Palo AltoConfig634 downloads

Palo Alto BGP Configuration

BGP configuration under a PAN-OS virtual router with eBGP/iBGP peers, import/export policy, prefix filtering, and route-map equivalents via PAN-OS route filters.

↓ example.txt

What is it?

BGP on Palo Alto runs within the virtual router context (not a standalone process). PAN-OS supports eBGP and iBGP under the same virtual router, with peer groups, import/export policies, and redistribution from connected/static/OSPF routes. Palo Alto BGP is commonly used for multi-homed internet connectivity (dual ISP with eBGP peering), SD-WAN underlay routing, or data center peering with spine switches. Route filtering is done via 'policy' objects referencing address prefix filters.

When to use

·Connecting to ISPs for multi-homed internet access with traffic engineering
·Data center deployments where the firewall peers with core switches (eBGP or iBGP)
·SD-WAN scenarios where the firewall needs to advertise and receive prefixes dynamically
·Receiving full BGP tables from an ISP for traffic path selection

When NOT to use

·Simple single-ISP deployments — a static default route (0.0.0.0/0) is simpler and more reliable
·Routing inside the campus/DC — use OSPF for internal routing; BGP for external/inter-domain

How it compares

vs Cisco IOS BGPSame BGP protocol. IOS has more mature BGP features (route reflectors, communities, RPKI). Palo Alto's BGP is functional for edge deployments but lacks some advanced features like route server capabilities.

vs OSPF on Palo AltoOSPF is for internal routing (IGP). BGP is for external routing (EGP). A firewall in a data center may run both: OSPF to learn internal routes and BGP to peer with ISPs.

Prerequisites

→Virtual router must be configured first
→AS number agreed with the ISP (public AS for internet peering, private AS 64512-65534 for internal BGP)
→Route filters should be prepared before enabling BGP to prevent accidental route leaks
→For ISP peering: the ISP must provide their peer IP and AS number

Config Generator

Hostname *

Virtual Router

Local AS *

Router ID *

Install BGP routes?

BGP Peers

Redistribute into BGP

Verification commands

show routing protocol bgp peer

Show BGP peer status and session state

ExpectedPeers should show 'Established' state with non-zero prefix counts for received/sent routes

show routing route type bgp

Show BGP routes installed in the routing table

ExpectedLists BGP routes with next-hop, AS path, and preference. Missing routes indicate filtering or peering issues.

show routing protocol bgp rib

Show the BGP RIB (Routing Information Base) before route selection

ExpectedShows all received paths including non-best paths. Best path marked with '*'

Debug commands

show routing protocol bgp peer <name> detail

Show detailed BGP session state, capabilities, and error messages

Common mistakes & fixes

SymptomBGP peer stuck in 'Connect' or 'Active' state

CauseTCP 179 blocked by security policy or zone protection, wrong peer IP

FixVerify security policy allows TCP 179 between the peering interfaces. Check 'test security-policy-match' from the peering IP to the neighbor.

SymptomBGP established but no routes being received

CauseImport policy filtering all routes, or peer not advertising any routes

FixTemporarily remove the import policy and check if routes appear. Verify with ISP that they are advertising the expected prefixes to your AS.

SymptomRoutes not being redistributed to BGP

CauseRedistribution rule not enabled or missing route filter match

FixVerify 'show routing protocol bgp rib' vs 'show routing route type bgp'. Check if the route exists in the routing table first.

Further learning

Recommended books to go deeper on this topic.

BGP Design and Implementation

Randy Zhang & Micah Bartell · Cisco Press · The practical BGP bible — iBGP, eBGP, policies, communities, design patterns

Kindle ↗Hardcover ↗Paperback ↗

Internet Routing Architectures

Sam Halabi · Cisco Press · BGP for ISPs and large enterprise — AS path, route reflectors, confederation

Hardcover ↗