Configure Dynamic Routing in CN-Series HSF

Table of Contents

Custom Metric Based HPA Using KEDA in EKS Environments

Configure Dynamic Routing in CN-Series HSF

Configure BGP and BGP over BFD dynamic routing protocols in your CN-Series HSF cluster.

Where Can I Use This?	What Do I Need?
CN-Series HSF firewall deployment	Panorama running with minimum PAN-OS 11.1 version

CN-Series Hyperscale Security Fabric (HSF) now introduces dynamic routing through BGP and BGP over BFD protocols. Using dynamic routing, you can attain stable, high-performing, and highly available layer 3 routing through profile-based filtering lists and conditional route maps which can be used across logical routers. These profiles provide finer granularity to filter routes for each dynamic routing protocol and improve route redistribution across multiple protocols.

BGP looks for the available paths that data could travel and picks the best route, based on IP prefixes that are available within autonomous systems. The Bidirectional Forwarding Detection (BFD) configuration manages the CN-GW pods and path failures.

To enable dynamic routing, you will need to configure the Panorama and the CN-Series HSF cluster. You will need at least 2 CN-MGMTs, 2 CN-NGFWs, 2 CN-DBs and 1 CN-GW in the cluster. The BGP peering is configured between the CN cluster and the external router.

On the CN-Series HSF, the dynamic routing will be supported on PANOS 11.x.x. For information on obtaining PAN-OS 11.0, see Get the Images and Files for the CN-Series Deployment.

In the Panorama, you will need to configure the device groups and manage the HSF cluster through the device group. To configure the HSF cluster, see Deploy the HSF Cluster.

To configure BGP on the HSF cluster, you will need to perform the following steps:

Enable advanced routing.
Configure a logical router.
Create a static route for CN-GW loopback interface.
Configure BGP on an advanced routing engine.
1. Currently, only IPv4 is supported on BGP routing.
2. While creating a peer, ensure that you create a loopback session and provide a loopback IP address for each CN-GW in the Addressing tab.
(optional) Create BGP routing profiles for authentication, timers, address families, dampening, route redistribution to BGP, and BGP filtering.
(optional) Create filters for the advanced routing engine, such as access lists, prefix lists, AS Path access lists, community lists, and route maps.
Click Commit to Panorama. After the configuration is committed to Panorama, BGP will be configured to each CN-GW.