BGP
Border Gateway Protocol (BGP) is the primary internet routing protocol. BGP determines network reachability based on IP prefixes that are available within autonomous systems (AS), where an AS is a set of IP prefixes that a network provider has designated to be part of a single routing policy.
In the routing process, connections are established between BGP peers (or neighbors). If a route is permitted by the policy, it is stored in the routing information base (RIB). Each time the local firewall RIB is updated, the firewall determines the optimal routes and sends an update to the external RIB, if export is enabled.
Conditional advertisement is used to control how BGP routes are advertised. The BGP routes must satisfy conditional advertisement rules before being advertised to peers.
BGP supports the specification of aggregates, which combine multiple routes into a single route. During the aggregation process, the first step is to find the corresponding aggregation rule by performing a longest match that compares the incoming route with the prefix values for other aggregation rules.
The firewall provides a complete BGP implementation, which includes the following features:
Specification of one BGP routing instance per virtual router. Routing policies based on route-map to control import, export and advertisement, prefix-based filtering, and address aggregation. Advanced BGP features that include route reflector, BGP Confederations, route flap dampening, and graceful restart. IGP-BGP interaction to inject routes to BGP using redistribution profiles.
BGP configuration consists of the following elements:
Per-routing-instance settings, which include basic parameters such as local route ID and local AS and advanced options such as path selection, route reflector, AS confederation, route flap, and dampening profiles. Authentication profiles, which specify the MD5 authentication key for BGP connections. Authentication helps prevent route leaking and successful DoS attacks. Peer group and neighbor settings, which include neighbor address and remote AS and advanced options such as neighbor attributes and connections. Routing policy, which specifies rule sets that peer groups and peers use to implement imports, exports, conditional advertisements, and address aggregation controls. Configure BGP BGP Confederations
Configure BGP
Perform the following procedure to configure BGP.
Configure BGP
Configure general virtual router configuration settings. See Virtual Routers for details.
Configure standard BGP configuration settings. Select the BGP tab. Select Enable to enable the BGP protocol. For Router ID, assign an IP address to the virtual router. For AS Number, enter the number of the AS to which the virtual router belongs, based on the router ID. Range is 1-4294967295.
Configure general BGP configuration settings. Select BGP > General. Select Reject Default Route to ignore any default routes that are advertised by BGP peers. Select Install Route to install BGP routes in the global routing table. Select Aggregate MED to enable route aggregation even when routes have different Multi-Exit Discriminator (MED) values. Enter a value for the Default Local Preference that specifies a value than can be used to determine preferences among different paths. Select one of the following values for the AS format for interoperability purposes: 2 Byte (default value) 4 Byte Enable or disable each of the following values for Path Selection: Always Compare MED —Enable this comparison to choose paths from neighbors in different autonomous systems. Deterministic MED Comparison —Enable this comparison to choose between routes that are advertised by IBGP peers (BGP peers in the same autonomous system). Click Add to include a new authentication profile and configure the following settings: Profile Name —Enter a name to identify the profile. Secret/Confirm Secret —Enter and confirm a passphrase for BGP peer communications. The Secret is used as a key in MD5 authentication.
( Optional ) Configure BGP Advanced settings. On the Advanced tab, select Graceful Restart and configure the following timers: Stale Route Time (sec) —Specifies the length of time in seconds that a route can say in the stale state (range is 1- 3600; default is 120). Local Restart Time (sec) —Specifies the length of time in seconds that the local device waits to restart. This value is advertised to peers (range is 1-3600’ default is 120). Max Peer Restart Time (sec) —Specifies the maximum length of time in seconds that the local device accepts as a grave period restart time for peer devices (range is 1-3600; default is 120). For Reflector Cluster ID, specify an IPv4 identifier to represent the reflector cluster. For Confederation Member AS, specify the autonomous system number identifier (also called a sub-AS number), which is visible only within the BGP confederation. Click Add and enter the following information for each Dampening Profile that you want to configure, select Enable, and click OK: Profile Name —Enter a name to identify the profile. Cutoff —Specify a route withdrawal threshold above which a route advertisement is suppressed (range is 0.0-1000.0; default is 1.25). Reuse —Specify a route withdrawal threshold below which a suppressed route is used again (range is 0.0-1000.0; default is 5). Max Hold Time (sec) —Specify the maximum length of time in seconds that a route can be suppressed, regardless of how unstable it has been (range is 0-3600 seconds; default is 900). Decay Half Life Reachable (sec) —Specify the length of time in seconds after which a route’s stability metric is halved if the route is considered reachable (range is 0-3600 seconds; default is 300). Decay Half Life Unreachable (sec) —Specify the length of time in seconds after which a route’s stability metric is halved if the route is considered unreachable (range is 0-3600; default is 300). Click OK.
Configure the BGP peer group. Select the Peer Group tab and click Add. Enter a Name for the peer group and select Enable. Select Aggregated Confed AS Path to include a path to the configured aggregated confederation AS. Select Soft Reset with Stored Info to perform a soft reset of the firewall after updating the peer settings. Specify the type of peer or group from the Type drop-down and configure the associated settings (see below in this table for descriptions of Import Next Hop and Export Next Hop). IBGP Export Next Hop: Specify Original or Use self EBGP Confed Export Next Hop: Specify Original or Use self EBGP Confed Export Next Hop: Specify Original or Use self EBGP Import Next Hop: Specify Original or Use self, Export Next Hop: Specify Resolve or Use self. Select Remove Private AS if you want to force BGP to remove private AS numbers. Click OK to save.
Configure a BGP peer that belongs to the peer group and specify its addressing. Select Network > Virtual Routers and select a virtual router. Select BGP > Peer Group and select the peer group you created. For Peer, Add a peer by Name. Select Enable to activate the peer. Enter the Peer AS to which the peer belongs. Select Addressing. For Local Address, select the Interface for which you are configuring BGP. If the interface has more than one IP address, enter the IP address for that interface to be the BGP peer. For Peer Address, enter the IP address of the BGP peer. Click OK.
Configure connection settings for the BGP peer. Select Network > Virtual Routers and select a virtual router. Select BGP > Peer Group and select the peer group you created. Select the Peer you configured. Select Connection Options. Select an Auth Profile for the peer. Set a Keep Alive Interval (sec), the interval (in seconds) after which routes from the peer are suppressed according to the Hold Time setting (range is 0-1,200; default is 30). Set Multi Hop, the time -to-live (TTL) value in the IP header (range is 1-255; default is 0. The default value of 0 means 2 for eBGP prior to PAN-OS 7.1.9, and it means 1 beginning with PAN-OS 7.1.9. The default value of 0 means 255 for iBGP). Set Open Delay Time (sec), the delay in seconds between a TCP handshake and the firewall sending the first BGP Open message to establish a BGP connection (range is 0-240; default is 0). Set Hold Time (sec), the length of time in seconds that may elapse between successive Keepalive or Update messages from the peer before the peer connection is closed (range is 3-3600; default is 90). Set Idle Hold Time (sec), the length of time to wait (in seconds) before retrying to connect to the peer (range is 1-3600; default is 15). For Incoming Connections, enter a Remote Port and select Allow to allow incoming traffic to this port. For Outgoing Connections, enter a Local Port and select Allow to allow outgoing traffic from this port. Click OK.
Configure the BGP peer with settings for route reflector client, peering type, maximum prefixes, and Bidirectional Forwarding Detection (BFD). Select Network > Virtual Routers and select a virtual router. Select BGP > Peer Group and select the peer group you created. Select the Peer you configured. Select Advanced. For Reflector Client, select one of the following: non-client —Peer is not a route reflector client (default). client —Peer is a route reflector client. meshed-client For Peering Type, select one of the following: Bilateral —The two BGP peers establish a peer connection. Unilateral —(default). For Max Prefixes, enter the maximum number of supported IP prefixes (range is 1-100,000) or select unlimited. To enable BFD for the peer (and thereby override the BFD setting for BGP, as long as BFD is not disabled for BGP at the virtual router level), select one of the following: default —Peer uses only default BFD settings. Inherit-vr-global-setting (default)—Peer inherits the BFD profile that you selected globally for BGP for the virtual router. A BFD profile you configured—See Create a BFD profile. Selecting Disable BFD disables BFD for the BGP peer. Click OK.
Configure Import and Export rules. The import/export rules are used to import/export routes from/to other routers. For example, importing the default route from your ISP. Select the Import tab and then click Add and enter a name in the Rules field and select Enable. Click Add and select the Peer Group to which the routes will be imported from. Click the Match tab and define the options used to filter routing information. You can also define the Multi-Exit Discriminator (MED) value and a next hop value to routers or subnets for route filtering. The MED option is an external metric that lets neighbors know about the preferred path into an AS. A lower value is preferred over a higher value. Click the Action tab and define the action that should occur (allow/deny) based on the filtering options defined in the Match tab. If Deny is selected, no further options need to be defined. If the Allow action is selected, define the other attributes. Click the Export tab and define export attributes, which are similar to the Import settings, but are used to control route information that is exported from the firewall to neighbors. Click OK to save.
Configure conditional advertising, which allows you to control what route to advertise in the event that a different route is not available in the local BGP routing table (LocRIB), indicating a peering or reachability failure. This is useful in cases where you want to try to force routes to one AS over another, for example if you have links to the internet through multiple ISPs and you want traffic to be routed to one provider instead of the other unless there is a loss of connectivity to the preferred provider. Select the Conditional Adv tab, click Add and enter a name in the Policy field. Select Enable. Click Add and in the Used By section enter the peer group(s) that will use the conditional advertisement policy. Select the Non Exist Filter tab and define the network prefix(es) of the preferred route. This specifies the route that you want to advertise, if it is available in the local BGP routing table. If a prefix is going to be advertised and matches a Non Exist filter, the advertisement will be suppressed. Select the Advertise Filters tab and define the prefix(es) of the route in the Local-RIB routing table that should be advertised in the event that the route in the non-exist filter is not available in the local routing table. If a prefix is going to be advertised and does not match a Non Exist filter, the advertisement will occur.
Configure aggregate options to summarize routes in the BGP configuration. BGP route aggregation is used to control how BGP aggregates addresses. Each entry in the table results in one aggregate address being created. This will result in an aggregate entry in the routing table when at least one or more specific route matching the address specified is learned. Select the Aggregate tab, click Add and enter a name for the aggregate address. In the Prefix field, enter the network prefix that will be the primary prefix for the aggregated prefixes. Select the Suppress Filters tab and define the attributes that will cause the matched routes to be suppressed. Select the Advertise Filters tab and define the attributes that will cause the matched routes to always be advertised to peers.
Configure redistribution rules. This rule is used to redistribute host routes and unknown routes that are not on the local RIB to the peers routers. Select the Redist Rules tab and click Add. In the Name field, enter an IP subnet or select a redistribution profile. You can also configure a new redistribution profile from the drop-down if needed. Click Enable to enable the rule. In the Metric field, enter the route metric that will be used for the rule. In the Set Origin drop-down, select incomplete, igp, or egp. ( Optional ) Set MED, local preference, AS path limit and community values.
BGP Confederations
BGP confederations provide a way to divide an autonomous system (AS) into two or more sub-autonomous systems (sub-AS) to reduce the burden that the full mesh requirement for IBGP causes. The firewalls (or other routing devices) within a sub-AS must still have a full iBGP mesh with the other firewalls in the same sub-AS. You need BGP peering between sub-autonomous systems for full connectivity within the main AS. The firewalls peering with each other within a sub-AS form an IBGP confederation peering. The firewall in one sub-AS peering with a firewall in a different sub-AS form an EBGP confederation peering. Two firewalls from different autonomous systems that connect are EBGP peers.
Autonomous systems are identified with a public (globally-assigned) AS number, such as AS 24 and AS 25 in the preceding figure. In a PAN-OS environment, you assign each sub-AS a unique Confederation Member AS number, which is a private number seen only within the AS. In this figure, the confederations are AS 65100 and AS 65110. RFC 6996, Autonomous System (AS Reservation for Private Use, indicates that the IANA reserves AS numbers 64512-65534 for private use.)
The sub-AS confederations seems like full autonomous systems to each other within the AS. However, when the firewall sends an AS path to an EBGP peer, only the public AS number appears in the AS path; no private sub-AS (Confederation Member AS) numbers are included.
BGP peering occurs between the firewall and R2; the firewall in the figure has these relevant configuration settings:
AS number—24 Confederation Member AS—65100 Peering Type—EBGP confed Peer AS—65110
Router 2 (R2) in AS 65110 is configured as follows:
AS number—24 Confederation Member AS—65110 Peering Type—EBGP confed Peer AS—65100
BGP peering also occurs between the firewall and R1. The firewall has the following additional configuration:
AS number—24 Confederation Member AS—65100 Peering Type—IBGP confed Peer AS—65110
R1 is configured as follows:
AS number—24 Confederation Member AS—65110 Peering Type—IBGP confed Peer AS—65100
BGP peering occurs between the firewall and R5. The firewall has the following additional configuration:
AS number—24 Confederation Member AS—65100 Peering Type—EBGP confed Peer AS—25
R5 is configured as follows:
AS number—25 Peering Type—EBGP Peer AS—24
After the firewall is configured to peer with R1, R2, and R5, its peers are visible on the Peer Group tab:
The firewall shows the R1, R2, and R5 peers:
To verify that the routes from the firewall to the peers are established, on the virtual router’s screen, select More Runtime Stats and select the Peer tab.
Select the Local RIB tab to view information about the routes stored in the Routing Information Base (RIB).
Then select the RIB Out tab.

Related Documentation