12-29-2021 05:05 PM
We have BGP setup between our core switches and out Palo Alto FWs but I never see any traffic logs for port 179 or application BGP on the Palo Altos.
How do I go about seeing this traffic ?
12-29-2021 05:29 PM
Thank you for the post @iqbal786
There is no special setting to enable to see BGP traffic log. As long as BGP peer's traffic is hitting a firewall policy where logging is enabled you will be able to see that traffic in the Traffic log.
I am thinking of 2 reasons why you do not see the log.
- Your BGP traffic might be hitting either: interzone-default or intrazone-default rule where by default logging is not enabled. These rules are located in very bottom and you can override them, then select under actions: Log at session end.
- If you have set BGP peers recently and policy that is being matched has enabled: Log at session end, you will not see any log until BGP peering flaps/resets or you clear BGP peer to end BGP session to generate log. Unless session is ended you will not see any log unless you have enabled Log at session start.
Kind Regards
Pavel
12-29-2021 05:29 PM
Thank you for the post @iqbal786
There is no special setting to enable to see BGP traffic log. As long as BGP peer's traffic is hitting a firewall policy where logging is enabled you will be able to see that traffic in the Traffic log.
I am thinking of 2 reasons why you do not see the log.
- Your BGP traffic might be hitting either: interzone-default or intrazone-default rule where by default logging is not enabled. These rules are located in very bottom and you can override them, then select under actions: Log at session end.
- If you have set BGP peers recently and policy that is being matched has enabled: Log at session end, you will not see any log until BGP peering flaps/resets or you clear BGP peer to end BGP session to generate log. Unless session is ended you will not see any log unless you have enabled Log at session start.
Kind Regards
Pavel
12-29-2021 06:55 PM
So it was the second reason. I didn't realize what what the rule was used for until I broke the network. There were no comments and the rule was overly permissive
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
