Post by Gowtham M

𝗧𝗵𝗲 𝗕𝗚𝗣 "𝗢𝗻𝗲-𝗪𝗮𝘆 𝗦𝘁𝗿𝗲𝗲𝘁" 𝗧𝗿𝗮𝗽 𝗗𝘂𝗿𝗶𝗻𝗴 𝗮 𝗣𝗮𝗹𝗼 𝗔𝗹𝘁𝗼 𝗠𝗶𝗴𝗿𝗮𝘁𝗶𝗼𝗻 🌐 A branch migration looked perfect on paper. ✅ IPsec Tunnel: UP ✅ BGP Session: ESTABLISHED ✅ Spoke → Hub Traffic: Working But there was one problem... ❌ Hub → Spoke Traffic: Completely Broken The spoke firewall was advertising its local networks, and "show routing protocol bgp rib-out" confirmed the routes were being sent. Yet the Hub firewall never learned a single prefix. 𝗧𝗵𝗲 𝗛𝗶𝗱𝗱𝗲𝗻 𝗖𝘂𝗹𝗽𝗿𝗶𝘁 🔍 During the migration, the new Palo Alto firewall was configured with Local-AS to maintain BGP adjacency using the legacy router's ASN. What many engineers don't realize is that, by default, Palo Alto may advertise routes with both: • The configured Local ASN • The firewall's actual System ASN When the Hub receives the route advertisement and detects its own ASN within the AS-Path, it assumes a routing loop and silently rejects the route. No BGP flaps. No alarms. No obvious errors. Just missing routes. 𝗧𝗵𝗲 𝗙𝗶𝘅 🛠️ Modify the BGP Peer Local-AS behavior: Network → Virtual Router → BGP → Peer Group → Peer → Local-AS Change the mode to: ✔ Replace-AS (Recommended) ✔ No-Prepend This ensures only the expected ASN is advertised, preventing AS-Path loop detection on the Hub. Within seconds, the Hub accepts the routes and full bidirectional communication is restored. 𝗞𝗲𝘆 𝗟𝗲𝘀𝘀𝗼𝗻 📖 A BGP session being established does not guarantee route exchange. Always verify: ✔ Received Routes ✔ Advertised Routes ✔ AS-Path Attributes ✔ Local-AS Behavior Sometimes the tunnel is healthy, BGP is up, and the real problem is hiding inside the AS-Path. #PaloAltoNetworks #BGP #NetworkSecurity #Routing #FirewallMigration #IPSec #NetworkEngineering #PANW #Troubleshooting #DataCenter