topic Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto in General Topics

Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

banksants — Sat, 19 Dec 2020 12:52:32 GMT

Hi,

Does Palo Alto support Cisco BGP neighbor x.x.x.x local-as yyyy feature? or there is any way to achieve the same (Palo Alto FW has a local ASN, but it uses another local ASN just for a specific neighbor)

Thanks!

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

MP18 — Sat, 19 Dec 2020 20:12:34 GMT

@banksants

Are you looking for some CLI command like below ?

t network virtual-router NetGear protocol bgp

+ allow-redist-default-route allow redistribute default route to BGP

+ ecmp-multi-as Support multiple AS in ECMP

+ enable enable

+ enforce-first-as Enforce First AS for EBGP

+ install-route Populate BGP learned route to global route table

+ local-as local AS number

+ reject-default-route do not learn default route from BGP

+ router-id router id of this BGP instance

> auth-profile BGP authentication profiles

> dampening-profile route flap dampening profiles

> peer-group peer group configuration

> policy BGP routing policy configuration

> redist-rules redistribution rules for export through BGP

> routing-options routing instance options

<Enter> Finish input

Regards

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

banksants — Sat, 02 Jan 2021 21:18:09 GMT

Hi MP18,

thanks for the message.

No, I was looking for a feature support, but I have done a workaround as it seems unsupported.

Thanks.

Banksants

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

fatboy1607 — Thu, 07 Oct 2021 11:15:03 GMT

Could you suggest what workaround you did on palo alto firewall to achieve local as thing.

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

mithunmurali2 — Tue, 25 Feb 2025 17:15:11 GMT

anyone who was able to achieve this local-as config through panorama

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

TomYoung — Mon, 23 Jun 2025 17:50:51 GMT

EDIT: This post is wrong. Please ignore.

Hi all,

This feature is available with the Advanced Routing Engine, but that is a big change to make.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/advanced-routing/configure-bgp-on-an-advanced-routing-engine

Thanks,

Tom

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

TomYoung — Mon, 23 Jun 2025 17:45:44 GMT

By the way,

You should be able to have multiple local ASNs with virtual routers (VRs). You can then enable BGP between the VRs. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIpCAK

I am going to do this with a customer and report back. EDIT: This worked great. The one neighbor that required a different ASN is peered on a new VR.

Thanks,

Tom

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

JessePeden — Mon, 23 Jun 2025 16:16:52 GMT

No it's not. This is not the same as defining your local ASN at the base level of your BGP instance. The "Local-AS" feature is essentially a way to masquerade your instance ASN as another ASN. For example, if your instance's ASN is 65100 and you need to peer with someone that is using 65100 for another peering they have, or they require using a non-private ASN, you can use the "Local-AS" feature to alter your ASN specifically for that peering without changing your instance ASN and breaking any other peerings you have. Palo Alto PAN-OS does not support this feature.

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

TomYoung — Mon, 23 Jun 2025 16:35:00 GMT

Hi @JessePeden ,

Palo Alto PAN-OS does not support this feature.

Did you see the URL I posted above? It should be supported in the Advanced Routing Engine.

No it's not. This is not the same as defining your local ASN at the base level of your BGP instance.

I know what local-as means and what it does. Creating a new VR with a new BGP ASN will allow you to configure the new peering with the neighbor that requires the different ASN. All the original neighbors remain on the old VR. This is an effective workaround. I just did it with a customer. You can enable BGP between the VRs to facilitate routing.

Thanks,

Tom

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

JessePeden — Mon, 23 Jun 2025 17:10:28 GMT

Did you see the URL I posted above? It should be supported in the Advanced Routing Engine.

I'm aware of the Advanced Routing Engine and have it enabled on every PA setup I manage right out of the gate. The feature is not there, and I'm not sure where you're getting the info as it's not mentioned in the article you linked (unless I missed it somehow - maybe you can share the exact line mentioning it).

Creating a new VR with a new BGP ASN will allow you to configure the new peering with the neighbor that requires the different ASN. All the original neighbors remain on the old VR. This is an effective workaround. I just did it with a customer. You can enable BGP between the VRs to facilitate routing.

I'm sure that works fine as a workaround, and I had made no mention of it in my original response - only that of the "local-as" feature being non-existent in PAN-OS (in both the LRE and ARE). I'm in a situation where I'll either need to look into doing the same thing, though, or do my peering on the Cisco switches instead of the PA units if I can't get BGP working in a separate logical router.

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

TomYoung — Mon, 23 Jun 2025 17:49:51 GMT

Hi @JessePeden ,

You are right. It is not in the URL, and therefore not supported by Palo Alto. I thought I saw it there but was mistaken. I will delete that post if I can.

Thanks,

Tom

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

JessePeden — Mon, 23 Jun 2025 18:01:42 GMT

Dang. I was hoping that I was the one that was wrong, truthfully, as there's zero reason (in my book) for Palo Alto not to support that feature.