topic vWire Fails in BGP in General Topics

vWire Fails in BGP

mbs.admin — Wed, 18 Dec 2013 07:37:34 GMT

Hi,

We have a deployment of Palo Alto in vWire mode. But after it was setup, bgp is no longer functioning. I already created an allow all policy but it didn't work as well. Any advise that can help me to make this work?

Thanks,

Rex

Re: vWire Fails in BGP

hyadavalli — Wed, 18 Dec 2013 13:02:12 GMT

Hello Rex,

Please make sure you have two security policies for inbound and outbound traffic.

BGP negotiation can happen from either side.

Regards,

Hari Yadavalli

Re: vWire Fails in BGP

mbs.admin — Thu, 19 Dec 2013 08:42:06 GMT

Hi Hari,

Thanks for the response. We already have that policy but BGP is not working still . Any more suggestions?

Regards,

Rex

Re: vWire Fails in BGP

kiwi — Thu, 19 Dec 2013 09:11:31 GMT

Hi Rex,

Are you seeing any sessions in the traffic log for the BGP traffic ?

You could set up a filter on tcp-port 179 and make a PCAP to see the BGP communication across the vwire. Analysis of the PCAP could be useful in identifying the issue.

Also with the filter in place you can check the global counters on the PAN. These counters could give an indication as to why it is failing.

The following DOC can assist you in setting up filter and checking the global counters :

Packet Capture, Debug Flow-basic and Counter Commands

Kind regards,

-Kim.

Re: vWire Fails in BGP

Phoenix — Thu, 19 Dec 2013 21:23:54 GMT

Hello,

Run the below command multiple times and pass the Bgp traffic.

"show session all filter application bgp"

If we identify the session in Active -> then the session is setup. If in Discard -> it is rejected by certain rule or so. If we do not see any output in the session command then the traffic is not hitting the PAN at all. As informed in the prior update we will have to take packet captures and global counters to see or gain more knowledge if we see the sessions building.

Thanks