Firewall tries to close a BGP/TCP connection with switch

FrancoisNoel — Thu, 02 Jun 2022 14:08:32 GMT

Hi,

The following problem involves a firewall (10.249.0.13) wanting to close a BGP connection with its neighboring switch (10.249.0.14).

The switch answers with a BGP NOTIFICATION message that contains 'No supported AFI/SAFI'. (separate issue) The firewall then sends a FIN to the switch to close the TCP connection. Follows a series of FIN retransmissions from the firewall and ACK retransmissions from the switch.

Is there a way to determine which side is not understanding here?

I have included an excerpt of the .pcap.

Thanks

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Firewall tries to close a BGP/TCP connection with switch

JayGolf — Fri, 03 Jun 2022 01:08:05 GMT

Hi @FrancoisNoel,

Thanks for reaching out. It looks like the switch sent a NOTIFICATION message because it detected an error with the BGP configuration between itself and the Palo. As a result, we see the termination of the adjacency.

The capture tells us there is a misconfiguration in either the switch or the palo. Can you share the configs? Also, it would be helpful to see the full debug to see what AFI and SAFI numbers are being exchanged. For example, the Palo default uses an address class of IPv4 and so if your switch bgp config is set with an address class of IPv6 then that could be an issue.

topic Firewall tries to close a BGP/TCP connection with switch in Next-Generation Firewall Discussions

Firewall tries to close a BGP/TCP connection with switch

Re: Firewall tries to close a BGP/TCP connection with switch