Focus

Next-Generation Firewall

BGP Conditional Adv Tab

Table of Contents

Filter

Expand All | Collapse All

Next-Generation Firewall Docs

Getting Started
Administration
Networking
Quick Start
Reference
Incidents & Alerts
Release Notes
Select a Document
- PAN-OS 12.1
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 8.1 (EoL)
Help
Select a Document
- PAN-OS 12.1
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 10.2
- PAN-OS 10.1

BGP Import and Export Tabs

BGP Aggregate Tab

BGP Conditional Adv Tab

Network > Virtual Router > BGP > Conditional Adv

A BGP conditional advertisement allows you to control which route to advertise in the event that a preferred route is not available in the local BGP routing table (LocRIB), indicating a peering or reachability failure. This is useful where you want to try to force routes to one AS over another, such as when you have links to the internet through multiple ISPs and you want traffic to be routed to one provider instead of the other except when there is a loss of connectivity to the preferred provider.

For conditional advertisement, you configure a Non Exist filter that specifies the preferred route(s) (Address Prefix) plus any other attributes that identify the preferred route (such as AS Path Regular Expression). If a route matching the Non Exist filter is not found in the local BGP routing table, only then will the firewall allow advertisement of the alternate route (the route to the other, non-preferred provider) as specified in its Advertise filter.

To configure conditional advertisement, select the Conditional Adv tab, Add a conditional advertisement, and configure the values described in the following table.

Virtual routers support only Non-Exist conditional advertisement (advertise routes when specific prefixes are absent from the BGP routing table). To match existing prefixes in the Local RIB (advertise routes when specific prefixes are present), migrate to Logical Routers (Advanced Routing Engine) and create a BGP Filtering Profile with an Exist filter under Conditional Advertisement.

BGP Conditional Advertisement Settings	Configure In	Description
Policy	BGPConditional Adv	Specify a name for this conditional advertisement policy rule.
Enable		Select to enable this conditional advertisement policy rule.
Used By		Add the peer groups that will use this conditional advertisement policy rule.
Non Exist Filter	BGPConditional AdvNon Exist Filters	Use this tab to specify the prefix(es) of the preferred route. This specifies the route that you want to advertise, if it is available in the local BGP routing table. (If a prefix is going to be advertised and matches a Non Exist filter, the advertisement will be suppressed.) Add a Non Exist Filter and specify a name to identify this filter.
Enable		Select to activate the Non Exist filter.
AS Path Regular Expression		Specify a regular expression for filtering AS paths.
Community Regular Expression		Specify a regular expression for filtering community strings.
Extended Community Regular Expression		Specify a regular expression for filtering extended community strings.
MED		Specify a MED value for route filtering (range is 0-4,294,967,295).
Route Table		Specify which route table (unicast, multicast, or both) the firewall will search to see if the matched route is present. If the matched route is not present in that route table, only then will the firewall allow the advertisement of the alternate route.
Address Prefix		Add the exact Network Layer Reachability Information (NLRI) prefix for the preferred route(s).
Next Hop		Specify next hop routers or subnets for filtering the route.
From Peer		Specify peer routers for route filtering.
Advertise Filter	BGPConditional AdvAdvertise Filters	Use this tab to specify the route prefixes that should be advertised to BGP peers only when the condition routes (defined in the Non-Exist filter) do not exist in the local BGP table. If a prefix is to be advertised and does not match a Non Exist filter, the advertisement will occur. Add an advertise filter and specify a name to identify this filter.
Enable		Select to activate the filter.
AS Path Regular Expression		Specify a regular expression for filtering AS paths.
Community Regular Expression		Specify a regular expression for filtering community strings.
Extended Community Regular Expression		Specify a regular expression for filtering extended community strings.
MED		Specify a MED value for route filtering (range is 0-4,294,967,295).
Route Table		Specify which route table the firewall uses when a matched route is to be conditionally advertised: unicast, multicast, or both.
Address Prefix		Add the exact Network Layer Reachability Information (NLRI) prefix for the route to be advertised if the preferred route is not available.
Next Hop		Specify next hop routers or subnets for route filtering.
From Peer		Specify peer routers for route filtering.

BGP Import and Export Tabs

BGP Aggregate Tab

Next-Generation Firewall Docs

BGP Conditional Adv Tab

Next-Generation Firewall Docs

BGP Conditional Adv Tab

Activation and Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

FedRAMP

Hardware Reference

Hardware Quick Start Guides

Virtual ION Deployment

3rd Party Integrations

Best Practices

Experts Corner