topic BGP peers transit sessions flapping in General Topics

BGP peers transit sessions flapping

TranceforLife — Fri, 14 Jul 2017 11:04:24 GMT

Hi Guys,

PA-5050 is a transit device for four BGP peers. Had no flapping since 2015 on PAN-OS 6.0.12. After upgrade from 6.0.12 > 7.0.11 BGP peering no longer stable:

Can anyone advise something? Apart of the increasing a timeout session under the application what else l could check/modify? Session end reason is "aged-out"

Application version 619-3583 (10/05/16)

ping: @pulukas

With warm regards,

Myky

Re: BGP transit peerings flapping

TranceforLife — Sat, 18 Mar 2017 15:18:17 GMT

Anyone with the similar issue?

Re: BGP transit peerings flapping

pulukas — Sun, 19 Mar 2017 16:08:42 GMT

Also had no problems running BGP peering sessions through a PA on version 6. But don't have any current production access to that kind of setup for PanOS 7 to compare.

I assume that the version upgrade was the only change.

What do the BGP logs show as the reason for loss?

Are you running BFD on the sessions, if so what do those logs show?

Are there other symptoms of traffic issues on the link?

I would definately open an official TAC case on this type of issue too.

Re: BGP transit peerings flapping

TranceforLife — Tue, 21 Mar 2017 09:08:03 GMT

@pulukas Thanks for coming back to me. Appreciate it. l am still doing some research on thins. Will get back here once have more information. Session end reason for Palo logs is "aged-out"

Re: BGP transit peerings flapping

TranceforLife — Tue, 04 Apr 2017 14:08:25 GMT

The problem resolved itself!

Re: BGP transit peerings flapping

TranceforLife — Fri, 14 Jul 2017 08:19:07 GMT

Hi All,

PA-5050 7.1.8

I am back here guys. This issue is getting interesting. BGP flapping only happens after the failover test (every month we do failover test) and almost exactly after 5 hours (after the test) BGP peers flapping occur. Our topology below:

Cisco Nexus (BGP Peer) <---------------------> PA HA <-------------------> (BGP Peer) Cisco Nexus
( BGP transit sessions,
failover test)

Failover test logs at 6:12

5 hours after BGP flapping logs from Nexus and PA (transit session):

Don't understand why this is happening. During the month (between the failover tests) BGP peers are stable (no flaps).

Any ideas, guys?

Thx,

Myky

Re: BGP transit peerings flapping

TranceforLife — Mon, 17 Jul 2017 18:35:58 GMT

With TAC (00705852),

BGP Application has 5 hours session timeout interval (in Palo database). My guess is that after the failover test BGP timeout timer is not getting refreshed by Palo own session, so the session is happily active for 5 hours between the BGP peers (hello times exchanged but ignored by Palo).

After 5 hours Palo ends the session, BGP peers immediately re-establish the session and after the new session, Palo keeps refresh age-out timer.