CloudLabBox
Try the free demo

Palo Alto NGFW lab 18 of 30

Dynamic routing: OSPF inside, BGP to the ISP, redistribution between them

Make FW1 a real routing participant: OSPF with the depot core router, eBGP with the ISP, a discard route for Calder's public block advertised into BGP, and the ISP's default route redistributed into OSPF. Verify adjacencies and routes from both sides, then map it all to the Advanced Routing Engine.

Run this lab

It needs Lite: its 4 nodes are set to 5 vCPU and 7,680 MB in total. That fits the free demo too.

In your workspace: Shared, then Palo Alto NGFW PAN-OS 11 guided labs, then 18 - Dynamic routing - OSPF inside BGP to the ISP redistribution between them

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
5 vCPU, 7,680 MB
Smallest plan
Lite

The scenario

The depot has grown:

  • A Cisco CORE router now serves the users (10.1.10.0/24) and the warehouse VLAN (10.1.20.0/24). It's already running OSPF area 0 and points nothing at the firewall yet.
  • The ISP (AS 64500) has given Calder a provider-independent block, 192.0.2.0/24, and wants an eBGP session from Calder's AS 65010. The ISP sends a default route and its test prefix 198.51.100.0/24.

Users are translated to 192.0.2.10. That only works once the ISP learns 192.0.2.0/24 from you.

Static routes won't scale here. FW1 must learn the inside networks over OSPF, learn the internet over BGP, announce Calder's block to the ISP and hand CORE a default route.

Before you start. Start all the nodes. The firewall takes 6-8 minutes to boot and comes up with this lab's starting configuration already loaded. Wait until the FW1 console shows FW1 login:, then log in as admin / Lab-Access-1. Until the management plane is ready it answers Login incorrect, even with the right password. The Linux hosts are ready within seconds. The two Cisco routers are ready in about two minutes.

What you’ll practise

  • Configure OSPF on the virtual router with the right link type and a passive loopback
  • Configure eBGP with a peer group and install BGP routes
  • Use redistribution profiles to advertise a public prefix into BGP and the default route into OSPF
  • Verify neighbours, routes and the forwarding path on PAN-OS and on Cisco IOS peers
  • Explain how the Advanced Routing Engine's logical routers map to these settings

The tasks

  1. Check the starting point
  2. OSPF with the core router
  3. eBGP with the ISP
  4. Announce Calder's block, and hand CORE a default route
  5. Verify from every side
  6. The same design on the Advanced Routing Engine

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Dynamic routing - OSPF inside BGP to the ISP redistribution between them4 nodes and 1 network, 5 links. Every link is listed as text below the diagram.FW1COREISPClient-PCUserseth0Gi0/1ethernet1/2Gi0/0ethernet1/1Gi0/0mgmt
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FW1 ethernet1/1 to ISP Gi0/0
  • FW1 ethernet1/2 to CORE Gi0/0
  • CORE Gi0/1 to Users (network)
  • FW1 mgmt to Users (network)
  • Client-PC eth0 to Users (network)
Nodes in Dynamic routing: OSPF inside, BGP to the ISP, redistribution between them, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FW1Palo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB
CORECisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
Client-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Palo Alto NGFW PAN-OS 11 guided labs.

  3. Open 18 - Dynamic routing - OSPF inside BGP to the ISP redistribution between them and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Palo Alto NGFW labs

All Palo Alto NGFW labs

Related labs in other courses

CloudLabBox is independent of Palo Alto Networks and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.