PAN BGP Configuration

paloalto bgp routing networking

BGP configuration and operations on Palo Alto Networks firewalls. Covers PAN-OS-specific concepts, CLI commands, graceful restart vs BFD, and common gotchas.

For protocol fundamentals see: BGP - Reference For general PAN CLI commands see: PAN CLI - Cheat Sheet


Typical PAN-OS BGP Deployments

ScenarioRoleDetails
eBGP to ISPsASBRFirewall peers with one or more ISPs for internet routing
iBGP between HA pairiBGP peerActive/passive firewalls maintain BGP state across failover
eBGP to MPLS providerCE routerFirewall acts as Customer Edge, receiving provider routes
Redistribution into OSPFASBRExternal routes from BGP redistributed into internal OSPF as Type 5 LSAs

BGP Operational Commands

CommandDescription
show routing protocol bgp summaryPeer states, AS numbers, prefixes received, uptime
show routing protocol bgp peerDetailed peer information (timers, capabilities, state)
show routing protocol bgp peer <peer-name>Single peer detail
show routing protocol bgp loc-ribLocal RIB — all BGP routes (best and non-best)
show routing protocol bgp loc-rib bestOnly the best (active) BGP routes
show routing protocol bgp rib-outRoutes advertised to peers
show routing protocol bgp rib-inRoutes received from peers (pre-policy)
show routing protocol bgp policy importImport rules applied to incoming routes
show routing protocol bgp policy exportExport rules applied to outgoing routes
show routing protocol bgp redistributedRoutes redistributed into BGP
show routing route type bgpBGP routes installed in the routing table
show routing protocol bgp msg-counterBGP message statistics (OPEN, UPDATE, KEEPALIVE, NOTIFICATION)

Debug Commands

CommandDescription
debug routing bgp <on/off>Enable/disable BGP debug logging
less mp-log routed.logView routing daemon log (includes BGP events)
show log system direction equal backward | match bgpSystem log entries related to BGP

Graceful Restart vs BFD

These are complementary mechanisms, not alternatives. They solve different problems.

Comparison

PropertyGraceful Restart (GR)BFD (Bidirectional Forwarding Detection)
PurposeMaintain forwarding during control-plane restartsSub-second detection of path/link failures
Problem SolvedPeer doesn’t tear down session during planned/unplanned restartDetect failures faster than BGP Hold Timer (180s)
Detection SpeedN/A (prevents detection — keeps session alive)Sub-second (typically 300ms-1s)
Typical Use CaseHA failover, PAN-OS upgrades, process restartFast detection of link/path failure
MechanismRestarting router signals GR capability; helper holds routes as stale until reconvergedLightweight UDP echo packets between endpoints
ProtocolBGP capability (RFC 4724)Separate protocol (RFC 5880), linked to BGP
PAN-OS Config LocationVirtual Router → BGP → General tabVirtual Router → BGP → Peer Group → Peer → Connection Options

When to Use Each

ScenarioGraceful RestartBFDBoth?
HA failover (active/passive)Yes — prevents peer from tearing down BGP during failoverOptionalYes, if fast failure detection also needed
PAN-OS upgrade / restartYes — maintains forwarding while control plane rebootsNo (BFD would detect the restart as a failure)GR only
Fast link failure detectionNoYes — detects in milliseconds vs 180s hold timerYes
Multihop eBGP (not directly connected)OptionalYes — detects intermediate path failuresYes
iBGP between HA peersYes — standard practiceUsually not needed (HA link monitored separately)GR only

Graceful Restart Details

ParameterDefaultDescription
Stale Route Timer120 secondsHow long the helper holds stale routes after peer restarts
Local Restart Timer120 secondsHow long the restarting router has to re-establish and reconverge
Helper ModeEnabledWhether this router acts as a helper for restarting peers

How it works:

  1. During OPEN exchange, both peers advertise GR capability
  2. When the restarting router goes down, the helper marks routes as stale (not deleted)
  3. Helper continues forwarding on stale routes
  4. Restarting router comes back, re-establishes TCP/BGP session with GR flag
  5. Routes are refreshed — stale flag removed
  6. If Stale Route Timer expires before refresh, stale routes are purged

BFD Details

ParameterRecommendedDescription
Desired Min TX Interval300msHow often to send BFD packets
Required Min RX Interval300msMinimum interval willing to receive BFD packets
Detection Multiplier3Number of missed packets before declaring failure
Effective Detection Time900ms (300ms * 3)Total time to detect failure

Key point: BFD runs independently from BGP. When BFD detects a failure, it notifies BGP, which immediately tears down the session (rather than waiting for the 180s Hold Timer).


Import and Export Rules

PAN-OS uses Import/Export rules to control which routes are accepted into and advertised from the BGP RIB. This is conceptually similar to route-maps on Cisco but with a PAN-specific workflow.

Critical Gotcha: Default Deny

PAN-OS BGP has an implicit deny on import. If you have no import rules, no BGP routes will be installed in the routing table. This catches people migrating from Cisco/Juniper where the default is to accept all routes.

Rule TypePurposeDefault Behavior
Import RulesFilter and modify routes received from peers before installing in RIBDeny all (must explicitly allow)
Export RulesFilter and modify routes advertised to peersDeny all (must explicitly allow)
Conditional AdvertisementAdvertise routes only when specific conditions are metN/A

Import/Export Rule Actions

Match CriteriaDescription
Address PrefixMatch on specific prefixes or prefix ranges
AS Path (Regex)Match on AS_PATH regular expressions
CommunityMatch on community values
Extended CommunityMatch on extended community values (RT, SoO)
Next HopMatch on next-hop address
MEDMatch on MED value
PeerMatch on specific peer or peer group
Set ActionDescription
Allow / DenyAccept or reject the route
LOCAL_PREFSet LOCAL_PREF value
MEDSet MED value
AS_PATH PrependPrepend AS numbers to AS_PATH
CommunitySet, add, or remove community values
WeightSet weight value
Next HopOverride next-hop address

Configuration Checklist

High-level steps for configuring BGP on PAN-OS:

  1. Virtual Router → Select or create the virtual router
  2. BGP Tab → Enable BGP
  3. General → Set Router ID, Local AS number
  4. General → Enable Graceful Restart if needed
  5. Peer Group → Create a peer group (eBGP or iBGP type)
  6. Peer → Add peer: name, peer AS, peer IP, local interface/IP
  7. Peer → Connection Options → Set timers, enable BFD, MD5 auth
  8. Import Rules → Create rules to accept incoming routes (remember: default is deny)
  9. Export Rules → Create rules for routes to advertise
  10. Redistribution Profile → If redistributing into/from BGP and other protocols
  11. Commit and verify with show routing protocol bgp summary

Common Gotchas

IssueCauseFix
Peer established but no routes in routing tableNo import rules configured (default deny)Create import rules with Allow action
Routes not advertised to peerNo export rules configured (default deny)Create export rules matching desired prefixes
eBGP peer won’t connect (not directly connected)eBGP requires TTL=1 by defaultEnable eBGP multihop in peer connection options
MD5 auth failingKey mismatch or TCP option negotiation issueVerify key on both sides; check for NAT/proxy between peers
Routes accepted but not preferrediBGP AD (200) is higher than OSPF (110) or other IGPExpected behavior — use import rules to set LOCAL_PREF or modify AD
Graceful Restart not working during HA failoverGR not enabled on both the firewall and the peerEnable GR on both sides; verify helper mode on peer
Flapping after HA failoverBFD detecting the brief outage during failoverEither disable BFD for HA scenarios, increase BFD multiplier, or rely on GR
Redistributed routes not appearing in BGPMissing redistribution profile or export ruleCreate redistribution profile AND an export rule that allows redistributed routes
Next-hop unreachable for iBGP routesiBGP preserves next-hop by defaultUse next-hop-self equivalent: import rule action to set next-hop, or ensure next-hop is in IGP

Redistribution on PAN-OS

PAN-OS handles redistribution via Redistribution Profiles (which routes to redistribute) and Export Rules (which redistributed routes to actually advertise).

StepWhereWhat
1Redistribution ProfileDefine which connected/static/OSPF routes to pull into BGP
2Export RuleAllow the redistributed routes to be advertised to BGP peers

Both are required. A redistribution profile without a matching export rule means the routes are pulled into BGP internally but never advertised.