topic Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing in VM-Series in the Public Cloud

Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

hafeezy2j — Tue, 11 Feb 2020 16:35:44 GMT

Hello, currently doing a POC for Transit VPC setup in AWS with VM-Series firewalls and noticed that default route is not propagated on subscriber VPC routing tables. All the other subnets are propagating. Followed https://www.paloaltonetworks.com/resources/guides/aws-transit-vpc-model-deployment-guide as is but I'm using PAN-OS 9.1 and in the guide they have used 8.1.4. Any idea what could I have been missing?

show routing protocol bgp rib-out command doesn't show the default (0.0.0.0/0) either.

Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

jmeurer — Tue, 11 Feb 2020 16:45:46 GMT

There is an additional step necessary to export the 0/0 route. Please have a look at this article.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltUCAS

Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

hafeezy2j — Tue, 11 Feb 2020 18:00:20 GMT

@jmeurer Just tried that and it didn't work.It removed more specific routes which were propagated before.

Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

jmeurer — Tue, 11 Feb 2020 18:07:00 GMT

Do you have an existing 0/0 static in the VPC route table? We will not override that route.

Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

hafeezy2j — Tue, 11 Feb 2020 20:12:38 GMT

@jmeurer Show routing protocol bgp rib-out doesn't even show 0/0 default route. Pan-os 9.1 has additional setting which I'm missing. I have deployed similiar setup with 8.1.4 (later upgraded to 9.0.6) and it works as expected.

Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

jmeurer — Wed, 12 Feb 2020 01:23:24 GMT

at this point, it might be good to get a TAC case open. I have not tried Transit VPC with 9.1.

I would be curious, if you add a static route in the vpc pointing to the vgw, does the traffic flow?

Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

dmaynard — Wed, 12 Feb 2020 02:21:32 GMT

@jmeurer Transit VPC is community supported not TAC supported.

For additional clarification:

As this is related to route propagation with the VM-Series firewall it would be TAC supported for assistance within the PA-VM.

Issues related to deployment and automation for transit Arch would open issue in github.

For assistance open issue in github.

https://github.com/PaloAltoNetworks/aws-transit-vpc

Re: Default route is not distributed to subscriber VPC - Bgp/Dynamic routing

jmeurer — Wed, 12 Feb 2020 06:11:44 GMT

I labbed it with a single firewall running 9.1 and the 0/0 exported to the VPC route table as expected. Please post screenshots of your VR BGP settings and AWS route table for review.

Where is your 0/0 route configured in your firewall? Do you have a static to the first IP in the subnet or do you have DHCP configured to Automatically create the default route?