Finding a rogue IP in Prisma SD-WAN

TKlausen2 — Wed, 01 Jun 2022 16:43:25 GMT

Greetings.

Looks like someone misconfigured a global/local slider and we're receiving a /32 IP address in the BGP route table from the Data Center IONs. I'd like to identify the offending site quickly - is there an easy way to locate an IP by site using the portal?

Re: Finding a rogue IP in Prisma SD-WAN

PavelK — Wed, 08 Jun 2022 21:38:25 GMT

Thank you for the post @TKlausen2

maybe there is a better way to do it, but on top of my head I can think of below options:

Advertising router ID / AS number

Login to SD-WAN portal, then navigate to: Maps > Claimed Devices, then click on any appliance, then a new page will open:

After you click on remote session, a new page will open where you can login from CLI. Authenticate with elem-admin, then issue: "dump routing route prefix=X.X.X.X/32" where X.X.X.X is the prefix you are tracking down. Reference is here: https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/prisma-sd-wan-ion-cli-reference/use-cli-commands/dump-commands/dump-routing-route

In this output, you will see the router ID as well as AS of the device that advertised that prefix:

If you know to what router/site that router ID / AS number belongs, then you go to that site and fix it. If you do not know that information, you can still find it from SD-WAN portal from: Manage > Setup > Devices > Claimed > Select a device > Routing > BGP/Peers > BGP Global Config for ION device. If you have hundreds of devices, this might however be a time consuming and equals to searching that slider misconfiguration manually device by device.

Audit Log

An alternative way might be to search in audit log to track down recent changes. Reference: https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/prisma-sd-wan-admin/prisma-sd-wan-administrator-authorization-and-authentication/audit-logs

Kind Regards

Pavel

Re: Finding a rogue IP in Prisma SD-WAN

kn — Tue, 14 Jun 2022 06:32:07 GMT

From the DC device try the below commands

#dump prefix reachability prefix=x.x.x.x/32

this will give you path id from which its learning the prefixes and then try

#inspect fib vpn pathid=zzzzzzzzzz
the above command will give you the site name. |

topic Re: Finding a rogue IP in Prisma SD-WAN in Prisma SD-WAN Discussions

Finding a rogue IP in Prisma SD-WAN

Re: Finding a rogue IP in Prisma SD-WAN

Re: Finding a rogue IP in Prisma SD-WAN