- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
04-24-2025 10:51 AM
Hi Folks....requesting anyone's Palo Alto FW troubleshooting expertise:
In one of our implementations, we ran into some BGP session establishment issues and that delayed the change a lot as we couldn't figure out the issue.
The issue was the BGP authentication failed. Once we disabled BGP authentication, BGP session got established.
Is there a way to troubleshoot such an issue when BGP session fails to come up on Palo Alto FWs?
Can we do sort of a tcpdump (or any other debugging utility) to find out the reasons why BGP session fails to establish?
In Cisco IOS this can be easily done and the debug outputs clearly identify the problem.
Any and all responses will be highly appreciated!!!
Thanks very much.
04-24-2025 08:53 PM
Hi @azizislam ,
Since BGP between your PA and the peer established after removing auth, that strongly suggests a secret mismatch. You can quickly check BGP logs in the GUI by searching the system logs (Monitor -> Logs -> System). Run a ( subtype eq 'routing' ) or a ( subtype eq 'routing' ) and (eventid eq 'bgp'). You can find status messages as your PA attempts to establish adjacency. Id use the GUI to catch low-hanging fruit errors like misconfigurations/tcp connectivity.
If you need to dig further, you can run:
show routing protocol bgp peer input.peer.ip.here (you can check out the session state and errors)
If nothing is apparent from system logs, show routing protocol, then you can run a:
tail follow yes mp-log routed.log (all kinds of notification messages, peer state info, errors, resets, etc.) Similar to running a debug ip bgp command on IOS. You can correlate these logs with peer debug logs and packet captures between your PA and the peer.
04-24-2025 08:57 PM
Hello @azizislam
on the top of what Jay mentioned, I would recommend to check logs: less mp-log routed.log (KB for reference: BGP Not Working after MD5 Key is Changed) and for debugging with PCAP, I would refer to Tips & Tricks: Enabling Packet Captures to Troubleshoot Daemons.
Kind Regards
Pavel
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!