BGP confederations provide a way to divide an autonomous system (AS) into two or more sub-autonomous systems (sub-AS) to reduce the burden that the full mesh requirement for IBGP causes. The firewalls (or other routing devices) within a sub-AS must still have a full iBGP mesh with the other firewalls in the same sub-AS. You need BGP peering between sub-autonomous systems for full connectivity within the main AS. The firewalls peering with each other within a sub-AS form an IBGP confederation peering. The firewall in one sub-AS peering with a firewall in a different sub-AS form an EBGP confederation peering. Two firewalls from different autonomous systems that connect are EBGP peers.

Autonomous systems are identified with a public (globally-assigned) AS number, such as AS 24 and AS 25 in the preceding figure. In a PAN-OS environment, you assign each sub-AS a unique Confederation Member AS number, which is a private number seen only within the AS. In this figure, the confederations are AS 65100 and AS 65110. (RFC6996, Autonomous System (AS) Reservation for Private Use, indicates that the IANA reserves AS numbers 64512-65534 for private use.)

The sub-AS confederations seem like full autonomous systems to each other within the AS. However, when the firewall sends an AS path to an EBGP peer, only the public AS number appears in the AS path; no private sub-AS (Confederation Member AS) numbers are included.

BGP peering occurs between the firewall and R2; the firewall in the figure has these relevant configuration settings:

Router 2 (R2) in AS 65110 is configured as follows:

BGP peering also occurs between the firewall and R1. The firewall has the following additional configuration:

R1 is configured as follows:

BGP peering occurs between the firewall and R5. The firewall has the following additional configuration:

R5 is configured as follows:

After the firewall is configured to peer with R1, R2, and R5, its peers are visible on the Peer Group tab:

The firewall shows the R1, R2, and R5 peers:

To verify that the routes from the firewall to the peers are established, on the virtual router’s screen, select More Runtime Stats and select the Peer tab.

Select the Local RIB tab to view information about the routes stored in the Routing Information Base (RIB).

Then select the RIB Out tab.