topic Re: Conditional Advertisement, Revert Back Options in Next-Generation Firewall Discussions

Conditional Advertisement, Revert Back Options

jortiztrb — Wed, 02 Apr 2025 20:48:46 GMT

Good day all, I was working with PA support I may be just be getting confused with the information.

I'm trying to use conditional advertisement to advertise a single subnet via BGP only when another a particular learned route is down. I got this portion working. But, how do I revert back when BGP learned route comes back?

According to PA support this is not possible. They provided the document below but I still asked the question below

Reference document: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEUCA0.

In the scenario explained in the document, once FW-B starts advertising 55.55.55.100 route to FW-C, is there a method to undo this once 100.100.100.0/24 is in the local rib again?

Re: Conditional Advertisement, Revert Back Options

TomYoung — Thu, 03 Apr 2025 17:25:50 GMT

Hi @jortiztrb ,

Could you provide more details? You have conditional advertisement working. Are you saying that when the Non-Exist prefix comes back, the NGFW does not automatically stop advertising the conditional prefix?

Thanks,

Tom

Re: Conditional Advertisement, Revert Back Options

jortiztrb — Thu, 03 Apr 2025 19:21:38 GMT

That is correct. Unless I set it up incorrectly. I was able to get the BGP routes advertised when the monitored route went down. However, after route came back up, BGP was still advertising.

Re: Conditional Advertisement, Revert Back Options

TomYoung — Thu, 03 Apr 2025 23:01:59 GMT

Hi @jortiztrb ,

That doesn't make sense. You may be running into a bug. I have configured BGP Conditional Advertisement on Cisco. If you configure it good enough to advertise the route, then it should automatically withdraw it.

Here is a good blog on the topic. https://blog.davidvassallo.me/2013/04/04/palo-alto-networks-implementing-conditional-advertising-in-bgp/ He says

"And turning it [ the monitored route ] back on reverses it, advertising only to GM, our primary peer." When the conditional prefix is not withdrawn, what does the "show routing protocol bgp policy cond-adv" show? He says you "may need to disable the primary ISP bgp peer, commit, and re-enable the bgp peer." That's a pain.

Thanks,

Tom