09-15-2015 07:36 AM
I have a PA connected to my upstream provider exactly how it is with the same provider at two other locations, but I cannot for the life of me get BGP to establish. I've got a case open, but they're being hilarious slow and only responding with canned redundant questions and management is getting impatient.
Is there a way to turn on debugging with these to tell me what the hell is going on? I'm using eBGP, no multi-hop (direct connection), Peer is configured correctly, verified matched ASN's with my provider. I see packets coming and going on 179 between me and my PER, but thats all I see, there is nothing in the System, Configuration or Traffic Logs.
09-15-2015 07:42 AM
For testing, create a policy that looks for all BGP traffic in the zone you have BGP configured (I'm assuming untrust). This should capture all the traffic for BGP and hopefully get you the answers.
Also check your runtime stast for the virtual router, Network->Virtual Router->More Runtime Stats (its a column, dont open the virtual router).
Hope this helps.
09-15-2015 07:59 AM
I've got a profile for it already, and I'm seeing two way traffic on destination port 179, PCAP's aren't matching though for whatever reason.
The Runtime Stats are showing me slowly incrementing "Status Flap Counts", but I'm not seeing any incoming or outgoing messages.
Security on this is pretty basic. The BGP peer is on my "MPLS" zone which is wide open to my trusted zones with no NATs.
09-15-2015 08:07 AM
Since you have double checked your settings. I would get the provider on the phone and demand an engineer to work with you. I've been given th erun around with ISP's too many times and have been provided too much incorrect info to not be hesitant about calling them and working directly with an engineer.
09-15-2015 08:10 AM
The engineer for my provider has been more helpful than PA has at this point.
I should mention, this was a working BGP relationship before we cut it over from a Cisco ISR to a PA-500. All settings have been verified while I was on the phone with them, there is no authentication.
09-15-2015 09:02 AM
Then I would hammer PAN support and make them give you an engineer to work with. Call you sales or sales engineer if support is not cooperating. If you ask me, its a critical issues since its a network down status.
09-21-2015 11:55 AM
What version of code are you running?
I had some odd issues with BGP where the GUI looked like it was configured correctly but there were several lines missing when I examined the CLI.
The problems I had were a little different than you have described but it might be worth looking at.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
