How to Configure Security Policies to Allow BGP
BGP runs by sending five types of BGP messages: Open, Update, Notification, Keepalive, and Route-refresh. A TCP connection is set up between two adjacent devices. Then, the two devices exchange Open messages to set up a BGP peer relationship and send Keepalive messages to confirm and maintain the peer relationship. BGP peers send Update, Notification, and Route-refresh messages to exchange routing information, error information, and route refresh capabilities.
All BGP messages are transmitted in unicast mode. Therefore, security policies need to be configured to permit traffic in both directions. BGP uses TCP port 179.
No. |
Name |
Source Security Zone |
Destination Security Zone |
Source Address/Region |
Destination Address/Region |
Service |
Action |
|---|---|---|---|---|---|---|---|
101 |
Allow bgp out |
Local |
Untrust |
10.1.1.10/24 |
10.1.2.10/24 |
bgp (TCP: 179) |
permit |
102 |
Allow bgp in |
Untrust |
Local |
10.1.2.10/24 |
10.1.1.10/24 |
bgp (TCP: 179) |
permit |