Strata Cloud Manager

1. Select ConfigurationNGFW and Prisma Access.
2. For Configuration Scope, select Folders and then select All Firewalls, a specific folder, or the specific firewalls you want to configure. (Don’t choose Global.)
3. Select Device SettingsRoutingRouters and select the logical router you're configuring.
4. Edit the Multicast card and Enable multicast.
5. Select the MSDP tab.
6. On the General tab, Enable MSDP.

7. Select the Global Timer profile, or select the default profile (this is the default setting), or create a new timer profile. If you select default, Keep Alive Interval is set to 60, Message Timeout is set to 75, and Connection Retry Interval is set to 30. If you select None, the default values apply.
8. Select the Global Authentication profile or create a new one. The default is None.
9. For the Originator ID, select the Interface that the logical router uses as the RP interface in Source-Active (SA) messages.
10. Select or enter the IP Address (with prefix length) that the logical router uses as the RP address in SA messages. If no Originator IP address is configured, the logical router uses the PIM RP address to encapsulate the SA message.
11. Select the Peers tab and Add a peer Name (maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), hyphen (-), or dot (.) and can contain a combination of alphanumeric characters, underscore, or hyphen or dot. No space is allowed.

12. Enter the Source Interface used to establish the MSDP connection over TCP with its MSDP peer.
13. Select the IP address of the source interface. The default is None.
14. Select the Type of peer address:

    • IP—(the default) and select an address object or enter an IP address.
    • FQDN—Select or enter the fully qualified domain name of the peer. The drop-down displays all FQDN names configured as address objects.
15. Enter the BGP autonomous system number of the Remote AS where the MSDP peer is located.
16. For Authentication, do one of the following:

    • Select an MSDP authentication profile to apply to this peer, which overrides the Global Authentication Profile you applied to MSDP on the General page.
    • inherit (Inherit from global authentication) (the default) the global authentication profile.
    • Select none (Disable authentication) to disable authentication to this peer, which overrides the Global Authentication Profile.
17. For Max SA, enter the maximum number of Source-Active (SA) entries the SA cache will accept from this MSDP peer. The range is 0 to 1,024; the default is 0 (unlimited). After this maximum is reached, new SA messages from this peer are dropped.
18. For Inbound SA Filter, select an access list or create a new access list to filter incoming SA messages (block unwanted groups) from this peer. The default is None.

    The access list can specify source addresses in an (S,G) pair to filter, or destination (group) addresses in an (S,G) pair to filter, or both.
19. For Outbound SA Filter, select an access list or create a new access list to filter outgoing SA messages (block unwanted groups) being propagated to this peer. The default is None.

    The access list can specify source addresses in an (S,G) to filter, or destination (group) addresses in an (S,G) to filter, or both.
20. Click Add and Update.
21. Save the configuration.
22. Create MSDP authentication and timer profiles for Strata Cloud Manager if you have not done so.
23. Push Config and Push the configuration. Select the Admin Scope and enter a Description for the configuration. Select Push again.