vWire Fails in BGP

[mbs.admin]

Hi,

We have a deployment of Palo Alto in vWire mode. But after it was setup, bgp is no longer functioning. I already created an allow all policy but it didn't work as well. Any advise that can help me to make this work?

Thanks,

Rex

[hyadavalli]

Hello Rex,

Please make sure you have two security policies for inbound and outbound traffic.

BGP negotiation can happen from either side.

Regards,

Hari Yadavalli

[mbs.admin]

Hi Hari,

Thanks for the response. We already have that policy but BGP is not working still . Any more suggestions?

Regards,

Rex

[kiwi]

Hi Rex,

Are you seeing any sessions in the traffic log for the BGP traffic ?

You could set up a filter on tcp-port 179 and make a PCAP to see the BGP communication across the vwire.  Analysis of the PCAP could be useful in identifying the issue.

Also with the filter in place you can check the global counters on the PAN.  These counters could give an indication as to why it is failing.

The following DOC can assist you in setting up filter and checking the global counters :

Packet Capture, Debug Flow-basic and Counter Commands

Kind regards,

-Kim.

[Phoenix]

Hello,

Run the below command multiple times and pass the Bgp traffic.

"show session all filter application bgp"

If we identify the session in Active -> then the session is setup. If in Discard -> it is rejected by certain rule or so. If we do not see any output in the session command then the traffic is not hitting the PAN at all. As informed in the prior update we will have to take packet captures and global counters to see or gain more knowledge if we see the sessions building.

Thanks