Configure BGP
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
Configure BGP
Configure BGP for a virtual router.
Perform the following task to configure BGP.
- Configure general virtual router settings.
- Enable BGP for the virtual router, assign a router ID, and assign the virtual router to an AS.
- Selectand select a virtual router.NetworkVirtual Routers
- SelectBGP.
- EnableBGP for this virtual router.
- Assign aRouter IDto BGP for the virtual router, which is typically an IPv4 address to ensure the Router ID is unique.
- Assign theAS Number—the number of the AS to which the virtual router belongs based on the router ID (range is 1 to 4,294,967,295).
- ClickOK.
- Configure general BGP configuration settings.
- Selectand select a virtual router.NetworkVirtual Routers
- Select.BGPGeneral
- SelectReject Default Routeto ignore any default routes that are advertised by BGP peers.
- SelectInstall Routeto install BGP routes in the global routing table.
- SelectAggregate MEDto enable route aggregation even when routes have different Multi-Exit Discriminator (MED) values.
- Specify theDefault Local Preferencethat can be used to determine preferences among different paths.
- Select theAS Formatfor interoperability purposes:
- 2 Byte(default)
- 4 Byte
Runtime stats display BGP 4-byte AS numbers using asplain notation according to RFC 5396. - Enable or disable each of the following settings forPath Selection:
- Always Compare MED—Enable this comparison to choose paths from neighbors in different autonomous systems.
- Deterministic MED Comparison—Enable this comparison to choose between routes that are advertised by IBGP peers (BGP peers in the same autonomous system).
- ForAuth Profiles,Addan authentication profile:
- Profile Name—Enter a name to identify the profile.
- Secret/Confirm Secret—Enter and confirm a passphrase for BGP peer communications. The Secret is used as a key in MD5 authentication.
- ClickOKtwice.
- (Optional) Configure BGP settings.
- Selectand select a virtual router.NetworkVirtual Routers
- Select.BGPAdvanced
- SelectECMP Multiple AS Supportif you configured ECMP and you want to run ECMP over multiple BGP autonomous systems.
- Enforce First AS for EBGP(enabled by default) to cause the firewall to drop an incoming Update packet from an eBGP peer that does not list the eBGP peer’s own AS number as the first AS number in the AS_PATH attribute.
- SelectGraceful Restartand configure the following timers:
- Stale Route Time (sec)—Specifies the length of time, in seconds, that a route can stay in the stale state (range is 1 to 3,600; default is 120).
- Local Restart Time (sec)—Specifies the length of time, in seconds, that the local device waits to restart. This value is advertised to peers (range is 1 to 3,600; default is 120).
- Max Peer Restart Time (sec)—Specifies the maximum length of time, in seconds, that the local device accepts as a grace period restart time for peer devices (range is 1 to 3,600; default is 120).
- ForReflector Cluster ID, specify an IPv4 identifier to represent the reflector cluster.
- ForConfederation Member AS, specify the autonomous system number identifier (also called a sub-AS number), which is visible only within the BGP confederation. For more information, see BGP Confederations.
- Addthe following information for each Dampening Profile that you want to configure, selectEnable, and clickOK:
- Profile Name—Enter a name to identify the profile.
- Cutoff—Specify a route withdrawal threshold above which a route advertisement is suppressed (range is 0.0 to 1,000.0; default is 1.25).
- Reuse—Specify a route withdrawal threshold below which a suppressed route is used again (range is 0.0 to 1,000.0; default is 5).
- Max Hold Time (sec)—Specify the maximum length of time, in seconds, that a route can be suppressed, regardless of how unstable it has been (range is 0 to 3,600; default is 900).
- Decay Half Life Reachable (sec)—Specify the length of time, in seconds, after which a route’s stability metric is halved if the route is considered reachable (range is 0 to 3,600; default is 300).
- Decay Half Life Unreachable (sec)—Specify the length of time, in seconds, after which a route’s stability metric is halved if the route is considered unreachable (range is 0 to 3,600; default is 300).
- ClickOKtwice.
- Configure a BGP peer group.
- Selectand select a virtual router.NetworkVirtual Routers
- Select,BGPPeer GroupAddaNamefor the peer group, andEnableit.
- SelectAggregated Confed AS Pathto include a path to the configured aggregated confederation AS.
- SelectSoft Reset with Stored Infoto perform a soft reset of the firewall after updating the peer settings.
- Select theTypeof peer group:
- IBGP—Export Next Hop: SelectOriginalorUse self.
- EBGP Confed—Export Next Hop: SelectOriginalorUse self.
- EBGP Confed—Export Next Hop: SelectOriginalorUse self.
- EBGP—Import Next Hop: SelectOriginalorUse self; andExport Next Hop: SpecifyResolveorUse self. SelectRemove Private ASif you want to force BGP to remove private AS numbers from the AS_PATH attribute in Updates that the firewall sends to a peer in another AS.
- ClickOK.
- Configure a BGP peer that belongs to the peer group and specify its addressing.
- Selectand select a virtual router.NetworkVirtual Routers
- Selectand select the peer group you created.BGPPeer Group
- For Peer,Adda peer byName.
- Enablethe peer.
- Enter thePeer ASto which the peer belongs.
- SelectAddressing.
- ForLocal Address, select theInterfacefor which you are configuring BGP. If the interface has more than oneIPaddress, enter the IP address for that interface to be the BGP peer.
- ForPeer Address, select eitherIPand enter the IP address or select or create an address object, or selectFQDNand enter the FQDN or address object that is type FQDN.The firewall uses only one IP address (from each IPv4 or IPv6 family type) from the DNS resolution of the FQDN. If the DNS resolution returns more than one address, the firewall uses the preferred IP address that matches the IP family type (IPv4 or IPv6) configured for the BGP peer. The preferred IP address is the first address the DNS server returns in its initial response. The firewall retains this address as preferred as long as the address appears in subsequent responses regardless of its order.
- ClickOK.
- Configure connection settings for the BGP peer.
- Selectand select a virtual router.NetworkVirtual Routers
- Selectand select the peer group you created.BGPPeer Group
- Select thePeeryou configured.
- SelectConnection Options.
- Select anAuth Profilefor the peer.
- Set aKeep Alive Interval (sec)—The interval, in seconds, after which routes from the peer are suppressed according to the Hold Time setting (range is 0 to 1,200; default is 30).
- SetMulti Hop—The time-to-live (TTL) value in the IP header (range is 0 to 255; default is 0). The default value of 0 means 1 for eBGP. The default value of 0 means 255 for iBGP.
- SetOpen Delay Time (sec)—The delay, in seconds, between a TCP handshake and the firewall sending the first BGP Open message to establish a BGP connection (range is 0 to 240; default is 0).
- SetHold Time (sec)—The length of time, in seconds, that may elapse between successive Keepalive or Update messages from the peer before the peer connection is closed (range is 3 to 3,600; default is 90).
- SetIdle Hold Time (sec)—The length of time to wait, in seconds, before retrying to connect to the peer (range is 1 to 3,600; default is 15).
- SetMin Route Advertisement Interval (sec)—The minimum amount of time, in seconds, between two successive Update messages that a BGP speaker (the firewall) sends to a BGP peer that advertise routes or withdrawal of routes (range is 1 to 600; default is 30).
- ForIncoming Connections, enter aRemote Portand selectAllowto allow incoming traffic to this port.
- ForOutgoing Connections, enter aLocal Portand selectAllowto allow outgoing traffic from this port.
- ClickOK.
- Configure the BGP peer with settings for route reflector client, peering type, maximum prefixes, and Bidirectional Forwarding Detection (BFD).
- Selectand select a virtual router.NetworkVirtual Routers
- Selectand select the peer group you created.BGPPeer Group
- Select thePeeryou configured.
- SelectAdvanced.
- ForReflector Client, select one of the following:
- non-client(default)—Peer is not a route reflector client.
- client—Peer is a route reflector client.
- meshed-client
- ForPeering Type, select one of the following:
- Bilateral—The two BGP peers establish a peer connection.
- Unspecified(default).
- ForMax Prefixes, enter the maximum number of IP prefixes to import from the peer (range is 1 to 100,000) or selectunlimited.
- To enableBFDfor the peer (and thereby override the BFD setting for BGP, as long as BFD is not disabled for BGP at the virtual router level), select one of the following:
- default—Peer uses only default BFD settings.
- Inherit-vr-global-setting(default)—Peer inherits the BFD profile that you selected globally for BGP for the virtual router.
- A BFD profile you configured—See Create a BFD Profile.SelectDisable BFDto disable BFD for the BGP peer.
- ClickOK.
- Configure Import and Export rules.The import and export rules are used to import and export routes from and to other routers (for example, importing the default route from your Internet Service Provider).
- SelectImport,Adda name (maximum of 63 characters) in theRulesfield. The name must start with an alphanumeric character and can contain a combination of alphanumeric characters, underscore (_), hyphen (-), dot (.), and space.
- Enablethe rule.
- AddthePeer Groupfrom which the routes will be imported.
- SelectMatchand define the options used to filter routing information. You can also define the Multi-Exit Discriminator (MED) value and a next hop value to routers or subnets for route filtering. The MED option is an external metric that lets neighbors know about the preferred path into an AS. A lower value is preferred over a higher value.
- SelectActionand define the action that should occur (allow or deny) based on the filtering options defined in theMatchtab. If you selectDeny, you don’t need to define any additional options. If you selectAllow, then define the other attributes.
- ClickOK.
- SelectExportand define export attributes, which are similar to theImportsettings but are used to control route information that is exported from the firewall to neighbors. The name of the Export rule can be a maximum of 31 characters.
- Configure conditional advertising, which allows you to control what route to advertise in the event that a different route is not available in the local BGP routing table (LocRIB), indicating a peering or reachability failure.This is useful in cases where you want to try to force routes to one AS over another, such as when you have links to the internet through multiple ISPs and you want traffic to be routed to one provider instead of the other except when there is a loss of connectivity to the preferred provider.
- SelectConditional AdvandAddaPolicyname.
- Enablethe conditional advertisement.
- In theUsed Bysection,Addthe peer groups that will use the conditional advertisement policy.
- SelectNon Exist Filterand define the network prefixes of the preferred route. This specifies the route that you want to advertise when it is available in the local BGP routing table. If a prefix is going to be advertised and matches a Non Exist filter, the advertisement will be suppressed.
- SelectAdvertise Filtersand define the prefixes of the route in the Local-RIB routing table that should be advertised in the event that the route in the non-exist filter is unavailable in the local routing table. If a prefix is going to be advertised and does not match a Non Exist filter, the advertisement will occur.
- ClickOK.
- Configure aggregate options to summarize routes in the BGP configuration.BGP route aggregation is used to control how BGP aggregates addresses. Each entry in the table results in the creation of one aggregate address. This will result in an aggregate entry in the routing table when at least one specific route matching the address specified is learned.
- SelectAggregateandAdda name for the aggregate address.
- Enter the networkPrefixthat will be the primary prefix for the aggregated prefixes.
- SelectSuppress Filtersand define the attributes that will cause the matched routes to be suppressed.
- SelectAdvertise Filtersand define the attributes that will cause the matched routes to always be advertised to peers.
- ClickOK.
- Configure redistribution rules.This rule is used to redistribute host routes and unknown routes that are not on the local RIB to the peer routers.
- SelectRedist RulesandAdda new redistribution rule.
- Enter theNameof an IP subnet or select a redistribution profile. You can also configure a new redistribution profile if needed.
- Enablethe rule.
- Enter the routeMetricthat will be used for the rule.
- In theSet Originlist, selectincomplete,igp, oregp.
- (Optional) Set MED, local preference, AS path limit, and community values.
- ClickOK.
- Commityour changes.