CN-Series
Configure Dynamic Routing in CN-Series HSF
Table of Contents
Configure Dynamic Routing in CN-Series HSF
Configure BGP and BGP over BFD dynamic routing protocols in your CN-Series HSF
cluster.
Where Can I Use This? | What Do I Need? |
|---|---|
|
|
CN-Series Hyperscale Security Fabric (HSF)
now introduces dynamic
routing through BGP and BGP over BFD protocols. Using dynamic routing, you can attain
stable, high-performing, and highly available layer 3 routing through profile-based
filtering lists and conditional route maps which can be used across logical routers.
These profiles provide finer granularity to filter routes for each dynamic routing
protocol and improve route redistribution across multiple protocols. BGP looks for the available paths that data could travel and picks the best route, based
on IP prefixes that are available within autonomous systems. The Bidirectional
Forwarding Detection (BFD) configuration manages the CN-GW pods and path failures.
To enable dynamic routing, you will need to configure the Panorama and the CN-Series HSF
cluster. You will need at least 2 CN-MGMTs, 2 CN-NGFWs, 2 CN-DBs and 1 CN-GW in the
cluster. The BGP peering is configured between the CN cluster and the external
router.
On the CN-Series HSF, the dynamic routing will be supported on
PANOS 11.x.x. For information on obtaining PAN-OS 11.0, see
Get the Images and Files for the CN-Series
Deployment
.In the Panorama, you will need to configure the device groups and manage the HSF cluster
through the device group. To configure the HSF cluster, see
Deploy the HSF Cluster
.To configure BGP on the HSF cluster, you will need to perform the following steps:
- Create a static route for CN-GW loopback interface.
- Configure BGP on an advanced routing engine.
- Currently, only IPv4 is supported on BGP routing.
- While creating a peer, ensure that you create a loopback session and provide a loopback IP address for each CN-GW in theAddressingtab.
- (optional) Create BGP routing profiles for authentication, timers, address families, dampening, route redistribution to BGP, and BGP filtering.
- (optional) Create filters for the advanced routing engine, such as access lists, prefix lists, AS Path access lists, community lists, and route maps.
- ClickCommit to Panorama. After the configuration is committed to Panorama, BGP will be configured to each CN-GW.
To check BGP status, login to CN-MGMT and execute the following commands:
- show advanced-routing bgp summary
- show advanced-routing bgp peer status
- show advanced-routing bgp peer details
To check BFD status from CN-MGMT, execute the following commands
- show advanced-routing bfd summary
- show advanced-routing bfd details
