JunOS iBGP session not establishing

Question

I have a test environment set up with two Juniper vSRX instances and a L2 network trunked between them and can reach each other on the IP addresses I'm trying to peer them on.

vSRX 1 has an external BGP session and full tables and vSRX 2 is bare; I'm trying to configure an iBGP mesh between them. Both vSRX's have all of their BGP config in a routing instance and not in the base.

I've replaced a publicly routable subnet with 10.0.0.1 in the below configurations.

vSRX 1:

instance-type virtual-router;
interface ge-0/0/0.200;
routing-options {
...
    router-id 10.0.0.1;
    autonomous-system [external-as-number];
}
protocols {
    bgp {
        traceoptions {
            file bgp size 1m files 5;
            flag all;
        }
        log-updown;
        group ibgp-ipv4 {
            type internal;
            local-address 10.0.0.1;
            family inet {
                unicast;
            }
            neighbor 10.0.0.2;
        }
    }
}

vSRX 2:

instance-type virtual-router;
interface ge-0/0/0.200;
interface ge-0/0/1.300;
routing-options {
...
    router-id 10.0.0.2;
    autonomous-system [external-as-number];
}
protocols {
    bgp {
        traceoptions {
            file bgp size 1m files 5;
            flag all;
        }
        log-updown;
...
        group ibgp-ipv4 {
            type internal;
            local-address 10.0.0.2;
            family inet {
                unicast;
            }
            neighbor 10.0.0.1;
        }
    }
}

I've checked firewall policies and have a global catch all policy for bgp to be allowed anywhere

The BGP logs show this, but I can't see any sign of why the TCP session is closed:

task_process_events_internal: connect ready for BGP_[external-as-number]_[external-as-number].10.0.0.2
bgp_connect_complete: error connecting to 10.0.0.2 (Internal AS [external-as-number]): Socket is not connected
bgp_close_socket: peer 10.0.0.2 (Internal AS [external-as-number])
task_close: close socket 43 task BGP_[external-as-number]_[external-as-number].10.0.0.2
task_reset_socket: task BGP_[external-as-number]_[external-as-number].10.0.0.2 socket 43
bgp_event: peer 10.0.0.2 (Internal AS [external-as-number]) old state Connect event OpenFail new state Idle
bgp_event: peer 10.0.0.2 (Internal AS [external-as-number]) old state Idle event Start new state Active

Am I missing something obvious here, or should the session be establishing, even without import / exports etc?

Regards

Answer 1

If you're using a vSRX, you will need to add your interfaces into a security zone, and ensure that host-inbound traffic allows BGP eg:

set security zones security-zone PEERING interfaces ge-0/0/0.200
set security zones security-zone PEERING host-inbound-traffic protocols bgp