iBGP Between Palo Alto and Cisco Router

[usaiatawakevou]

Got two Cisco ISR 4431 as border routers peering with 2 ISP. Got PA-850 that I need to configure as:

1. HA
2. iBGP - OSPF
3. configured ip unnumbered on the Palo Alto interface connecting to the Cisco 

Any configuration example out there that can assist will be really appreciated

[usaiatawakevou]

This is my planned setup

[rmfalconer]

What exactly are you trying to accomplish?

[usaiatawakevou]

I've listed it above on my initial post

[rmfalconer]

You listed what you want to configure, not what you're trying to accomplish. 

When you say IP unnumbered, does that mean you want to use vwire? What are you trying to do with OSPF and BGP? Egress and Ingress paths? Full tables/provider table/default? Are there public resources behind the PA? A/A vs A/P?  Is there a reason you don't have L2 switch between the FW and routers?

Without knowing what you're trying to do, it's hard to provide any feedback. 

[usaiatawakevou]

Thanks for the response.

Current setup:

• iBGP using OSPF
• eBGP with ISP with prepend configured - working as expected
• both ISP send their default but we got route maps for high preference to ISP1
• Some static routes and PBR to use ISP2 
• all working as we want

We will replace pfsense firewall, VPN device and Vyos with a pair of PA-850. Need to accomplish the following:

• HA as in active/passive
• ip unnumbered so routing convergence when PA failover works smoothly
• no switch in the middle to avoid more points of failure. Prefer to connect point to point between device rather than a switch in between 
• iBGP between Cisco and PA - Not sure how this works with PA and CIsco. Current setup is working between Cisco and Vyos using OSPF as iBGP protocol
• PA to handle site-to-site VPN, PBR so some connections go out of ISP2
• etc

I've replicate the desired setup on my GNS3 lab however I couldn't figure out how iBGP works and ip unnumbered on PA so my lab is using IP address on point to point interface for now. OSPF between Cisco and PA with HA works but not BGP. When I tried to add peers, showing error as in peer invalid. 

Probably there is a way to do this on PA but I'm only familiar with Cisco and Vyos for iBGP hence my request for any pointers or configuration example for similar scenario

Hope Im clear

Thanks

[TomYoung · Accepted solution]

Hi @usaiatawakevou ,

PA does not support routing without an IP address.  I would put 2 switches in the middle for redundancy, but if you don't want to do that you could configure IRB on the 4431s so that Gi0/0/0 and Gi0/0/1 are in the same subnet.

With regard to BGP, the PA is RFC compliant and can form the iBGP neighbor.

Thanks,

Tom

[usaiatawakevou]

Thanks @TomYoung BVI solve it for me and my iBGP works now. Much apprecaited