topic Re: iBGP Between Palo Alto and Cisco Router in General Topics

iBGP Between Palo Alto and Cisco Router

usaiatawakevou — Thu, 03 Mar 2022 04:58:09 GMT

Got two Cisco ISR 4431 as border routers peering with 2 ISP. Got PA-850 that I need to configure as:

HA
iBGP - OSPF
configured ip unnumbered on the Palo Alto interface connecting to the Cisco

Any configuration example out there that can assist will be really appreciated

Re: iBGP Between Palo Alto and Cisco Router

usaiatawakevou — Fri, 04 Mar 2022 00:32:54 GMT

This is my planned setup

Re: iBGP Between Palo Alto and Cisco Router

rmfalconer — Fri, 04 Mar 2022 17:41:24 GMT

What exactly are you trying to accomplish?

Re: iBGP Between Palo Alto and Cisco Router

usaiatawakevou — Sun, 06 Mar 2022 23:57:03 GMT

I've listed it above on my initial post

Re: iBGP Between Palo Alto and Cisco Router

rmfalconer — Mon, 07 Mar 2022 16:24:59 GMT

You listed what you want to configure, not what you're trying to accomplish.

When you say IP unnumbered, does that mean you want to use vwire? What are you trying to do with OSPF and BGP? Egress and Ingress paths? Full tables/provider table/default? Are there public resources behind the PA? A/A vs A/P? Is there a reason you don't have L2 switch between the FW and routers?

Without knowing what you're trying to do, it's hard to provide any feedback.

Re: iBGP Between Palo Alto and Cisco Router

usaiatawakevou — Fri, 11 Mar 2022 19:23:42 GMT

Thanks for the response.

Current setup:

iBGP using OSPF
eBGP with ISP with prepend configured - working as expected
both ISP send their default but we got route maps for high preference to ISP1
Some static routes and PBR to use ISP2
all working as we want

We will replace pfsense firewall, VPN device and Vyos with a pair of PA-850. Need to accomplish the following:

HA as in active/passive
ip unnumbered so routing convergence when PA failover works smoothly
no switch in the middle to avoid more points of failure. Prefer to connect point to point between device rather than a switch in between
iBGP between Cisco and PA - Not sure how this works with PA and CIsco. Current setup is working between Cisco and Vyos using OSPF as iBGP protocol
PA to handle site-to-site VPN, PBR so some connections go out of ISP2
etc

I've replicate the desired setup on my GNS3 lab however I couldn't figure out how iBGP works and ip unnumbered on PA so my lab is using IP address on point to point interface for now. OSPF between Cisco and PA with HA works but not BGP. When I tried to add peers, showing error as in peer invalid.

Probably there is a way to do this on PA but I'm only familiar with Cisco and Vyos for iBGP hence my request for any pointers or configuration example for similar scenario

Hope Im clear

Thanks

Re: iBGP Between Palo Alto and Cisco Router

TomYoung — Fri, 11 Mar 2022 23:34:57 GMT

Hi @usaiatawakevou ,

PA does not support routing without an IP address. I would put 2 switches in the middle for redundancy, but if you don't want to do that you could configure IRB on the 4431s so that Gi0/0/0 and Gi0/0/1 are in the same subnet.

With regard to BGP, the PA is RFC compliant and can form the iBGP neighbor.

Thanks,

Tom

Re: iBGP Between Palo Alto and Cisco Router

usaiatawakevou — Mon, 14 Mar 2022 11:41:44 GMT

Thanks @TomYoung BVI solve it for me and my iBGP works now. Much apprecaited