2.2 Static Routing, BGP, and OSPF Configuration & Failover

2.2 Static Routing, BGP, and OSPF Configuration & Failover

Palo Alto Networks Next-Generation Firewalls support robust static and dynamic routing protocol suites within Virtual Routers. Network engineers must configure static routes, Open Shortest Path First (OSPF), and Border Gateway Protocol (BGP) to ensure optimal traffic forwarding, high availability, and rapid convergence during link or node failures.

This section covers static route configuration, default route design patterns, OSPF area topologies, BGP autonomous system peering, route redistribution profiles, and Bidirectional Forwarding Detection (BFD) integration.

---

Static Routes and Default Route Architecture

Static routes are manually configured routing entries used for fixed topology paths, default gateways, and out-of-band management. In PAN-OS, a static route configuration consists of five key attributes:

1. Destination: The target IPv4 or IPv6 network prefix (e.g., 0.0.0.0/0 for default route, or 10.250.0.0/16).
2. Interface: The egress Layer 3 interface (e.g., ethernet1/1).
3. Next Hop: Specifies the forwarder address type:
   • IP Address: Next-hop gateway IP.
   • Next VR: Target Virtual Router for inter-VR routing.
   • Discard: Drops matching traffic (useful for blackholing summary routes).
   • None: Used for point-to-point interface types.
4. Metric: Cost value used to compare routes from the same protocol (default = $10$).
5. Administrative Distance (AD): Trustworthiness ranking (default = $10$).

Floating Static Routes for ISP Redundancy

To implement automatic Internet Service Provider (ISP) failover without dynamic routing:

• Primary Static Route: Destination 0.0.0.0/0, Egress ethernet1/1 (ISP-1), AD = $10$.
• Backup (Floating) Static Route: Destination 0.0.0.0/0, Egress ethernet1/2 (ISP-2), AD = $20$.

Because the primary route has a lower AD ($10$), it is installed into the FIB. If ethernet1/1 goes down (or Path Monitoring fails), the primary route is removed, and the floating backup route ($AD = 20$) is immediately promoted into the FIB.

Equal-Cost Multi-Path (ECMP)

When multiple static or dynamic routes to the same destination have identical AD and Metric values, PAN-OS can distribute traffic across up to 4 or 8 parallel paths (depending on firewall model) using ECMP.

• IP Hash: Hashes source and destination IP addresses to ensure session stickiness.
• Balanced Round-Robin: Symmetric distribution across active paths.
• Symmetric Return: Ensures return flow for a session exits out the exact interface on which the ingress packet arrived.

---

OSPFv2 and OSPFv3 Implementation

PAN-OS supports OSPFv2 (IPv4 routing) and OSPFv3 (IPv6 and IPv4 routing). OSPF operates within a Virtual Router and requires a unique 32-bit Router ID (formatted as an IP address, e.g., 1.1.1.1).

OSPF Area Types in PAN-OS

OSPF networks are hierarchically divided into Areas to constrain Link-State Advertisement (LSA) flooding:

OSPF Authentication & Timers

• OSPFv2 Authentication: Supports Simple Password, MD5, and HMAC-SHA-256 cryptographic keys.
• Timers: Hello Interval (default 10s broadcast/point-to-point) and Dead Interval (default 40s). If dead timers expire without receiving a Hello packet, the neighbor adjacency is torn down.

---

Border Gateway Protocol (BGP) Architecture

BGP is the standard path-vector routing protocol used for internet edge peering, multi-cloud interconnects, and large enterprise cores.

Autonomous System Numbers (ASN)

PAN-OS supports both 16-bit (1–65535) and 32-bit ASNs (expressed in plain number format up to 4,294,967,295 or dot notation ASN.subASN). Private AS ranges include 64512–65535 and 4200000000–4294967294.

eBGP vs. iBGP

• External BGP (eBGP): Peering between different ASNs. Default IP TTL is $1$ (requires eBGP Multihop if peers are not directly connected).
• Internal BGP (iBGP): Peering within the same ASN. Enforces the iBGP split-horizon rule (routes learned via iBGP are not advertised to other iBGP peers unless Route Reflectors are configured).

BGP Peer Groups

To scale BGP configurations, PAN-OS utilizes Peer Groups. A Peer Group pools multiple BGP neighbors that share identical policies:

• Export / Import Policies: Match criteria (prefix lists, community strings, AS-path regex) and actions (set Local Preference, MED, AS-path prepending).
• Keepalive and Hold Timers: Default Keepalive = 30s, Hold Time = 90s.
• Soft Reconfiguration & Route Refresh: Allows policy updates without resetting TCP sessions.

---

Route Redistribution Profiles

Route Redistribution allows a Virtual Router to take routes learned from one protocol (e.g., Connected or Static) and advertise them into another protocol (e.g., OSPF or BGP).

1. Create a Redistribution Profile: Define name, priority, source protocol (Connected, Static, OSPF, BGP), and match conditions (destination subnets, interface, metric, tag).
2. Apply to Target Protocol: Under OSPF Export or BGP Export, bind the Redistribution Profile and set egress metrics/origin attributes.

---

Bidirectional Forwarding Detection (BFD) for Sub-Second Failover

Standard dynamic routing timers can take anywhere from $30$ seconds (BGP keepalives) to $40$ seconds (OSPF dead timer) to detect a physical link failure over an intermediate Ethernet switch or dark fiber circuit.

BFD (Bidirectional Forwarding Detection) provides protocol-independent, low-overhead, sub-second failure detection:

• Operation: Microsecond/millisecond hello timers (e.g., 50ms–300ms intervals with a detection multiplier of 3).
• Integration: BFD can be enabled on Static Routes, OSPF Interfaces, and BGP Peer Groups.
• Failover Action: When BFD detects packet loss exceeding the threshold, it immediately signals the Virtual Router to tear down the routing adjacency and remove associated routes from the FIB in under 100–300 milliseconds.