BGP Session Establishment Troubleshooting on Palo Alto?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

BGP Session Establishment Troubleshooting on Palo Alto?

L0 Member

Hi Folks....requesting anyone's Palo Alto FW troubleshooting expertise:

In one of our implementations, we ran into some BGP session establishment issues and that delayed the change a lot as we couldn't figure out the issue.

The issue was the BGP authentication failed. Once we disabled BGP authentication, BGP session got established.

Is there a way to troubleshoot such an issue when BGP session fails to come up on Palo Alto FWs? 

 

Can we do sort of a tcpdump (or any other debugging utility) to find out the reasons why BGP session fails to establish? 

 

In Cisco IOS this can be easily done and the debug outputs clearly identify the problem.

 

Any and all responses will be highly appreciated!!!

 

Thanks very much.

2 REPLIES 2

Community Team Member

Hi @azizislam ,

 

Since BGP between your PA and the peer established after removing auth, that strongly suggests a secret mismatch. You can quickly check BGP logs in the GUI by searching the system logs (Monitor -> Logs -> System). Run a ( subtype eq 'routing' ) or a ( subtype eq 'routing' ) and (eventid eq 'bgp'). You can find status messages as your PA attempts to establish adjacency. Id use the GUI to catch low-hanging fruit errors like misconfigurations/tcp connectivity. 

 

If you need to dig further, you can run:

show routing protocol bgp peer input.peer.ip.here (you can check out the session state and errors) 

 

If nothing is apparent from system logs, show routing protocol, then you can run a:

 

tail follow yes mp-log routed.log (all kinds of notification messages, peer state info, errors, resets, etc.) Similar to running a debug ip bgp command on IOS. You can correlate these logs with peer debug logs and packet captures between your PA and the peer. 

 

 

 

 

 

 

 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

Hello @azizislam

 

on the top of what Jay mentioned, I would recommend to check logs: less mp-log routed.log (KB for reference: BGP Not Working after MD5 Key is Changed) and for debugging with PCAP, I would refer to Tips & Tricks: Enabling Packet Captures to Troubleshoot Daemons.

 

Kind Regards

Pavel  

Help the community: Like helpful comments and mark solutions.
  • 453 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!