Configure an Address Family Profile

Configure an Address Family Profile

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessDevice SettingsRoutingProfilesBGP and select the Configuration Scope where you want to configure an address family profile for a BGP configuration.

   You can select a folder or firewall from your Folders or select Snippets to configure an address family profile for a BGP configuration in a snippet.
3. For Address Family Profiles, Add Profile.
4. Enter a Name for the profile.

   The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is supported.
5. Select Unicast or Multicast and Enable.

   Both Unicast and Multicast can be enabled.
6. Enable Soft reconfiguration of peer stored with routes to cause the firewall to perform a soft reset after the settings of any of its BGP peers are updated.

   This setting is enabled by default.
7. Enable Advertise all paths to peer to have BGP advertise all known paths to its neighbor in order to preserve multipath capabilities inside a network.
8. Enable Advertise the best path per each neighboring AS to have BGP advertise the best known paths to neighbors in order to preserve multipath capabilities inside a network.

   Disable this if you want to advertise the same path to all autonomous systems.
9. Enable Override ASNs in outbound updates if AS-Path equals Remote-AS.

   This setting is helpful if you have multiple sites belonging to the same AS number (AS 64512, for example) and there’s another AS between them. A router between the two sites receives an Update advertising a route that can access AS 64512. To avoid the second site dropping the Update because it’s also in AS 64512, the intermediate router replaces AS 64512 with its own AS number (ASN), AS 64522, for example.
10. Enable Route Reflector Client to make the BGP peer a route reflector in an iBGP network.
11. Select the Default Originate Route Map used in the default originate configuration.
12. Allow AS In:

    • Origin—Accept routes even if the firewall’s own AS is present in the AS_PATH.
    • Occurrence—Number of times the firewall’s own AS can be in the AS_PATH.
    • None (default)—No action taken.
13. Enter the maximum Number Prefix to accept (learn) from the peer.

    Range is 1-4,294,9677,295. Default is 1,000.
14. Enter the Threshold (percentage) of the maximum number of prefixes added to the BGP local RIB.

    If the peer advertises more than the threshold, the firewall takes the specified Rule Type action. Range is 1-100. Default is 100.
15. Select the Rule Type action for when the number prefix threshold is exceeded.

    • Warning Only (default)—A system log is generated.
    • Restart—The BGP peer connection is restarted.
16. Select the Next Hop.

    • Self—Causes the firewall to change the Next Hop address (in Updates it receives) to its own IP address in the Update before sending it on. This is helpful when the firewall is communicating with an eBGP router (in another AS) and with an IBGP router (in its own AS). For example, suppose the Next Hop address in a BGP Update that arrives at AS 64512 is the IP address of the egress interface of Router 2 where the Update egressed AS 64518. The Update indicates that to reach networks that Router 2 is advertising, use the Next Hop address of Router 2. However, if the firewall sends that Update to an iBGP neighbor in AS 64512, the unchanged Next Hop of Router 2 is outside AS 64512 and the iBGP neighbor doesn’t have a route to it. When you select Self, the firewall changes the Next Hop to its own IP address so that an iBGP neighbor can use that Next Hop to reach the firewall, which in turn can reach the eBGP router.
    • Self Force—Force set the Next Hop to self for the reflected routes.
    • None (default)—Keep the original Next Hop in the attribute.
17. Set Remove Private As to have BGP remove private AS numbers from the AS_PATH attribute in Updates that the firewall sends to a peer in another AS.

    • All—Remove all private AS numbers.
    • Replace AS—Replace all private AS numbers with the firewall AS number.
    • None (default)—No action taken.
18. Set Send Community to select the type of BGP community attributes to send in outbound Update packets.

    • All—Send all communities.
    • Both—Send standard and extended communities.
    • Extended—Send extended communities (RFC 4360).
    • Large—Send large communities (RFC 8092).
    • Standard—Send standard communities (RFC 1997).
    • None (default)—Don’t send any communities.
19. Set the ORF List to advertise the ability of the peer group or peer to send a prefix list and or receive a prefix list to implement outbound route filtering (ORF) at the source. This minimizes sending or receiving unwanted prefixes in Updates.

    • None (default)—The peer group or peer (where this AFI profile is applied) has no ORF capability.
    • Both—Advertise that the peer group or peer (where this AFI profile is applied) can send a prefix list and receive a prefix list to implement ORF.
    • Receive—Advertise that the peer group or peer (where this AFI profile is applied) can receive a prefix list to implement ORF. The local peer receives the remote peer’s ORF capability and prefix list, which it implements as an outbound route filter.
    • Send—Advertise that the peer group or peer (where this AFI profile is applied) can send a prefix list to implement ORF. The remote peer (with receive capability) receives the ORF capability and implements the prefix list it received as an outbound route filter when advertising routes to the sender.
20. Save.
21. Configure BGP.