My BGP routes are showing as Hidden and Inactive

[blason]

Hi Team,

I am facing this one more issue with BGP and route from other path is being received as Hidden and Inactive. I have scenario as depict in diagram. I am currently receiving route from Provider 1 whcih is fine. However route received from Provider 2 is showing as Hidden and Inactive on my firewall routing table.

I am at FW1 with AS 64520 with network 172.31.24.0/24 while other peer is 64520 as well with network 10.100.0.0/16. However we are connected with two providers and route learned from provider-2 is getting as Hidden and Inactive from FW1 perspective.

Can someone please help?

set bgp external remote-as 9730 on
set bgp external remote-as 9730 peer xx.xx.xx.xx on
set bgp external remote-as 9730 peer xx.xx.xx.xx holdtime 15
set bgp external remote-as 9730 peer xx.xx.xx.xx keepalive 5
set bgp external remote-as 65001 on
set bgp external remote-as 65001 peer yy.yy.yy.yy on
set bgp external remote-as 65001 peer yy.yy.yy.yy as-override on

Here is my route table at FW1

#show route bgp

B               10.100.0.0/16       via xx.xx.xx.xx, eth1, cost None, age 913492

And here is the issue

B               10.100.0.0/16       via xx.xx.xx.xx, eth1, cost None, age 913540
B          H i  10.100.0.0/16       is an unusable route

[Harold Ritter]

Hi @blason ,

Can you provide the

show bgp 10.100.0.0/16 extensive

output.

Regards,

[blason]

Unfortunately this command is not available. This is a checkpoint firewall.

[MHM Cisco World]

I know little about FW with BGP
but why override is config ?

[blason]

Yes - However this is a simple BGP. I mean I would appreciate if you can tell me the reason behind it; I can see how do I convert this to

checkpoint firewall bgp

command.

[Harold Ritter]

Hi @blason ,

I was looking at the checkpoint support site and it seems like you need an inbound route-map to accept this route. Do you have an inbound route-map set on the other peer by any chance?

Regards,

[blason]

Inbound Route map on R1 or R3? have you followed any specific sk from check point support site?

[blason]

I guess do I need to use

allowas-in   Accept a IPv4-route that contains the local-AS in the as-path

[Harold Ritter]

Hi @blason ,

Yes, you need that. You probably have it configured for one of the peers already, since the prefix is accepted from one of them.

Regards,

[blason · Accepted solution]

This resolved the issue -

set bgp  external remote-as 65001 peer yy.yy.yy.yy allowas-in-count 2

This command is specific to Check Point!!