Config validation failing due to "protocol -> bgp -> redist-rules is invalid" after upgrade from 8.0 to 8.1
12854
Created On 05/16/19 13:39 PM - Last Modified 08/03/20 16:02 PM
Symptom
- Firewall with "Redistribution Rules" under BGP or "Export Rules" under OSPF setting within Virtual Router config might fail in config validation after upgrade from PanOS 8.0 to 8.1.
- User would get an error "protocol -> bgp -> redist-rules is invalid" during config validation.
Environment
Issue affects all PanOS devices which are upgraded from PanOS 8.0.x to 8.1.x
Cause
In PanOS 8.1 and onwards, there is strict validation of subnets. This subnet validation check is not limited to BGP redistribution rules. Validation of other protocols' export rules are also being done.
Due to this condition, if the firewall has a host route prefix, without subnet mask (i.e. 10.10.10.10 instead of 10.10.10.10/32) configured in redistribution list, commit will fail.
Incorrect prefix name
Resolution
To resolve the problem, admin should have correct subnet mask added to every prefix in redistribution rules.
Correct prefix name