Showing results for 
Show  only  | Search instead for 
Did you mean: 


hello i am new to palo alto 

i recently configured bgp on my palo alto pa 500 device and my bgp peer is getting connected and then after a minute it gets disconnected and the bgp state becomes active. also i am using md5 key for authentication. could you please help me with a possible solution or reason. thank you


Community Team Member

Hi @CirrostratusNetworks,


It would help to know how you set it up. 

The forwarding table size for the PA-500 supports upto 1250 entries.


You will need more debugging. 


Start with enabling debug on BGP: 

admin@PA-VM> debug routing pcap bgp on

You can view with: 

admin@PA-VM> debug routing pcap bgp view

or even follow live with: 

admin@PA-VM> view-pcap follow yes debug-pcap <bgp_capture_file>





LIVEcommunity team member, CISSP
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Hello Sir,

Thank you for your reply

I am getting the following messages BGP peer MP extension negotiation. MP-EXTENSION negotiation to peer  successful, AFI/SAFI 1/1

BGP peer session enters established state. peer IP: 

BGP peer session left established state. peer IP: 

Also the peer side has more than 2000 bgp routes and the number of forwarding routes on pa 500 device from our end is only 24.  so does those routes count too from the peer side ?


Also on the peer side they are getting the following log

Error wait: 63/300

Last error: Received: Malformed AS_PATH


Thank You for your support.




If the peer is advertising all 2000+ prefixes to you, then it will be a problem. 

Do you need all 2000 prefixes? You can configure inbound rules to permit specific prefixes or maybe the peer could send a summary.


@rmfalconer thank you

Actually we are connected to the internet exchange with palo alto pa 500 so we need all the routes.

since it is not an isp we cannot configure default route or receive a summary

currently the only option available is to configure inbound rules to permit specific prefixes as per your suggestion.


is there any other alternative or do i have to upgrade to another device due to hardware ?


thank you 




You can create filters but that would be used to allow only certain prefixes. Some would be blocked so you wouldn't have routes to these networks.

If you need to support over 2000 prefixes, you'll need a larger device.   You should check with your reseller or PA to size correctly.

Also, for the malformed AS message, are you using a 2 byte or 4 byte AS number? Did you select the correct option in the BGP config on the PA?

@rmfalconer sir i am using 4byte AS number.

Also i have created route filter but still BGP is getting connected and then disconnected.

so that is also not working. what could be the possbile issue?


thank you

  • 6 replies
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!