BGP unable to establish due to traffic drop on gateway firewall
book
Article ID: 378369
calendar_today
Updated On:
Products
VMware vDefend Firewall
Issue/Introduction
You are running IPV4 and/or IPv6 BGP to peer with next hop router.
You will observe there are BGP down alarms in the NSX-T UI for either IPV4 or IPv6.
You have configured BGP allow rules on the Tier-0 Gateway firewall.
You have configured IPV4 or IPv6 for the IP protocol for the BGP allow rule similar to the screenshot below:
You will either have inet or inet6 in the rule on the NSX-T edge cli when running command get firewall <firewallinterfaceUUID> ruleset rules
Rule : inout inet protocol tcp from any to any port 179 accept Rule : inout inet6 protocol tcp from any to any port 179 accept
Inet protocol in the first rule above means IPv4 traffic will be processed only.
Inet6 protocol in the second rule above means IPv6 traffic will only be processed only.
NOTE: The preceding log excerpts are only examples. Date, time and environmental variables may vary depending on your environment.
Environment
VMware NSX-T Data Center 4.x
VMware NSX-T Data Center 3.x
Cause
If you a running IPv4 and/or IPv6 BGP the traffic will get dropped by the Tier-0 gateway firewall if the appropriate IP protocol is not enabled. See Documentation for reference.
Resolution
If you are using IPv4 only then set the IP protocol to IPV4 only.
If you are using IPv6 only then set the IP protocol to IPv6 only.
If you are using both then set the IP protocol to IPv4-IPv6.
See Documentation for creating a Gateway Firewall Policy and Rule for reference.