topic Re: BGP Communities in Palo Alto Firewall in General Topics

BGP Communities in Palo Alto Firewall

nanukanu — Fri, 03 Jan 2020 14:30:33 GMT

Hi,

It's possible to use well-known communities in Palo Alto like in Cisco Router? I mean, community no-export, no-advertise, local-as or Internet.

We need to propagate some routes to a peer but indicate to that peer that don't propagate outside the AS.

Thank you in advance,

Re: BGP Communities in Palo Alto Firewall

OtakarKlier — Fri, 03 Jan 2020 16:01:13 GMT

Hello,

The PAN routing can be filtered via route redistribution. Take a look at the following and see if it answers your question.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkmCAC

Regards,

Re: BGP Communities in Palo Alto Firewall

nanukanu — Fri, 03 Jan 2020 16:05:58 GMT

Hi,

Thank you for your time.

That doesn't solve our problem. There is no way to set "well-known" communities on your link, just standard communities like xxx:yyy.

So, maybe isn't posible to do that?

Thank you ,

Re: BGP Communities in Palo Alto Firewall

OtakarKlier — Fri, 03 Jan 2020 16:18:26 GMT

Hello,

Good questions. I'm not a BGP expert, however you could reach out to your SE and they can ask other SE's to see if they know. Or you can enter a TAC case and I'm sure you can get your answer that way.

Sorry I couldnt help more.

Re: BGP Communities in Palo Alto Firewall

cfistik — Wed, 08 Jan 2020 21:49:10 GMT

Yes, it is possible. Under Virtual Router select BGP -> Export -> Action:

Hope that helps.

Re: BGP Communities in Palo Alto Firewall

nanukanu — Thu, 16 Jan 2020 09:24:33 GMT

Hi,

Sorry for the late answer.

Finally we will try to solve using standard BGP attributes:

NO_EXPORT (0xFFFFFF01)
NO_ADVERTISE (0xFFFFFF02)
NO_EXPORT_SUBCONFED (0xFFFFFF03)
NOPEER (0xFFFFFF04)

Thank you for the responses,

Re: BGP Communities in Palo Alto Firewall

B_Young — Thu, 30 Jan 2020 17:43:50 GMT

The Community drop down box is misleading in that it seems like the original choices are your only choices. What Palo doesn't tell you is that you can just enter your ASN:NN community and it will accept it.

The drop down box will then display the community that you entered for future choices.