BGP Session flaps for every 3 minutes - PAN OS

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

BGP Session flaps for every 3 minutes - PAN OS

L1 Bithead

Hi Team,

 

We have a BGP running over IPSec VPN. The VPN is terminated between PA 5250 and SDN Gateway. The VPN is running fine but the BGP session is flapping for every 3 minutes. Normally this behavior observed due to MTU size detection in during PMTUD in Cisco devices.  Please help me to troubleshoot this further in the Palo Alto Firewall side.

 

(active)> show routing protocol bgp peer peer-name ClientName-Int

==========
Peer: ClientName-Int (id 4)
virtual router: ClientName
Peer router id: 10.33.0.2
Remote AS: 64512
Peer group: PG_ClientName_Int (id 18)
Peer status: Established, for 179 seconds
Password set: no
Passive: no
Multi-hop TTL: 4
Remote Address: 10.33.0.2:179
Local Address: 10.204.22.230:53976
(R) reflector client: not-client
same confederation: no
send aggr confed as-path: yes
peering type: Unspecified
Connect-Retry interval: 1
Open Delay: 0
Idle Hold: 15
Prefix limit: 5000
Holdtime: 180 (config 3600)
Keep-Alive interval: 1 (config 30)
Update messages: in 780, out 18513
Total messages: in 3103, out 19697
Last update age: 23
Last error: HoldTimer expired (4)
Flap counts: 4655, established 390 times
(R) ORF entries: 0
Nexthop set to self: no
use 3rd party as next-hop: yes
override nexthop to peer: no
----------
remove private AS number: yes
----------
Capability: Multiprotocol Extensions(1) value: IPv4 Unicast
Capability: Route Refresh(yes)
----------
Prefix counter for: bgpAfiIpv4 / unicast
Incoming Prefix: Accepted 48, Rejected 2, Policy Rej 0, Total 50
Outgoing Prefix: 1513
Advertised Prefix: 264

(active)> show routing protocol bgp peer peer-name ClientName-Int

==========
Peer: ClientName-Int (id 4)
virtual router: ClientName
Peer router id: 10.33.0.2
Remote AS: 64512
Peer group: PG_ClientName_Int (id 18)
Peer status: Idle, for 0 seconds
Password set: no
Passive: no
Multi-hop TTL: 4
Remote Address: 10.33.0.2
Local Address: 10.204.22.230
(R) reflector client: not-client
same confederation: no
send aggr confed as-path: yes
peering type: Unspecified
Connect-Retry interval: 1
Open Delay: 0
Idle Hold: 15
Prefix limit: 5000
Holdtime: 180 (config 3600)
Keep-Alive interval: 1 (config 30)
Update messages: in 780, out 18513
Total messages: in 3104, out 19697
Last update age: 0
Last error: HoldTimer expired (4)
Flap counts: 4656, established 390 times
(R) ORF entries: 0
Nexthop set to self: no
use 3rd party as next-hop: yes
override nexthop to peer: no
----------
remove private AS number: yes
----------

2 REPLIES 2

Cyber Elite
Cyber Elite

Hi @Naspers ,

- Have you compare all timers between the PAN FW and Cisco? I believe some of the BGP timers default values are different for the two vendors

- Have you tried to run packet capture for the BGP session on the PAN FW?

L1 Bithead

Hi Astardzheiv,

 

The peer end is actually SDN gateway. We can see there is a BGP notification message is being sent from SDN gateway to Palo alto for hold timers, then BGP is going to idle state. The flap is happening exactly after 180 seconds and it is idle for 15 seconds and established again every time. Is it might be SDN gateway have 180 seconds as in the timer and its trying to re-established every time.

Naspers_2-1637407324017.png

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!