topic Re: BGP Session Establishment Troubleshooting on Palo Alto? in General Topics

BGP Session Establishment Troubleshooting on Palo Alto?

azizislam — Thu, 24 Apr 2025 17:51:48 GMT

Hi Folks....requesting anyone's Palo Alto FW troubleshooting expertise:

In one of our implementations, we ran into some BGP session establishment issues and that delayed the change a lot as we couldn't figure out the issue.

The issue was the BGP authentication failed. Once we disabled BGP authentication, BGP session got established.

Is there a way to troubleshoot such an issue when BGP session fails to come up on Palo Alto FWs?

Can we do sort of a tcpdump (or any other debugging utility) to find out the reasons why BGP session fails to establish?

In Cisco IOS this can be easily done and the debug outputs clearly identify the problem.

Any and all responses will be highly appreciated!!!

Thanks very much.

Re: BGP Session Establishment Troubleshooting on Palo Alto?

JayGolf — Fri, 25 Apr 2025 03:53:37 GMT

Hi @azizislam ,

Since BGP between your PA and the peer established after removing auth, that strongly suggests a secret mismatch. You can quickly check BGP logs in the GUI by searching the system logs (Monitor -> Logs -> System). Run a ( subtype eq 'routing' ) or a ( subtype eq 'routing' ) and (eventid eq 'bgp'). You can find status messages as your PA attempts to establish adjacency. Id use the GUI to catch low-hanging fruit errors like misconfigurations/tcp connectivity.

If you need to dig further, you can run:

show routing protocol bgp peer input.peer.ip.here (you can check out the session state and errors)

If nothing is apparent from system logs, show routing protocol, then you can run a:

tail follow yes mp-log routed.log (all kinds of notification messages, peer state info, errors, resets, etc.) Similar to running a debug ip bgp command on IOS. You can correlate these logs with peer debug logs and packet captures between your PA and the peer.

Re: BGP Session Establishment Troubleshooting on Palo Alto?

PavelK — Fri, 25 Apr 2025 03:57:11 GMT

Hello @azizislam

on the top of what Jay mentioned, I would recommend to check logs: less mp-log routed.log (KB for reference: BGP Not Working after MD5 Key is Changed) and for debugging with PCAP, I would refer to Tips & Tricks: Enabling Packet Captures to Troubleshoot Daemons.

Kind Regards

Pavel