topic Re: How to allow BGP port over VTI in Firewall and Security Management

How to allow BGP port over VTI

Blason_R — Thu, 29 Apr 2021 16:56:02 GMT

Hi Team,

I have configured VTI tunnels with AWS and tunnels are up however we have setup BGP between peers and in log for port 179 it shows

According to the policy the packet should not have been decrypted

So do I need to set separate rule to allow TCP 179? Or is that allowed by default. Due to this my routing is not coming up.

Re: How to allow BGP port over VTI

the_rock — Thu, 29 Apr 2021 17:51:37 GMT

I am pretty sure you would need to allow it, but one way to know 100% is to run this on cp firewall while testing:

fw ctl zdebug + drop | grep 179

That would tell you if anything is being dropped on the port on the kernel level.

Re: How to allow BGP port over VTI

Bob_Zimmerman — Thu, 29 Apr 2021 18:41:30 GMT

That is the VPN equivalent of antispoofing. It generally happens when you are using a route-based VPN, but also have encryption domains set on the tunnel endpoints. Is the peer's encryption domain set to an empty group?

Re: How to allow BGP port over VTI

Blason_R — Sat, 01 May 2021 05:25:40 GMT

Yes we will have to allow it and I was using wrong peer name than configured in dashboard. Plus what I learned is - this rule should be above stealth rule.