BGP configuration and operations on Palo Alto Networks firewalls. Covers PAN-OS-specific concepts, CLI commands, graceful restart vs BFD, and common gotchas.
Yes — prevents peer from tearing down BGP during failover
Optional
Yes, if fast failure detection also needed
PAN-OS upgrade / restart
Yes — maintains forwarding while control plane reboots
No (BFD would detect the restart as a failure)
GR only
Fast link failure detection
No
Yes — detects in milliseconds vs 180s hold timer
Yes
Multihop eBGP (not directly connected)
Optional
Yes — detects intermediate path failures
Yes
iBGP between HA peers
Yes — standard practice
Usually not needed (HA link monitored separately)
GR only
Graceful Restart Details
Parameter
Default
Description
Stale Route Timer
120 seconds
How long the helper holds stale routes after peer restarts
Local Restart Timer
120 seconds
How long the restarting router has to re-establish and reconverge
Helper Mode
Enabled
Whether this router acts as a helper for restarting peers
How it works:
During OPEN exchange, both peers advertise GR capability
When the restarting router goes down, the helper marks routes as stale (not deleted)
Helper continues forwarding on stale routes
Restarting router comes back, re-establishes TCP/BGP session with GR flag
Routes are refreshed — stale flag removed
If Stale Route Timer expires before refresh, stale routes are purged
BFD Details
Parameter
Recommended
Description
Desired Min TX Interval
300ms
How often to send BFD packets
Required Min RX Interval
300ms
Minimum interval willing to receive BFD packets
Detection Multiplier
3
Number of missed packets before declaring failure
Effective Detection Time
900ms (300ms * 3)
Total time to detect failure
Key point: BFD runs independently from BGP. When BFD detects a failure, it notifies BGP, which immediately tears down the session (rather than waiting for the 180s Hold Timer).
Import and Export Rules
PAN-OS uses Import/Export rules to control which routes are accepted into and advertised from the BGP RIB. This is conceptually similar to route-maps on Cisco but with a PAN-specific workflow.
Critical Gotcha: Default Deny
PAN-OS BGP has an implicit deny on import. If you have no import rules, no BGP routes will be installed in the routing table. This catches people migrating from Cisco/Juniper where the default is to accept all routes.
Rule Type
Purpose
Default Behavior
Import Rules
Filter and modify routes received from peers before installing in RIB
Deny all (must explicitly allow)
Export Rules
Filter and modify routes advertised to peers
Deny all (must explicitly allow)
Conditional Advertisement
Advertise routes only when specific conditions are met
N/A
Import/Export Rule Actions
Match Criteria
Description
Address Prefix
Match on specific prefixes or prefix ranges
AS Path (Regex)
Match on AS_PATH regular expressions
Community
Match on community values
Extended Community
Match on extended community values (RT, SoO)
Next Hop
Match on next-hop address
MED
Match on MED value
Peer
Match on specific peer or peer group
Set Action
Description
Allow / Deny
Accept or reject the route
LOCAL_PREF
Set LOCAL_PREF value
MED
Set MED value
AS_PATH Prepend
Prepend AS numbers to AS_PATH
Community
Set, add, or remove community values
Weight
Set weight value
Next Hop
Override next-hop address
Configuration Checklist
High-level steps for configuring BGP on PAN-OS:
Virtual Router → Select or create the virtual router
BGP Tab → Enable BGP
General → Set Router ID, Local AS number
General → Enable Graceful Restart if needed
Peer Group → Create a peer group (eBGP or iBGP type)
Import Rules → Create rules to accept incoming routes (remember: default is deny)
Export Rules → Create rules for routes to advertise
Redistribution Profile → If redistributing into/from BGP and other protocols
Commit and verify with show routing protocol bgp summary
Common Gotchas
Issue
Cause
Fix
Peer established but no routes in routing table
No import rules configured (default deny)
Create import rules with Allow action
Routes not advertised to peer
No export rules configured (default deny)
Create export rules matching desired prefixes
eBGP peer won’t connect (not directly connected)
eBGP requires TTL=1 by default
Enable eBGP multihop in peer connection options
MD5 auth failing
Key mismatch or TCP option negotiation issue
Verify key on both sides; check for NAT/proxy between peers
Routes accepted but not preferred
iBGP AD (200) is higher than OSPF (110) or other IGP
Expected behavior — use import rules to set LOCAL_PREF or modify AD
Graceful Restart not working during HA failover
GR not enabled on both the firewall and the peer
Enable GR on both sides; verify helper mode on peer
Flapping after HA failover
BFD detecting the brief outage during failover
Either disable BFD for HA scenarios, increase BFD multiplier, or rely on GR
Redistributed routes not appearing in BGP
Missing redistribution profile or export rule
Create redistribution profile AND an export rule that allows redistributed routes
Next-hop unreachable for iBGP routes
iBGP preserves next-hop by default
Use next-hop-self equivalent: import rule action to set next-hop, or ensure next-hop is in IGP
Redistribution on PAN-OS
PAN-OS handles redistribution via Redistribution Profiles (which routes to redistribute) and Export Rules (which redistributed routes to actually advertise).
Step
Where
What
1
Redistribution Profile
Define which connected/static/OSPF routes to pull into BGP
2
Export Rule
Allow the redistributed routes to be advertised to BGP peers
Both are required. A redistribution profile without a matching export rule means the routes are pulled into BGP internally but never advertised.