Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

iBGP Between Palo Alto and Cisco Router

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

iBGP Between Palo Alto and Cisco Router

L1 Bithead

Got two Cisco ISR 4431 as border routers peering with 2 ISP. Got PA-850 that I need to configure as:

  1. HA
  2. iBGP - OSPF
  3. configured ip unnumbered on the Palo Alto interface connecting to the Cisco 

Any configuration example out there that can assist will be really appreciated

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @usaiatawakevou ,

 

PA does not support routing without an IP address.  I would put 2 switches in the middle for redundancy, but if you don't want to do that you could configure IRB on the 4431s so that Gi0/0/0 and Gi0/0/1 are in the same subnet.

 

With regard to BGP, the PA is RFC compliant and can form the iBGP neighbor.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

7 REPLIES 7

L1 Bithead

This is my planned setup

PA-Cisco-iBGP.PNG

 

L5 Sessionator

What exactly are you trying to accomplish?

I've listed it above on my initial post

L5 Sessionator

You listed what you want to configure, not what you're trying to accomplish. 

When you say IP unnumbered, does that mean you want to use vwire? What are you trying to do with OSPF and BGP? Egress and Ingress paths? Full tables/provider table/default? Are there public resources behind the PA? A/A vs A/P?  Is there a reason you don't have L2 switch between the FW and routers?

Without knowing what you're trying to do, it's hard to provide any feedback. 

Thanks for the response.

Current setup:

usaiatawakevou_0-1647023897411.png

  • iBGP using OSPF
  • eBGP with ISP with prepend configured - working as expected
  • both ISP send their default but we got route maps for high preference to ISP1
  • Some static routes and PBR to use ISP2 
  • all working as we want

We will replace pfsense firewall, VPN device and Vyos with a pair of PA-850. Need to accomplish the following:

usaiatawakevou_1-1647024541013.png

  • HA as in active/passive
  • ip unnumbered so routing convergence when PA failover works smoothly
  • no switch in the middle to avoid more points of failure. Prefer to connect point to point between device rather than a switch in between 
  • iBGP between Cisco and PA - Not sure how this works with PA and CIsco. Current setup is working between Cisco and Vyos using OSPF as iBGP protocol
  • PA to handle site-to-site VPN, PBR so some connections go out of ISP2
  • etc

I've replicate the desired setup on my GNS3 lab however I couldn't figure out how iBGP works and ip unnumbered on PA so my lab is using IP address on point to point interface for now. OSPF between Cisco and PA with HA works but not BGP. When I tried to add peers, showing error as in peer invalid. 

 

Probably there is a way to do this on PA but I'm only familiar with Cisco and Vyos for iBGP hence my request for any pointers or configuration example for similar scenario

 

Hope Im clear

 

Thanks

Cyber Elite
Cyber Elite

Hi @usaiatawakevou ,

 

PA does not support routing without an IP address.  I would put 2 switches in the middle for redundancy, but if you don't want to do that you could configure IRB on the 4431s so that Gi0/0/0 and Gi0/0/1 are in the same subnet.

 

With regard to BGP, the PA is RFC compliant and can form the iBGP neighbor.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Thanks @TomYoung BVI solve it for me and my iBGP works now. Much apprecaited

  • 1 accepted solution
  • 5964 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!