Configure BGP and BGP over BFD dynamic routing protocols in your CN-Series HSF
Where Can I Use This?
What Do I Need?
CN-Series HSF firewall deployment
running with minimum PAN-OS 11.1 version
CN-Series Hyperscale Security Fabric (HSF)
now introduces dynamic
routing through BGP and BGP over BFD protocols. Using dynamic routing, you can attain
stable, high-performing, and highly available layer 3 routing through profile-based
filtering lists and conditional route maps which can be used across logical routers.
These profiles provide finer granularity to filter routes for each dynamic routing
protocol and improve route redistribution across multiple protocols.
BGP looks for the available paths that data could travel and picks the best route, based
on IP prefixes that are available within autonomous systems. The Bidirectional
Forwarding Detection (BFD) configuration manages the CN-GW pods and path failures.
To enable dynamic routing, you will need to configure the Panorama and the CN-Series HSF
cluster. You will need at least 2 CN-MGMTs, 2 CN-NGFWs, 2 CN-DBs and 1 CN-GW in the
cluster. The BGP peering is configured between the CN cluster and the external
On the CN-Series HSF, the dynamic routing will be supported on
PANOS 11.x.x. For information on obtaining PAN-OS 11.0, see