Subnet or network addressing changes

Step 5: Examine Local Routing Table

Verify whether a more-specific /24 route exists in the local routing table that could be selected or advertised instead of the configured /23 prefix. This is a common cause of unexpected route advertisements in BGP, where more specific routes take precedence over less specific ones.

Step 6: Validate Secure Access Organization Configuration

Obtain and verify the Secure Access Organization ID to ensure proper access to configuration details and troubleshooting capabilities within the Secure Access management interface.

Cause

The most likely cause of this BGP route advertisement discrepancy is the presence of a more-specific /24 route in the local routing table that is being selected and advertised instead of the configured /23 prefix. BGP follows the longest prefix match rules, where more specific routes (longer subnet masks) are preferred over less specific routes. If a /24 subnet exists within the /23 range, BGP advertises the more specific /24 route to its peers rather than the broader /23 network.

Additional potential causes include routing policy configurations, route filtering, or network address translation (NAT) configurations that can be modifying the advertised prefix length during the BGP route advertisement process.

Related Content

• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
1.0	10-Sep-2026	Initial Release