PSA: PAN-OS Drops BGP peers with an invalid NLRI / Always filter inbound prefixes from Avi Vantage

If Avi Vantage IPAM cannot allocate an address for a new vIP, it will advertise an all-zeros host address — 0.0.0.0/32:

This will cause Palo Alto PAN-OS to restart a peer — even if it is not the immediate downstream prefix. Palo Alto uses routed as their dynamic routing engine — so this is probably default behavior inherited from there:

**** EXCEPTION 0x4103 - 57 (0000) **** I:008e7cd1 F:00000004 qbmlpar2.c 1352 :at 20:54:21, 2 May 2021 (1822572648 ms) UPDATE message contains NLRI of 0.0.0.0. **** PROBLEM 0x4102 - 46 (0000) **** I:008e7cd1 F:00000004 qbnmmsg.c 1074 :at 20:54:21, 2 May 2021 (1822572648 ms) NM has received an UPDATE message that failed to parse. Entity index = 1 Local address = 10.6.64.9 Local port = 0 Remote address = 10.6.64.12 Remote port = 0 Scope ID = 0 **** EXCEPTION 0x4102 - 71 (0000) **** I:008e7cd1 F:00000020 qbnmsnd2.c 167 :at 20:54:21, 2 May 2021 (1822572648 ms) A NOTIFICATION message is being sent to a neighbor due to an unexpected problem. NM entity index = 1 Local address = 10.6.64.9 Local port = 0 Remote address = 10.6.64.12 Remote port = 0 Scope ID = 0 Remote AS number = 64905 Remote BGP ID = 0X0A06400C Error code = UPDATE Message Error (3) Error subcode = Invalid Network Field (10)

This could cause a network outage for all subtending networks on this peer. Consider this a friendly reminder to always leverage route filtering between autonomous systems!

Unfortunately, strict import filters on PAN-OS did not resolve this issue.

Originally published at https://blog.engyak.net.