BGP Route Advertisement /Export Rule

[Cobraflo]

Need some help with advertising specific routes over BGP and hoping someone can help.

I have a site-to-site tunnel setup between AWS and my on-premise PA Firewall. I am receiving routes from AWS over BGP as expected. No issue there and I am able to create a redistribution profile & redist rule and advertise an existing static route listed within the PA's VR which points to my internal LAN i.e. 10.0.0.0/8 into BGP over to AWS. That said, I do not wish to advertise the entire 10.0.0.0/8 network but specific routes i.e. a 10.10.10.0/24 and have the ability not to advertise this to any other BGP peers I may have in the future under the same VR.

Thus far I have manage to just add the prefix i.e. 10.10.10.0/24 to a Redist rule which somewhat gives me the desired result and PA only advertises 10.10.10.0/24 into AWS. But I am concerned it will advertise this to other BGP peers so its no what I want.

I have tried to create an export rule which seems the way to go as this allows me to specify a prefix and peer i'd like to advertise this networks to and have better control but for some reason once I setup an export rule, I am unable to advertise the prefix.

With the export rule,

• Under General, I am selecting the AWS Peer Group (Peer-AWS) to be used
• Under Match, I have Address Prefix set to 10.10.10.0/24 with exact match and under "From Peer" I have the relevant AWS Peer assigned.
• Under Action, I have 'Allow' and Origin set to incomplete.
• Have tried specifying next hope but no joy.

For some reason, PA is not advertising the routes and I am not seeing 10.10.10.0/24 under the loc-rib or rib-out

Does anyone know what I missing or doing wrong?

Thank you!

[laurence64]

Hi @Cobraflo 

In theory the configuration you have looks correct, however the route not being there in the loc-rib is of concern, the absence of this route in the local rib basically means that it is not in your routing table, BGP as far as I am aware will not advertise an invalid route (a route it does not have a path to) you say at the start that you redistributing statics and connected, is the 10.10.10.0/24 one of those, and if so is that route still there? when you look under Virtual-router>BGP>Local Rib the route should show up as local if connected and there will be a peer next to it if it has got the route from somewhere else.

Please let me know if this helps, I am not a routing guru by any standard but your basic setup premise does look good to me, with the exception of this line 

• Under Match, I have Address Prefix set to 10.10.10.0/24 with exact match and under "From Peer" I have the relevant AWS Peer assigned.

If this is under the match tab I would suggest that needs to be removed and you match on just the prefix, if you select a peer in here then the firewall will look for that route coming from that peer as these are the match criteria the firewall uses on its routing table to take action on.

Hope this helps!

[Cobraflo]

@laurence64 

• route/path to 10.10.10.0/24 is present within the VR's routing table in the form of a static route pointing to 10.0.0.0/8 with a next-hop towards my local LAN segment. So its reachable by the PA. this is a permanent route as I point all RFC1918 to my internal LAN.
• when I setup a redistribution profile. I checked static and specified 10.0.0.0/8. Assigned it to the redist rule and it started to advertise the entire 10.0.0.0/8 which I do not want. i'd like to filter out and advertise on 10.10.10.0/24

I'll try seeting up a static route on the VR for a more specific route 10.10.10.0/24 but I find this to be unneccary and I will end up with lots of static routes as I will have more specific routes to advertise into BGP. I also dont see how this will prevent me advertising these static routes into other BGP AS neighbours if I utilise redistribution profiles.

I've gone through this with TAC. They seem to be awful. 3 calls and they still dont seem understand what I am trying to acheive which router needs advertising where.

[laurence64]

Did you try removing the "from peer" in the match statement ? that will cause the match statement in the export rule to fail, as that route has not come from the the peer.

The general tab will send it too the AWS peer, and the match statements are route selectors to send, as far as I understand anyway, if you have tried that then apologies!

[Cobraflo]

@laurence64 yes i removed it from peer. what you said made sense not to have it. still not having the desired effect. nothing is being advertised using the export rule.

[laurence64]

Hi,

Unfortunately as I suspected BGP will not advertise a route it does not have in it's local-rib, so in this instance while you can advertise the 10/8 as it is present the smaller /24 is not, I spent some time looking at this and was only able to get the route into the table by either adding a static or if it was connected, this morning I have spoken to a colleague who is a routing guy and he confirmed that this is how it works, once the route is in your local-rib then you can specify the peer that route is advertised to, it can work the other way around however, so if you have multiple /24 you can create an aggregate and advertise that to a peer.

Hope this helps!