topic Re: Does BGP need to be on a separate virtual router ? in General Topics

Does BGP need to be on a separate virtual router ?

gefuchs — Thu, 25 Oct 2018 13:51:09 GMT

I'm currently using rip in a single virtual router. I'm adding BGP for a Microsoft Express Route circuit. I have a consultant to assist in the BGP setup. He says the BGP needs to be in a separate virtual router. Is there a reason for this that anyone knows ? His answer is PaloAlto requires it. ???

PA3020.

TIA,

Greg

Re: Does BGP need to be on a separate virtual router ?

OtakarKlier — Thu, 25 Oct 2018 18:53:34 GMT

Hello,

A seoerate VR is not required to my knowledge.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/networking/bgp

Regards,

Re: Does BGP need to be on a separate virtual router ?

MP18 — Fri, 26 Oct 2018 04:59:24 GMT

No VR is not required for BGP.

Re: Does BGP need to be on a separate virtual router ?

Raido_Rattameister — Fri, 26 Oct 2018 19:57:42 GMT

BGP runs fine with one virtual router.

What is consultants claim? That BGP in general needs seperate VR or because you have RIP already?

Re: Does BGP need to be on a separate virtual router ?

pulukas — Sat, 27 Oct 2018 23:48:09 GMT

VR are needed when you need to isolate groups of routes that you don't want to propogate everywhere on the network. I suspect we are missing some element of your topology and routing requirements that make putting the Azure Express Routes in an isolated instance.

What is the toplogy and what segments need to communicate with Azure across this connection?

Re: Does BGP need to be on a separate virtual router ?

gefuchs — Mon, 29 Oct 2018 14:41:51 GMT

My topology is pretty simple. Core L3 switch with a half dozen vlans.

There is no requirement for isolation.

In fact I'm trying to figure out how this could work.

Part of what we are doing is connecting to the MS public PAS services such as Data Warehouse.

Using route filters we only get routing to the East Central region public addresses via the BGP session with Azure.

Since the BGP router has those routes, how would a workstation connected to the other VR know how to get to the Data Warehouse in East Central using the Express Route circuit.

There is no requirement for a separate VR other than consulant speak saying that's the way to do it.

Re: Does BGP need to be on a separate virtual router ?

pulukas — Thu, 01 Nov 2018 10:02:48 GMT

It sounds like the VR is not a requirement for you then. These would typically be used in your setup if you had only a segment of your network that would access the express route path. This is usually a Data Center area of the network. While the rest of the network should not see the routes or have access.

Importing the routes to a separate VR then makes it easy to control their redistribution on your company network to only thoese areas that need the access and nowhere else.

From your description it seems like this is not the case for your company.

Re: Does BGP need to be on a separate virtual router ?

mrzepa2 — Thu, 01 Nov 2018 13:38:49 GMT

You do not need a separate VR unless you are learning routes in BGP that overlap with routes in your existing network. If that is the case, you will have to worry about more that just a separate VR.

Re: Does BGP need to be on a separate virtual router ?

gefuchs — Tue, 06 Nov 2018 17:46:00 GMT

Thanks eveyone.

There was no reason to have a separate VR.

We went live with the Expressroute circuit last week.