Viewing BGP traffic logs

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Viewing BGP traffic logs

L0 Member

We have BGP setup between our core switches and out Palo Alto FWs but I never see any traffic logs for port 179 or application BGP on the Palo Altos.

 

How do I go about seeing this traffic ?

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

Thank you for the post @iqbal786

 

There is no special setting to enable to see BGP traffic log. As long as BGP peer's traffic is hitting a firewall policy where logging is enabled you will be able to see that traffic in the Traffic log.

 

I am thinking of 2 reasons why you do not see the log.

- Your BGP traffic might be hitting either: interzone-default or intrazone-default rule where by default logging is not enabled. These rules are located in very bottom and you can override them, then select under actions: Log at session end.

- If you have set BGP peers recently and policy that is being matched has enabled: Log at session end, you will not see any log until BGP peering flaps/resets or you clear BGP peer to end BGP session to generate log. Unless session is ended you will not see any log unless you have enabled Log at session start.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Thank you for the post @iqbal786

 

There is no special setting to enable to see BGP traffic log. As long as BGP peer's traffic is hitting a firewall policy where logging is enabled you will be able to see that traffic in the Traffic log.

 

I am thinking of 2 reasons why you do not see the log.

- Your BGP traffic might be hitting either: interzone-default or intrazone-default rule where by default logging is not enabled. These rules are located in very bottom and you can override them, then select under actions: Log at session end.

- If you have set BGP peers recently and policy that is being matched has enabled: Log at session end, you will not see any log until BGP peering flaps/resets or you clear BGP peer to end BGP session to generate log. Unless session is ended you will not see any log unless you have enabled Log at session start.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L0 Member

So it was the second reason. I didn't realize what what the rule was used for until I broke the network. There were no comments and the rule was overly permissive 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!