topic Re: BGP routing information The status of the route is Hidden and Rank:N/A in Firewall and Security Management

BGP routing information The status of the route is Hidden and Rank:N/A

zhangchuang — Mon, 05 Dec 2022 13:51:43 GMT

Hello fellow Check Mates,

The customer configures the following configurations on the peer BGP:

bgp 65015

graceful-restart

peer 172.16.40.78 as-number 65115

peer 172.16.40.78 bfd min-tx-interval 300 min-rx-interval 300

peer 172.16.40.78 bfd enable

peer 172.16.70.78 as-number 65500

peer 172.16.70.78 bfd min-tx-interval 300 min-rx-interval 300

peer 172.16.70.78 bfd enable

peer 198.19.210.85 as-number 18084

peer 198.19.210.85 bfd min-tx-interval 300 min-rx-interval 300

peer 198.19.210.85 bfd enable

ipv4-family unicast

undo synchronization

import-route direct

import-route static

peer 172.16.40.78 enable

peer 172.16.40.78 route-policy MAP-CX-IN import

peer 172.16.70.78 enable

peer 172.16.70.78 route-policy AS-PATH import

peer 172.16.70.78 route-policy AS-PATH export

peer 198.19.210.85 enable

route-policy AS-PATH permit node 10

if-match ip-prefix AS-PATH

apply as-path 65500 65500 65500 65500 65500 65500 65500 65500 65500 65500 additive

ip ip-prefix AS-PATH index 10 permit 192.168.99.0 24

ip ip-prefix AS-PATH index 20 permit 10.7.0.0 19

After A Route-policy is added, the status of the route received by the checkpoint firewall is displayed as Hidden and Rank:N/A

The BGP configurations of the checkpoint firewall are as follows:

set bgp external remote-as 65015 on

set bgp external remote-as 65015 peer 172.16.70.65 on

set bgp external remote-as 65015 peer 172.16.70.65 ping on

set bgp external remote-as 65025 on

set bgp external remote-as 65025 peer 172.16.80.65 on

set bgp external remote-as 65025 peer 172.16.80.65 ping on

Please help to analyze the cause of this, thank you!

Re: BGP routing information The status of the route is Hidden and Rank:N/A

Chris_Atkinson — Mon, 05 Dec 2022 15:26:47 GMT

Local AS and the as-path prepend are the same value, if I recall correctly this would break BGP rules.

If this is absolutely necessary you may need to look at the allow-as-in-count feature to "bend" loop prevention.

Re: BGP routing information The status of the route is Hidden and Rank:N/A

Blason_R — Tue, 06 Dec 2022 02:39:20 GMT

Or as-override to accept that as a route else @Chris_Atkinson said it will not install the route in route table. Though you can see in received route

Re: BGP routing information The status of the route is Hidden and Rank:N/A

zhangchuang — Tue, 06 Dec 2022 02:48:47 GMT

If I change the value of the AS path prefix, can I solve this problem?

Re: BGP routing information The status of the route is Hidden and Rank:N/A

Blason_R — Tue, 06 Dec 2022 03:26:28 GMT

Nope it won't I believe - This is what you are receiving the routes correct? I guess you will have to use as-override

e.g. - In my scenario

set bgp external remote-as 65001 peer 192.168.203.153 allowas-in-count 5

Where my BGP AS and remote BGP AS was same and we had a carrier in between which was not overriding the AS hence I had to do it on firewall

Re: BGP routing information The status of the route is Hidden and Rank:N/A

Chris_Atkinson — Tue, 06 Dec 2022 03:59:41 GMT

Probably the as-path needs to be changed yes (to the remote-as) or better use a different method altogether such as local preference/med etc.

Usually you would only prepend your own AS number on outbound route advertisements.

Re: BGP routing information The status of the route is Hidden and Rank:N/A

zhangchuang — Tue, 06 Dec 2022 04:02:13 GMT

I now ask the BGP on the opposite side to change the AS path prefix. At present, normal routes can be obtained. Thank you for your support.