End-of-Life (EoL)

Configure BGP

Perform the following procedure to configure BGP.
  1. Configure general virtual router configuration settings.
    See Virtual Routers for details.
  2. Configure standard BGP configuration settings.
    1. Select the
      BGP
      tab.
    2. Select
      Enable
      to enable the BGP protocol.
    3. For
      Router ID
      , assign an IP address to the virtual router.
    4. For
      AS Number
      , enter the number of the AS to which the virtual router belongs, based on the router ID. Range is 1-4294967295.
  3. Configure general BGP configuration settings.
    1. Select
      BGP
      > General
      .
    2. Select
      Reject Default Route
      to ignore any default routes that are advertised by BGP peers.
    3. Select
      Install Route
      to install BGP routes in the global routing table.
    4. Select
      Aggregate MED
      to enable route aggregation even when routes have different Multi-Exit Discriminator (MED) values.
    5. Enter a value for the
      Default Local Preference
      that specifies a value than can be used to determine preferences among different paths.
    6. Select one of the following values for the AS format for interoperability purposes:
      • 2 Byte (default value)
      • 4 Byte
    7. Enable or disable each of the following values for
      Path Selection
      :
      • Always Compare MED
        —Enable this comparison to choose paths from neighbors in different autonomous systems.
      • Deterministic MED Comparison
        —Enable this comparison to choose between routes that are advertised by IBGP peers (BGP peers in the same autonomous system).
    8. Click
      Add
      to include a new authentication profile and configure the following settings:
      • Profile Name
        —Enter a name to identify the profile.
      • Secret/Confirm Secret
        —Enter and confirm a passphrase for BGP peer communications. The Secret is used as a key in MD5 authentication.
  4. (
    Optional
    ) Configure BGP Advanced settings.
    1. On the
      Advanced
      tab, select
      Graceful Restart
      and configure the following timers:
      • Stale Route Time (sec)
        —Specifies the length of time in seconds that a route can say in the stale state (range is 1- 3600; default is 120).
      • Local Restart Time (sec)
        —Specifies the length of time in seconds that the local device waits to restart. This value is advertised to peers (range is 1-3600’ default is 120).
      • Max Peer Restart Time (sec)
        —Specifies the maximum length of time in seconds that the local device accepts as a grace period restart time for peer devices (range is 1-3600; default is 120).
    2. For
      Reflector Cluster ID
      , specify an IPv4 identifier to represent the reflector cluster.
    3. For
      Confederation Member AS
      , specify the autonomous system number identifier (also called a sub-AS number), which is visible only within the BGP confederation.
    4. Click
      Add
      and enter the following information for each Dampening Profile that you want to configure, select
      Enable
      , and click
      OK
      :
      • Profile Name
        —Enter a name to identify the profile.
      • Cutoff
        —Specify a route withdrawal threshold above which a route advertisement is suppressed (range is 0.0-1000.0; default is 1.25).
      • Reuse
        —Specify a route withdrawal threshold below which a suppressed route is used again (range is 0.0-1000.0; default is 5).
      • Max Hold Time (sec)
        —Specify the maximum length of time in seconds that a route can be suppressed, regardless of how unstable it has been (range is 0-3600 seconds; default is 900).
      • Decay Half Life Reachable (sec)
        —Specify the length of time in seconds after which a route’s stability metric is halved if the route is considered reachable (range is 0-3600 seconds; default is 300).
      • Decay Half Life Unreachable (sec)
        —Specify the length of time in seconds after which a route’s stability metric is halved if the route is considered unreachable (range is 0-3600; default is 300).
    5. Click
      OK
      .
  5. Configure the BGP peer group.
    1. Select the
      Peer Group
      tab and click
      Add
      .
    2. Enter a
      Name
      for the peer group and select
      Enable
      .
    3. Select
      Aggregated Confed AS Path
      to include a path to the configured aggregated confederation AS.
    4. Select
      Soft Reset with Stored Info
      to perform a soft reset of the firewall after updating the peer settings.
    5. Specify the type of peer or group from the
      Type
      drop-down and configure the associated settings (see below in this table for descriptions of Import Next Hop and Export Next Hop).
      • IBGP
        Export Next Hop:
        Specify
        Original
        or
        Use self
      • EBGP Confed
        Export Next Hop:
        Specify
        Original
        or
        Use self
      • EBGP Confed
        Export Next Hop:
        Specify
        Original
        or
        Use self
      • EBGP
        Import Next Hop:
        Specify
        Original
        or
        Use self
        ,
        Export Next Hop
        :
        Specify
        Resolve
        or
        Use self
        . Select
        Remove Private AS
        if you want to force BGP to remove private AS numbers.
    6. Click
      OK
      to save.
  6. Configure a BGP peer that belongs to the peer group and specify its addressing.
    1. Select
      Network
      Virtual Routers
      and select a virtual router.
    2. Select
      BGP
      Peer Group
      and select the peer group you created.
    3. For Peer,
      Add
      a peer by
      Name
      .
    4. Select
      Enable
      to activate the peer.
    5. Enter the
      Peer AS
      to which the peer belongs.
    6. Select
      Addressing
      .
    7. For
      Local Address
      , select the
      Interface
      for which you are configuring BGP. If the interface has more than one
      IP
      address, enter the IP address for that interface to be the BGP peer.
    8. For
      Peer Address
      , enter the IP address of the BGP peer.
    9. Click
      OK
      .
  7. Configure connection settings for the BGP peer.
    1. Select
      Network
      Virtual Routers
      and select a virtual router.
    2. Select
      BGP
      Peer Group
      and select the peer group you created.
    3. Select the
      Peer
      you configured.
    4. Select
      Connection Options
      .
    5. Select an
      Auth Profile
      for the peer.
    6. Set a
      Keep Alive Interval (sec)
      , the interval (in seconds) after which routes from the peer are suppressed according to the Hold Time setting (range is 0-1,200; default is 30).
    7. Set
      Multi Hop
      , the time -to-live (TTL) value in the IP header (range is 1-255; default is 0. The default value of 0 means 2 for eBGP prior to PAN-OS 7.1.9, and it means 1 beginning with PAN-OS 7.1.9. The default value of 0 means 255 for iBGP).
    8. Set
      Open Delay Time (sec)
      , the delay in seconds between a TCP handshake and the firewall sending the first BGP Open message to establish a BGP connection (range is 0-240; default is 0).
    9. Set
      Hold Time (sec)
      , the length of time in seconds that may elapse between successive Keepalive or Update messages from the peer before the peer connection is closed (range is 3-3600; default is 90).
    10. Set
      Idle Hold Time (sec)
      , the length of time to wait (in seconds) before retrying to connect to the peer (range is 1-3600; default is 15).
    11. For
      Incoming Connections
      , enter a
      Remote Port
      and select
      Allow
      to allow incoming traffic to this port.
    12. For
      Outgoing Connections
      , enter a
      Local Port
      and select
      Allow
      to allow outgoing traffic from this port.
    13. Click
      OK
      .
  8. Configure the BGP peer with settings for route reflector client, peering type, maximum prefixes, and Bidirectional Forwarding Detection (BFD).
    1. Select
      Network
      Virtual Routers
      and select a virtual router.
    2. Select
      BGP
      Peer Group
      and select the peer group you created.
    3. Select the
      Peer
      you configured.
    4. Select
      Advanced
      .
    5. For
      Reflector Client
      , select one of the following:
      • non-client
        —Peer is not a route reflector client (default).
      • client
        —Peer is a route reflector client.
      • meshed-client
    6. For
      Peering Type
      , select one of the following:
      • Bilateral
        —The two BGP peers establish a peer connection.
      • Unilateral
        —(default).
    7. For
      Max Prefixes
      , enter the maximum number of supported IP prefixes (range is 1-100,000) or select unlimited.
    8. To enable
      BFD
      for the peer (and thereby override the BFD setting for BGP, as long as BFD is not disabled for BGP at the virtual router level), select one of the following:
      • default
        —Peer uses only default BFD settings.
      • Inherit-vr-global-setting
        (default)—Peer inherits the BFD profile that you selected globally for BGP for the virtual router.
      • A BFD profile you configured—See Create a BFD profile.
      Selecting
      Disable BFD
      disables BFD for the BGP peer.
    9. Click
      OK
      .
  9. Configure Import and Export rules.
    The import/export rules are used to import/export routes from/to other routers. For example, importing the default route from your ISP.
    1. Select the
      Import
      tab and then click
      Add
      and enter a name in the
      Rules
      field and select
      Enable
      .
    2. Click
      Add
      and select the
      Peer Group
      to which the routes will be imported from.
    3. Click the
      Match
      tab and define the options used to filter routing information. You can also define the Multi-Exit Discriminator (MED) value and a next hop value to routers or subnets for route filtering. The MED option is an external metric that lets neighbors know about the preferred path into an AS. A lower value is preferred over a higher value.
    4. Click the
      Action
      tab and define the action that should occur (allow/deny) based on the filtering options defined in the
      Match
      tab. If
      Deny
      is selected, no further options need to be defined. If the
      Allow
      action is selected, define the other attributes.
    5. Click the
      Export
      tab and define export attributes, which are similar to the
      Import
      settings, but are used to control route information that is exported from the firewall to neighbors.
    6. Click
      OK
      to save.
  10. Configure conditional advertising, which allows you to control what route to advertise in the event that a different route is not available in the local BGP routing table (LocRIB), indicating a peering or reachability failure.
    This is useful in cases where you want to try to force routes to one AS over another, for example if you have links to the internet through multiple ISPs and you want traffic to be routed to one provider instead of the other unless there is a loss of connectivity to the preferred provider.
    1. Select the
      Conditional Adv
      tab, click
      Add
      and enter a name in the
      Policy
      field.
    2. Select
      Enable
      .
    3. Click
      Add
      and in the
      Used By
      section enter the peer group(s) that will use the conditional advertisement policy.
    4. Select the
      Non Exist Filter
      tab and define the network prefix(es) of the preferred route. This specifies the route that you want to advertise, if it is available in the local BGP routing table. If a prefix is going to be advertised and matches a Non Exist filter, the advertisement will be suppressed.
    5. Select the
      Advertise Filters
      tab and define the prefix(es) of the route in the Local-RIB routing table that should be advertised in the event that the route in the non-exist filter is not available in the local routing table. If a prefix is going to be advertised and does not match a Non Exist filter, the advertisement will occur.
  11. Configure aggregate options to summarize routes in the BGP configuration.
    BGP route aggregation is used to control how BGP aggregates addresses. Each entry in the table results in one aggregate address being created. This will result in an aggregate entry in the routing table when at least one or more specific route matching the address specified is learned.
    1. Select the
      Aggregate
      tab, click
      Add
      and enter a name for the aggregate address.
    2. In the
      Prefix
      field, enter the network prefix that will be the primary prefix for the aggregated prefixes.
    3. Select the
      Suppress Filters
      tab and define the attributes that will cause the matched routes to be suppressed.
    4. Select the
      Advertise Filters
      tab and define the attributes that will cause the matched routes to always be advertised to peers.
  12. Configure redistribution rules.
    This rule is used to redistribute host routes and unknown routes that are not on the local RIB to the peers routers.
    1. Select the
      Redist Rules
      tab and click
      Add
      .
    2. In the
      Name
      field, enter an IP subnet or select a redistribution profile. You can also configure a new redistribution profile from the drop-down if needed.
    3. Click
      Enable
      to enable the rule.
    4. In the
      Metric
      field, enter the route metric that will be used for the rule.
    5. In the
      Set Origin
      drop-down, select
      incomplete
      ,
      igp
      , or
      egp
      .
    6. (
      Optional
      ) Set MED, local preference, AS path limit and community values.

Recommended For You