How to configure BGP peering between a 4-byte ASN device with a 2-byte ASN device
18759
Created On 08/03/21 08:24 AM - Last Modified 07/08/24 03:09 AM
Objective
This article aims to configure two Firewalls one with 2-byte ASN and the other with 4-byte ASN to exchange BGP routes.
Note: BGP's 4-byte Autonomous System Number (ASN) has backward compatibility to 2-byte ASN, the other way around is not possible.
Environment
- Palo Alto Firewall
- PAN-OS 9.1
- BGP configured
Topology:
Procedure
- Configure BGP on FW1 from Network > Virtual Router > [VR-name] > BGP
- Configure FW1's BGP peering info from Network > Virtual Router > [VR-name] > BGP > Peer Group > Add.
- Take note of the snapshot below that since 2-byte ASN doesn't understand 4-byte ASN, use AS_TRANS 23456, which will serve as FW3 ASN from FW1's perspective. AS per RFC 4893. The AS number 23456 has been assigned by the IANA for AS_TRANS
- Configure FW3's basic BGP setup. By default ASN format is set to 2-byte, you will need to switch to 4-byte in FW3's config from Network > Virtual Router > [VR-name] > BGP
- Configure FW3's BGP peering info from Network > Virtual Router > [VR-name] > BGP > Peer Group > Add
- The above four steps are the essential procedure in this guide. This step and the subsequent ones will be more of an optional part to show the route sharing. Since the idea of configuration is identical to both Firewalls, the guide will show one from FW1, and you can configure FW3 just like below. Network > Virtual Router > [VR-name] > Redistribution Profile > Add
- (Optional) Attached the created Redistribution Profile from step 5 to BGP. Network > Virtual Router > [VR-name] > BGP > Redist Rules > Add
Note: remember to do the same step in FW3
Verification:
- FW1's BGP peering results:
- FW1's learned routes from FW3, note that the AS_PATH announced by FW3 is not 4294967294, but instead is ASN 23456
- FW3's ASN peering result:
- FW3's learned routes from FW1
Additional Information
- The key is to configure AS 23456 as the peer AS on the Firewall with 2-byte ASN format.
- The router with 4 byte ASN understands this and will form a peer relationship.
- On The firewall with 4-byte ASN, peer relationship is formed with the regular AS number (65530 in this case)
The special 16-bit ASN 23456 ("AS_TRANS") was assigned by IANA as a placeholder for 32-bit ASN values
for the case when 32-bit-ASN capable routers ("new BGP speakers") send BGP messages to routers with
older BGP software ("old BGP speakers") which do not understand the new 32-bit ASNs.