Getting AWS Transit VPC to learn routes from Palo Virtual Editions

[dmcneill]

I'm in the process of implementing a Transit VPC setup on AWS.  However, before I automate it, I want to understand it, so I'm opting to do a manual build initially.

I've been successful with getting the tunnels stood up between my Transit VPC Palos and the subscriber VPCs, as well as getting either side to learn routes from the other.

However, I am having a hard time figuring out how to gett routes exchanged between the Transit VPC Palos and the Transit VPC itself (and, ultimately, my direct-connect gateways).

Any assistance here would be greatly appreciated.

[jperry1]

if you go into the GitHub repo you should see a manual deployment guide. This guide was created so that folks such as yourself that want to build one manually will have all of the steps. That should walk you through the BGP portion 

https://github.com/PaloAltoNetworks/aws-transit-vpc/blob/master/documentation/Transit_VPC_Manual_Bui...

[dmcneill]

Thanks, but I've leaned heavily on that guide for my buildout, and I'm still not seeing how this specific item is achieved, or I'm being completely oblivious.

the "Configuring BGP" section describes setting up BGP to exchange routes with the subscribing VPCs...which I've done successfully at this point.  Where I'm falling flat is getting the Transit VPC itself (and, from there, my on-premesis routers) to learn the routes to those subscribing VPCs from the Palo virtual firewalls that reside within the Transit VPC.

[jperry1]

Got it. I believe I understand. I created this document to get the quad zero routes to populate throughout the BGP environment. This is specific to PAN-OS so this may be exactly what you are referring to. If you have the BGP configured already then I am pretty sure this is the last step you need.

Transit VPC Default Route Prepagation using BGP

https://github.com/PaloAltoNetworks/aws-transit-vpc/blob/master/documentation/Default_Route_to_Subsc...

[jmeurer]

The Transit VPC firewalls can distribute the Transit VPC subnets to the spokes by adding the ETH1/1 connected subnet to the BGP redistribution profile.

https://www.paloaltonetworks.com/documentation/81/pan-os/web-interface-help/network/network-virtual-...

With that said, the on-premisis firewalls will not learn the spoke subnets and vice versa from the Direct Connect VGW.  Here is where we typically run an IPSEC tunnel between on-prem and the transit firewalls to allow for bgp peering and route exchange.  You utilize the Direct Connect for IP transit and gain the benefit of Encrypted traffic in flight.

[JD-SECD]

Hi @dmcneill,

You are probably not seeing routes due to how BGP operates, if BGP see's route advertisments coming from its own ASN it will not populate those routes. You can do some crafty BGP ninjaing with redistribution profiles, either import or export (in your case I think you would need do do some configuration on your VR's BGP import section).

Instead of working and playing with BGP configurations. I've found it easier for me to detach the virtual gateway from the Transit-VPC. From there you you can establish your point-to-point tunnels from the transit-PANW-fw's to the detached VGW. You would also have your on prem-fw (if applicable) terminate to that detached VGW. Please see below document for a little bit more clarity:

https://docs.aws.amazon.com/solutions/latest/cisco-based-transit-vpc/appendix-d.html

From there you can select the option to propogate routes in the respective AWS's route tables.