I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to another AWS service. I cannot host the BGP instances on single VR because of differences on how AWS public and private VIF behave. How do I redistribute 1000+ prefixes from secondary VR to primary VR?

Currently, I have a BGP session established between both VRs with different peer groups. However, when I try to export the routes from secondary VR into main VR, I do not see any of the filtered routes in RIB-Out for secondary VR. I thought I would redistribute BGP routes but apparently that is not allowed, and throws an error

In virtual-router Second-VR, the redistribution profile Redist_profile has source filter type BGP, it cannot be used with BGP as export rule.
Configuration is invalid

I saw on one reddit post that "PA will not advertise learned routes from an AS to the same AS", so I removed the AS Path and used the _2345$ AS Path regex. Still no luck.

  • 2
    If two routers are BGP peers, you don't need to redistribute routes. Your export profile should allow the routers to exchange routes.
    – Ron Trunk
    Sep 11 '20 at 12:09
  • Export profile doesn't work with either narrowing the prefixes or filtering by next-hop IP address nor by matching the prefixes from other peer group. I have tried different combinations of match profile, but doesn't seem to work for some reason. Sep 11 '20 at 12:21
  • Can your profile allow everything? does that work?
    – Ron Trunk
    Sep 11 '20 at 12:55
  • How do I allow everything? By keeping everything default in the "Match" tab of Export? If so, then also it doesn't work. Sep 11 '20 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.