topic Viewing BGP traffic logs in General Topics

Viewing BGP traffic logs

iqbal786 — Thu, 30 Dec 2021 01:05:58 GMT

We have BGP setup between our core switches and out Palo Alto FWs but I never see any traffic logs for port 179 or application BGP on the Palo Altos.

How do I go about seeing this traffic ?

Re: Viewing BGP traffic logs

PavelK — Thu, 30 Dec 2021 01:29:12 GMT

Thank you for the post @iqbal786

There is no special setting to enable to see BGP traffic log. As long as BGP peer's traffic is hitting a firewall policy where logging is enabled you will be able to see that traffic in the Traffic log.

I am thinking of 2 reasons why you do not see the log.

- Your BGP traffic might be hitting either: interzone-default or intrazone-default rule where by default logging is not enabled. These rules are located in very bottom and you can override them, then select under actions: Log at session end.

- If you have set BGP peers recently and policy that is being matched has enabled: Log at session end, you will not see any log until BGP peering flaps/resets or you clear BGP peer to end BGP session to generate log. Unless session is ended you will not see any log unless you have enabled Log at session start.

Kind Regards

Pavel

Re: Viewing BGP traffic logs

iqbal786 — Thu, 30 Dec 2021 02:55:39 GMT

So it was the second reason. I didn't realize what what the rule was used for until I broke the network. There were no comments and the rule was overly permissive