Create BGP Routing Profiles (SCM)

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessDevice SettingsRoutingProfilesBGPConfigurationNGFW and Prisma AccessDevice SettingsRoutingProfilesBGP and select the Configuration Scope where you want to configure a profile for a BGP configuration.

   You can select a folder or firewall from your Folders or select Snippets to configure a profile for a BGP configuration in a snippet.
3. For Address Family Profiles, Add Profile.

   1. Enter a Name for the profile.

      The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is supported.
   2. Select Unicast or Multicast and Enable.

      Both Unicast and Multicast can be enabled.
   3. Enable Soft reconfiguration of peer stored with routes to cause the firewall to perform a soft reset after the settings of any of its BGP peers are updated.

      This setting is enabled by default.
   4. Enable Advertise all paths to peer to have BGP advertise all known paths to its neighbor in order to preserve multipath capabilities inside a network.
   5. Enable Advertise the best path per each neighboring AS to have BGP advertise the best known paths to neighbors in order to preserve multipath capabilities inside a network.

      Disable this if you want to advertise the same path to all autonomous systems.
   6. Enable Override ASNs in outbound updates if AS-Path equals Remote-AS.

      This setting is helpful if you have multiple sites belonging to the same AS number (AS 64512, for example) and there’s another AS between them. A router between the two sites receives an Update advertising a route that can access AS 64512. To avoid the second site dropping the Update because it’s also in AS 64512, the intermediate router replaces AS 64512 with its own AS number (ASN), AS 64522, for example.
   7. Enable Route Reflector Client to make the BGP peer a route reflector in an iBGP network.
   8. Select the Default Originate Route Map used in the default originate configuration.
   9. Allow AS In:

      • Origin—Accept routes even if the firewall’s own AS is present in the AS_PATH.
      • Occurrence—Number of times the firewall’s own AS can be in the AS_PATH.
      • None (default)—No action taken.
   10. Enter the maximum Number Prefix to accept (learn) from the peer.

       Range is 1-4,294,9677,295. Default is 1,000.
   11. Enter the Threshold (percentage) of the maximum number of prefixes added to the BGP local RIB.

       If the peer advertises more than the threshold, the firewall takes the specified Rule Type action. Range is 1-100. Default is 100.
   12. Select the Rule Type action for when the number prefix threshold is exceeded.

       • Warning Only (default)—A system log is generated.
       • Restart—The BGP peer connection is restarted.
   13. Select the Next Hop.

       • Self—Causes the firewall to change the Next Hop address (in Updates it receives) to its own IP address in the Update before sending it on. This is helpful when the firewall is communicating with an eBGP router (in another AS) and with an IBGP router (in its own AS). For example, suppose the Next Hop address in a BGP Update that arrives at AS 64512 is the IP address of the egress interface of Router 2 where the Update egressed AS 64518. The Update indicates that to reach networks that Router 2 is advertising, use the Next Hop address of Router 2. However, if the firewall sends that Update to an iBGP neighbor in AS 64512, the unchanged Next Hop of Router 2 is outside AS 64512 and the iBGP neighbor doesn’t have a route to it. When you select Self, the firewall changes the Next Hop to its own IP address so that an iBGP neighbor can use that Next Hop to reach the firewall, which in turn can reach the eBGP router.
       • Self Force—Force set the Next Hop to self for the reflected routes.
       • None (default)—Keep the original Next Hop in the attribute.
   14. Set Remove Private As to have BGP remove private AS numbers from the AS_PATH attribute in Updates that the firewall sends to a peer in another AS.

       • All—Remove all private AS numbers.
       • Replace AS—Replace all private AS numbers with the firewall AS number.
       • None (default)—No action taken.
   15. Set Send Community to select the type of BGP community attributes to send in outbound Update packets.

       • All—Send all communities.
       • Both—Send standard and extended communities.
       • Extended—Send extended communities (RFC 4360).
       • Large—Send large communities (RFC 8092).
       • Standard—Send standard communities (RFC 1997).
       • None (default)—Don’t send any communities.
   16. Set the ORF List to advertise the ability of the peer group or peer to send a prefix list and or receive a prefix list to implement outbound route filtering (ORF) at the source. This minimizes sending or receiving unwanted prefixes in Updates.

       • None (default)—The peer group or peer (where this AFI profile is applied) has no ORF capability.
       • Both—Advertise that the peer group or peer (where this AFI profile is applied) can send a prefix list and receive a prefix list to implement ORF.
       • Receive—Advertise that the peer group or peer (where this AFI profile is applied) can receive a prefix list to implement ORF. The local peer receives the remote peer’s ORF capability and prefix list, which it implements as an outbound route filter.
       • Send—Advertise that the peer group or peer (where this AFI profile is applied) can send a prefix list to implement ORF. The remote peer (with receive capability) receives the ORF capability and implements the prefix list it received as an outbound route filter when advertising routes to the sender.
   17. Save.
4. For Auth Profiles, Add Profile.

   1. Enter a Name for the profile.

      The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is supported.
   2. Enter the Secret and Confirm Secret.

      The Secret is used as the key in MD5 authentication.
   3. Save.
5. For Redistribution Profiles, Add Profile.

   1. Enter a Name for the profile.

      The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is supported.
   2. Enable the route type to redistribute (Static, OSPF, Connected, or RIP)

      You can enable multiple types of routes. A single profile supports one or all types of routes to redistribute.
   3. Configure the Metric to apply to the connected routes being redistributed into BGP.

      Range is 1-65535.
   4. Select the Route-Map to specify the match criteria which OSPF routes to redistribute.

      Default is None. If the route map Set configuration includes a Metric Action and Metric Value, they’re applied to the redistributed route. Otherwise, the Metric configured on the redistribution profile is applied to the redistributed route.
   5. Save.
6. Create a BGP Filtering profile.

   Advanced routing filters are required to populate the filter settings when you configure a BGP filtering profile. Create a BGP filtering profile to:

   • Accept routes that came from a specific AS Path (based on the AS Path access list).
   • Advertise routes that have a specific AS Path (based on the AS Path access list).
   • Accept routes to the local BGP RIB based on either a distribute list or prefix list (not both in the same filtering profile). A distribute list is based on source IP address with wildcard mask to get a prefix range. A prefix list is based on network address/prefix length.
   • Advertise routes from the local BGP RIB based on a distribute list or prefix list (not both in the same filtering profile).
   • Accept routes that meet the route map attribute criteria into the local BGP RIB, and optionally set attributes.
   • Advertise routes that meet the route map attribute criteria, and optionally set attributes.
   • Conditionally advertise routes that exist (satisfy exist criteria).
   • Conditionally advertise routes other than those that meet criteria (satisfy nonexist criteria).
   • Unsuppress dampened or summarized routes.
7. For Filtering Profiles, Add Profile.

   1. Enter a Name for the profile.

      The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is supported.
   2. Select Unicast or Multicast.

      Both Unicast and Multicast can be configured.
   3. For the Inbound Filter List, select an AS Path access list to specify that, when receiving routes from peers, only routes with the same AS Path are imported from the peer group or peer and added to the local BGP RIB.
   4. For the Outbound Filter List, select an AS Path access list to specify that only routes with the same AS Path are advertised to a peer router.
   5. For the Unsuppressed Map, select a route map of routes that you don’t want to suppress.

      For example, because the routes were summarized and therefore suppressed.
   6. Configure the Network Filters settings.

      1. For the Inbound Distribute List, select an access list to filter BGP routing information that BGP receives.
         This list is mutually exclusive with the Inbound Prefix List in a BGP filtering profile.
      2. For the Inbound Prefix List, select a prefix list to filter BGP routing information that BGP receives based on the network prefix.
         This list is mutually exclusive with the Inbound Distribute List in a BGP filtering profile.
      3. For the Inbound Route Maps, select a route map to have additional control over which routes are allowed into the local BGP RIB and to set attributes for the routes.
         For example, you can add an inbound route map to control route preference by prepending an AS to the AS Path of the route.
         If an Inbound Route Map, along with an Inbound Distribute List or Inbound Prefix List, are both configured, the conditions of both the route map and the list must be met.
      4. For the Outbound Distribute List, select an access list to filter BGP routing information that BGP advertises based on the IP address of the destination.
         This list is mutually exclusive with the Outbound Prefix List in a BGP filtering profile.
      5. For the Outbound Prefix List, select a prefix list to filter BGP routing information that BGP advertises based on the network prefix.
         This list is mutually exclusive with the Outbound Distribute List in a BGP filtering profile.
      6. For the Outbound Route Maps, select a route map to have additional control over which routes BGP advertises and to set attributes for advertised routes.
         If an Outbound Route Map, along with an Outbound Distribute List or Outbound Prefix List, are both configured, the conditions of both the route map and the list must be met.
   7. Configure the Conditional Advertisement settings.

      This allows you to control what route to advertise in the event that a different route does exist or doesn’t exist in the local BGP RIB. A route not existing in the local BGP RIB can indicate a peering or reachability failure. Conditional advertisements are useful in cases where you want to try to force routes to one AS over another, such as when you have links to the internet through multiple ISPs and you want traffic to be routed to one provider instead of another, except when there’s a loss of connectivity to the preferred provider.

      1. For the Exist Map, select a route map to specify the match criteria for the conditional advertisement.
         Only the Match portion of the route map is considered the Set portion is ignored.
      2. For the Advertise Map, select a route map to specify the routes to advertise in the event the condition is met.
         Only the Match portion of the route map is considered the Set portion is ignored.
      3. For the Non-Exist Map, select a route map to specify the match criteria for which routes don’t exist in the local BGP RIB to conditionally advertise.
         Only the Match portion of the route map is considered the Set portion is ignored.
      4. For the Advertise List, select the route map to specify routes to advertise when the routes in the Non-Exist Map aren’t in the local BGP RIB.
         Only the Match portion of the route map is considered the Set portion is ignored.
   8. Save.