06-12-2019 07:24 PM
I am really struggling with this. I have been at it for hours. I have two Palo Altos in standalone mode both forwarding traffic.I have connected to each palo cisco 9500s and Cisco 9300s. These are not fully meshed. So i know that I am going to need RR.
I cannot for the life of me get peering to work on the loopback interfaces of the palos. The session never forms on the Cisco switches. Do I need to create a policy for this traffic to pass?
I am running OSPF between all devices and redistributing connected routes only allowing the the loopbbacks. So on all the switches I see these all the looback addresses. The Palos also see them so I know OSPF is working. Then when i try to peer bgp with loopbacks it never forms. I am using update-source loopback on the Cisco side but i am not sure that exists on the Palo side.
I see the loopback in the local rib on the palo but not rib out. so i assume thats why its not working?
06-13-2019 08:38 AM
Hello,
Are the Loopback interfaces in the same zone? If not you will need policies. I say create a new policy as number 1 to allow the traffic and select logging at start and end. The other option would be to do a pcap to see if the packets are getting to the PAN and where they are getting dropped.
Regards,
06-18-2019 10:51 AM
So this was it. Zone to Zone allowing of app BGP was needed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
