topic Re: BGP Peering Issue in General Topics

BGP Peering Issue

WillWylie — Tue, 15 Sep 2015 14:36:19 GMT

I have a PA connected to my upstream provider exactly how it is with the same provider at two other locations, but I cannot for the life of me get BGP to establish. I've got a case open, but they're being hilarious slow and only responding with canned redundant questions and management is getting impatient.

Is there a way to turn on debugging with these to tell me what the hell is going on? I'm using eBGP, no multi-hop (direct connection), Peer is configured correctly, verified matched ASN's with my provider. I see packets coming and going on 179 between me and my PER, but thats all I see, there is nothing in the System, Configuration or Traffic Logs.

Re: BGP Peering Issue

OtakarKlier — Tue, 15 Sep 2015 14:42:10 GMT

For testing, create a policy that looks for all BGP traffic in the zone you have BGP configured (I'm assuming untrust). This should capture all the traffic for BGP and hopefully get you the answers.

Also check your runtime stast for the virtual router, Network->Virtual Router->More Runtime Stats (its a column, dont open the virtual router).

Hope this helps.

Re: BGP Peering Issue

WillWylie — Tue, 15 Sep 2015 14:59:26 GMT

I've got a profile for it already, and I'm seeing two way traffic on destination port 179, PCAP's aren't matching though for whatever reason.

The Runtime Stats are showing me slowly incrementing "Status Flap Counts", but I'm not seeing any incoming or outgoing messages.

Security on this is pretty basic. The BGP peer is on my "MPLS" zone which is wide open to my trusted zones with no NATs.

Re: BGP Peering Issue

OtakarKlier — Tue, 15 Sep 2015 15:07:26 GMT

Since you have double checked your settings. I would get the provider on the phone and demand an engineer to work with you. I've been given th erun around with ISP's too many times and have been provided too much incorrect info to not be hesitant about calling them and working directly with an engineer.

Re: BGP Peering Issue

WillWylie — Tue, 15 Sep 2015 15:10:08 GMT

The engineer for my provider has been more helpful than PA has at this point.

I should mention, this was a working BGP relationship before we cut it over from a Cisco ISR to a PA-500. All settings have been verified while I was on the phone with them, there is no authentication.

Re: BGP Peering Issue

OtakarKlier — Tue, 15 Sep 2015 16:02:13 GMT

Then I would hammer PAN support and make them give you an engineer to work with. Call you sales or sales engineer if support is not cooperating. If you ask me, its a critical issues since its a network down status.

Re: BGP Peering Issue

RFalconer — Mon, 21 Sep 2015 18:55:48 GMT

What version of code are you running?

I had some odd issues with BGP where the GUI looked like it was configured correctly but there were several lines missing when I examined the CLI.

The problems I had were a little different than you have described but it might be worth looking at.