topic Re: BGP route is not present on the other region in Next-Generation Firewall Discussions

BGP route is not present on the other region

Khairul.Nizam — Mon, 08 Jan 2024 03:17:36 GMT

This is the representation of the connectivity of my setup.

Inside each region have Palo Alto firewall and Silverpeak appliance.

On each region, between Palo Alto and Silverpeak there is ibgp that been configured. AS number is the same.

On the firewall itself, each AS number is different.

Currently from China, it only have the route to Singapore, but no to Ireland. Why is that ? is it due to Multihop?

Re: BGP route is not present on the other region

seb_rupik — Mon, 08 Jan 2024 09:20:12 GMT

Hi there,

If the peer state between Singapore and Ireland is 'established' then the lack of BGP prefixes is not down to eBGP multihop settings.

Do the BGP RIBs at both sites show prefixes that are being advertised to the other site?

Do BGP prefixes from Singapore appear in the Ireland BGP RIB (not the main routing table) and vice-versa?

cheers,

Seb.

Re: BGP route is not present on the other region

Khairul.Nizam — Tue, 09 Jan 2024 07:42:16 GMT

Route from SG -> IRE and IRE -> is no issues. Both Internal LAN can communicate each other.
The issues here now are from CN LAN, it's not able to reach IRE.

In the China routing table, there is no route to IRE.

Re: BGP route is not present on the other region

seb_rupik — Tue, 09 Jan 2024 15:35:16 GMT

Hello again,

On the Singaport firewall under the runtime stats for the Virtual Router which holds the BGP process, what does the BGP RIB Out look like? Does it show IRE prefixes being advertised to the Singapore peer?

Also on the China firewall, what does the BGP Local RIB look like? Does it show any of the IRE prefixes?

cheers,

Seb.

Re: BGP route is not present on the other region

Khairul.Nizam — Wed, 10 Jan 2024 07:47:43 GMT

In the SG Firewall RIB Out - there is no IRE prefixes

In CN Firewall Local RIB 0 - there is no IRE specific prefix but there is bigger 10.0.0.0/8 prefix

Re: BGP route is not present on the other region

seb_rupik — Wed, 10 Jan 2024 22:19:02 GMT

Hi there,

Do you have a BGP export policy configured on the SG firewall? Can you share any details on the BGP router configuration?

cheers,

Seb.

Re: BGP route is not present on the other region

Khairul.Nizam — Thu, 11 Jan 2024 02:49:28 GMT

Yes there is a Export policy on SG.
I can see one entry that allow the big subnet