topic BGP peering on loopbacks, struggle is real in General Topics

BGP peering on loopbacks, struggle is real

Stevenjwilliams83 — Thu, 13 Jun 2019 02:24:44 GMT

I am really struggling with this. I have been at it for hours. I have two Palo Altos in standalone mode both forwarding traffic.I have connected to each palo cisco 9500s and Cisco 9300s. These are not fully meshed. So i know that I am going to need RR.

I cannot for the life of me get peering to work on the loopback interfaces of the palos. The session never forms on the Cisco switches. Do I need to create a policy for this traffic to pass?

I am running OSPF between all devices and redistributing connected routes only allowing the the loopbbacks. So on all the switches I see these all the looback addresses. The Palos also see them so I know OSPF is working. Then when i try to peer bgp with loopbacks it never forms. I am using update-source loopback on the Cisco side but i am not sure that exists on the Palo side.

I see the loopback in the local rib on the palo but not rib out. so i assume thats why its not working?

Re: BGP peering on loopbacks, struggle is real

OtakarKlier — Thu, 13 Jun 2019 15:38:33 GMT

Hello,

Are the Loopback interfaces in the same zone? If not you will need policies. I say create a new policy as number 1 to allow the traffic and select logging at start and end. The other option would be to do a pcap to see if the packets are getting to the PAN and where they are getting dropped.

Regards,

Re: BGP peering on loopbacks, struggle is real

Stevenjwilliams83 — Tue, 18 Jun 2019 17:51:28 GMT

So this was it. Zone to Zone allowing of app BGP was needed.