Unable to Achieve Sub-Second Failover Times with BGP for Active-Passive Configuration

63450

Created On 09/26/18 13:51 PM - Last Modified 06/02/22 21:10 PM

BGP

High Availability

PAN-OS

Symptom

It is expected that when failing over from the active to the passive device, the failover should be seamless and not have any traffic drops.
But upon failing over the cluster, the BGP connection on the active device goes down and the new active device establishes the BGP connectivity with the peer.
The neighbor (peer) and the new active device advertise the BGP routes between themselves.
During the time that the peer and the new active device have an established BGP connection, there is an outage and traffic gets dropped because the routes do not yet exist on the routing table.

Environment

Palo Alto Firewalls
Supported PAN-OS.
High Availability (Active / Passive) Configured
BGP failover

Cause

Graceful restart has not been configured on both the firewalls of the cluster, and the peer.
Routes have not been synchronized on the cluster members

Resolution

Go to GUI: Network > Virtual Routers > BGP > Advanced > Graceful Restart

graceful.JPG.jpg

Enable the “Graceful Restart” checkbox and configure the timers to match with the peer configuration
Configure the peer device with Graceful restart feature with similar settings.
The command "show routing fib" can be used on Firewall to verify the route synchronization between the members of the cluster.

Note: In normal circumstances, when the router restarts its BGP process and the TCP connection to the peer router is cleared, the peer router will clear all routes associated with the restarting router. This does not occur with BGP graceful restart, however. Instead, the peer router marks all routes as "stale," but continues to use them to forward packets based on the expectation that the restarting router will re-establish the BGP session in short time. Likewise, the restarting router also continues forwarding packets in the interim.

When the restarting router opens the new BGP session, it will again send BGP capability 64 to its peers. But this time, flags will be set in the graceful restart capabilities exchange to let the peer router know that the BGP process has restarted.

Additional Information