Configure BGP

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessDevice SettingsRoutingLogical Routers and select the Configuration Scope where you want to configure BGP for a logical router.

   You can select a folder or firewall from your Folders or select Snippets to configure BGP for a logical router in a snippet.

   The number of logical routers supported varies based on the firewall model. If you create multiple logical routers for a folder or snippet, verify that the firewalls associated with the folder or snippet support the number of logical routers you configure.
3. Configure a Logical Router.
4. Edit BGP.
5. Enable BGP.
6. Assign a Router ID to the BGP for the logical router.

   The Router ID is typically an IPv4 address to ensure the Router ID is unique.
7. Assign the AS Number.

   The Autonomous System (AS) number is the number of the AS to which the logical router belongs to based on the router ID (range is 1-4,294,967,295).
8. Select a predefined BFD Profile.

   Bidirectional Forwarding Detection (BFD) profiles allow you to apply BFD settings to a static route or routing protocol.
9. Configure a BGP peer group.

   1. Add Peer Group.
   2. Enter the peer group Name and Enable.
   3. Select the peer group Type (IBGP or EBGP).
   4. Select an IPv4 Address Family profile to enable IPv4 route exchange.

      You can configure a New AFI Profile if not already created.
   5. Select an IPv4 Filtering Profile.

      Configure a BGP Filtering Profile if one doesn’t already exist.
10. Add a peer to the BGP peer group.

    1. For the Peers in the BGP Peer Group, Add Peer and enter the peer Name.
    2. Enable the peer.
    3. Enter the Peer AS to which the peer belongs.
    4. Select Addressing.
    5. For Local Address, select the Interface for which you’re configuring BGP.

       If the interface has more than one IP address, enter the IP address for that interface to be the BGP peer.
    6. For the Peer Address, enter the peer IP address.

       The firewall uses only one IPv4 address from the DNS resolution of the FQDN. If the DNS resolution returns more than one address, the firewall uses the preferred IP address that matches the IPv4 family type configured for the BGP peer. The preferred IP address is the first address the DNS server returns in its initial response. The firewall retains this address as preferred as long as the address appears in subsequent responses regardless of its order.
11. (Optional) Configure connection settings for the BGP peer.

    1. Select Connection Options.
    2. Select an Auth Profile for the peer or Inherit an Auth Profile from the BGP Peer Group.

       You can configure a New Auth Profile if one doesn’t already exist.
    3. Select the Timer Profile or Inherit the time profile from the BGP Peer group.
    4. Set the Multi Hop time-to-live (TTL) value in the IP header (range is 0-255; default is 0).

       The default value of zero means 1 for eBGP. The default value of zero means 255 for iBGP.
    5. For the Dampening Profile, select the Default or inherit the dampening profile from the BGP Peer group.

       The default dampening profile values are:

       • Cutoff—1.25
       • Reuse—5
       • Max Hold Time (sec)—900
       • Decay Half Life Reachable (sec)—300
       • Decay Half Life Unreachable—300
12. (Optional) Configure the BGP peer with settings for Bidirectional Forwarding Detection (BFD).

    Bidirectional Forwarding Detection (BFD) profiles allow you to apply BFD settings to a static route or routing protocol.

    1. Select Advanced.
    2. Select the BFD Profile.
13. Save the peer you added to the BGP peer group.
14. Save the BGP Peer Group configuration.
15. Save the logical router configuration.
16. Push Config to push your configuration changes.