Finding a rogue IP in Prisma SD-WAN

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Finding a rogue IP in Prisma SD-WAN

L0 Member

Greetings.

 

Looks like someone misconfigured a global/local slider and we're receiving a /32 IP address in the BGP route table from the Data Center IONs. I'd like to identify the offending site quickly - is there an easy way to locate an IP by site using the portal?

 

Prisma SD-WAN 

 

 

2 REPLIES 2

Cyber Elite
Cyber Elite

Thank you for the post @TKlausen2

 

maybe there is a better way to do it, but on top of my head I can think of below options:

 

Advertising router ID / AS number

Login to SD-WAN portal, then navigate to: Maps > Claimed Devices, then click on any appliance, then a new page will open:

PavelK_0-1654723068069.png

After you click on remote session, a new page will open where you can login from CLI. Authenticate with elem-admin, then issue: "dump routing route prefix=X.X.X.X/32" where X.X.X.X is the prefix you are tracking down. Reference is here: https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/prisma-sd-wan-ion-cli-reference/use-cli-comma...

In this output, you will see the router ID as well as AS of the device that advertised that prefix:

PavelK_1-1654723741206.png

If you know to what router/site that router ID / AS number belongs, then you go to that site and fix it. If you do not know that information, you can still find it from SD-WAN portal from: Manage > Setup > Devices > Claimed > Select a device > Routing > BGP/Peers > BGP Global Config for ION device. If you have hundreds of devices, this might however be a time consuming and equals to searching that slider misconfiguration manually device by device.

 

Audit Log

An alternative way might be to search in audit log to track down recent changes. Reference: https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/prisma-sd-wan-admin/prisma-sd-wan-administrat...

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L1 Bithead

From the DC device try the below commands 

#dump prefix reachability prefix=x.x.x.x/32

this will give you path id from which its learning the prefixes and then try 

#inspect fib vpn pathid=zzzzzzzzzz 
the above command will give you the site name.  |



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!