BGP Route Advertisement /Export Rule

[Cobraflo]

Need some help with advertising specific routes over BGP and hoping someone can help.

I have a site-to-site tunnel setup between AWS and my on-premise PA Firewall. I am receiving routes from AWS over BGP as expected. No issue there and I am able to create a redistribution profile & redist rule and advertise an existing static route listed within the PA's VR which points to my internal LAN i.e. 10.0.0.0/8 into BGP over to AWS. That said, I do not wish to advertise the entire 10.0.0.0/8 network but specific routes i.e. a 10.10.10.0/24 and have the ability not to advertise this to any other BGP peers I may have in the future under the same VR.

Thus far I have manage to just add the prefix i.e. 10.10.10.0/24 to a Redist rule which somewhat gives me the desired result and PA only advertises 10.10.10.0/24 into AWS. But I am concerned it will advertise this to other BGP peers so its no what I want.

I have tried to create an export rule which seems the way to go as this allows me to specify a prefix and peer i'd like to advertise this networks to and have better control but for some reason once I setup an export rule, I am unable to advertise the prefix.

With the export rule,

• Under General, I am selecting the AWS Peer Group (Peer-AWS) to be used
• Under Match, I have Address Prefix set to 10.10.10.0/24 with exact match and under "From Peer" I have the relevant AWS Peer assigned.
• Under Action, I have 'Allow' and Origin set to incomplete.
• Have tried specifying next hope but no joy.

For some reason, PA is not advertising the routes and I am not seeing 10.10.10.0/24 under the loc-rib or rib-out

Does anyone know what I missing or doing wrong?

Thank you!