BGP Communities in Palo Alto Firewall

[nanukanu]

Hi,

It's possible to use well-known communities in Palo Alto like in Cisco Router? I mean, community no-export, no-advertise, local-as or Internet.

We need to propagate some routes to a peer but indicate to that peer that don't propagate outside the AS.

Thank you in advance,

[OtakarKlier]

Hello,

The PAN routing can be filtered via route redistribution. Take a look at the following and see if it answers your question.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkmCAC

Regards,

[nanukanu]

Hi,

Thank you for your time.

That doesn't solve our problem. There is no way to set "well-known" communities on your link, just standard communities like xxx:yyy.

So, maybe isn't posible to do that?

Thank you ,

[OtakarKlier]

Hello,

Good questions. I'm not a BGP expert, however you could reach out to your SE and they can ask other SE's to see if they know. Or you can enter a TAC case and I'm sure you can get your answer that way.

Sorry I couldnt help more.

[cfistik · Accepted solution]

Yes, it is possible. Under Virtual Router select BGP -> Export -> Action:

Hope that helps.

[nanukanu]

Hi,

Sorry for the late answer.

Finally we will try to solve using standard BGP attributes:

• NO_EXPORT (0xFFFFFF01)
• NO_ADVERTISE (0xFFFFFF02)
• NO_EXPORT_SUBCONFED (0xFFFFFF03)
• NOPEER (0xFFFFFF04)

Thank you for the responses,

[B_Young]

The Community drop down box is misleading in that it seems like the original choices are your only choices.  What Palo doesn't tell you is that you can just enter your ASN:NN community and it will accept it.

The drop down box will then display the community that you entered for future choices.