BGP peers transit sessions flapping

[TranceforLife]

Hi Guys,

PA-5050 is a transit device for four BGP peers. Had no flapping since 2015 on PAN-OS 6.0.12. After upgrade from 6.0.12 > 7.0.11 BGP peering no longer stable:

Can anyone advise something? Apart of the increasing a timeout session under the application what else l could check/modify? Session end reason is "aged-out"

 Application version    619-3583 (10/05/16)

ping: @pulukas

With warm regards,

Myky

[TranceforLife]

Anyone with the similar issue? 

[pulukas]

Also had no problems running BGP peering sessions through a PA on version 6.  But don't have any current production access to that kind of setup for PanOS 7 to compare.

I assume that the version upgrade was the only change.

What do the BGP logs show as the reason for loss?

Are you running BFD on the sessions, if so what do those logs show?

Are there other symptoms of traffic issues on the link?

I would definately open an official TAC case on this type of issue too.

[TranceforLife]

@pulukas Thanks for coming back to me. Appreciate it. l am still doing some research on thins. Will get back here once have more information. Session end reason for Palo logs is "aged-out" 

[TranceforLife]

The problem resolved itself!

[TranceforLife]

Hi All,

PA-5050 7.1.8

I am back here guys. This issue is getting interesting. BGP flapping only happens after the failover test (every month we do failover test) and almost exactly after 5 hours (after the test) BGP peers flapping occur. Our  topology below:

Cisco Nexus (BGP Peer) <---------------------> PA HA <-------------------> (BGP Peer) Cisco Nexus 
                                                                              ( BGP transit sessions, 
                                                                                            failover test) 

Failover test logs at 6:12

5 hours after BGP flapping logs from Nexus and PA (transit session):

Don't understand why this is happening. During the month (between the failover tests) BGP peers are stable (no flaps).

Any ideas, guys?

Thx,

Myky

[TranceforLife]

With TAC (00705852),

BGP Application has 5 hours session timeout interval (in Palo database). My guess is that after the failover test BGP timeout timer is not getting refreshed by Palo own session, so the session is happily active for 5 hours between the BGP peers (hello times exchanged but ignored by Palo). 

After 5 hours Palo ends the session, BGP peers immediately re-establish the session and after the new session, Palo keeps refresh age-out timer.