BGP sessions reset or not - Active-Standby HA

Retr0_Jase — Sun, 08 Dec 2024 23:48:55 GMT

Hello All,

I have a few BGP related questions regarding Palo Alto Network firewalls HA active-standby setup.

Scenario:

* eBGP to internal/trust network

* static default route for WAN/untrust side

* floating IPs are used

Qs:

1. During failover, is the the BGP session state re-established on the passive firewall? That is, the BGP session is not synced over HA1 (control plane) to the standby (new 'active').

2: I guess BGP routing table (RIB) is synced over HA1 and BGP graceful restart can help maintain the FIB (i.e. best routes are not withdrawn from FIB of standby firewall that is the new 'active') ? Please confirm.

Thanks in advance community.

Jase

Re: BGP sessions reset or not - Active-Standby HA

reaper — Tue, 10 Dec 2024 09:18:57 GMT

Hi Jase

1. after a failover BGP needs to re-establish neighborship

2. the RIB is not synced, the FIB is synced over HA1

Reference: HA Synchronization

topic Re: BGP sessions reset or not - Active-Standby HA in Next-Generation Firewall Discussions

BGP sessions reset or not - Active-Standby HA

Re: BGP sessions reset or not - Active-Standby HA