topic Re: BGP Peering Issue in General Topics

BGP Peering Issue

a.jones — Thu, 09 May 2019 15:17:03 GMT

Hi All,

I have an issue with maintening a BGP Establish connection. Essentially the setup is the Palo Alto to two peers to allow for resilience if one BGP peer fails. If one peer is established it stays stable. If I enable the path to the second peer and disable the path to the first peer it remains established and stable. When I enable both BGP paths to establish at both peers at the same time they establish without any problems but then eventually randonmly recycle with a routed-bgp-peer-left established error, re-establishing seconds later.

I have adjusted the Multihop, prepend AS and seperated the peers into seperate peer groups but the issue persists.

Any ideas?

Regards

Adrian

I have it set up and when I peer with

Re: BGP Peering Issue

jeremy.larsen — Thu, 09 May 2019 19:13:24 GMT

1. Do the MTU settings on both ends match?

2. Is this iBGP or eBGP (all have same AS or different)?

3. Are these 2 connections on the same or different subnets?

4. Are these direct/p2p connections or routed through another network?

5. Are you using another IGP like OSPF and pointing to Loopback interfaces?

Re: BGP Peering Issue

a.jones — Fri, 10 May 2019 07:25:42 GMT

Hi Jeremy,

Yes, MTU matches both ends. Individually the sessions stay up, it's only when I have BGP established to the two peers from the Palo Alto. It mainly affects one path with more hops but occassionally the other path drops.

It is an eBGP configuration.

The connections are on a /29 subnet and not different subnets.

They are connected to the router via VRFs, one router is local, the other in another datacentre.

Our routing is entirely eBGP internal and external (2 BGP sessions).

As I said, this works and routes well. It is only when I enable the 2nd peer so we have that BGP resilience that I see this peering drop. Both peering sessions individually are stable if the other is down.

Regards

Adrian

Re: BGP Peering Issue

jeremy.larsen — Thu, 16 May 2019 20:46:04 GMT

I know this is just a shot in the dark, but is ECMP enabled? I don't think this would cause this kind of issue.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/bgp/configure-bgp#

Re: BGP Peering Issue

MartinE — Thu, 01 Aug 2024 13:32:10 GMT

Did you ever find the solution to this? I'm hitting the same problem. One VPN works fine with BGP. Second VPN is also up. But as soon as BGP is enabled on the second VPN, both tunnels start flapping.

Re: BGP Peering Issue

Brandon_Wertz — Tue, 06 Aug 2024 16:13:49 GMT

@MartinE wrote:

Did you ever find the solution to this? I'm hitting the same problem. One VPN works fine with BGP. Second VPN is also up. But as soon as BGP is enabled on the second VPN, both tunnels start flapping.

This thread is 5 years old, I hope it wouldn't be the same issue. What code are you running? Is anything else negative happing to the firewall?

I've got 5250s which multiple BGP peers (2 of which are over an IPsec tunnel) established to different destinations but they're receiving redundant IP space from the distinct peers. There's nothing fancy with the BGP peers, one of them does have auth enabled though.

Re: BGP Peering Issue

SethHolmes — Tue, 10 Sep 2024 08:43:54 GMT

Thank you so much for the link.