How to Configure BGP Peering Over a Site-to-Site IPSec VPN?
You configured a single IPSec Cloud VPN tunnel for your organization to a third-party customer. You confirmed that the VPN tunnel is established. However, the BGP session status states that the BGP is not configured. The customer has provided you with their BGP settings: • Local BGP address: 169.254.11.1/30 • Local ASN: 64515 • Peer BGP address: 169.254.11.2 • Peer ASN: 64517 • Base MED: 1000 • MD5 Authentication: Disabled You need to configure the local BGP session for this tunnel based on the settings provided by the customer. You already associated the Cloud Router with the Cloud VPN Tunnel. What settings should you use for the BGP session?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the fundamental distinction between local and remote BGP parameters, with the primary trap being the accidental entry of the local ASN into the peer ASN field.
Configuring BGP over a site-to-site IPSec cloud VPN requires explicitly defining the remote peer's IP address and Autonomous System Number. The certification community unanimously agrees that the peer ASN must strictly match the customer's provided ASN, not the local router's identifier.
Candidates frequently select an option using the local ASN (64515) for the peer ASN, which violates eBGP peering rules and prevents session establishment due to AS path validation failures.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
BGP peering relies on accurate neighbor identification, requiring the remote device's IP (169.254.11.2) and its specific Autonomous System Number (64517) to establish an eBGP session. Link-local addresses in the 169.254.0.0/16 range are standard for point-to-point tunnel interfaces, making them ideal for BGP neighbors without consuming public IP space. Associating the Cloud Router with the tunnel handles IPsec phase 2 traffic, but BGP requires manual neighbor definition under the routing policy.Why the Other Options Are Wrong
Selecting the local ASN (64515) as the peer ASN incorrectly configures the session as iBGP, triggering loop-prevention mechanisms that immediately drop the connection. Options suggesting incorrect peer IPs would fail the TCP handshake on port 179, while mismatched authentication settings would cause MD5/TCP-AO negotiation failures. Since the question explicitly provides the customer's peer ASN, any deviation breaks the peering adjacency.Community Comment Notes
The candidate community strongly validates option C, with multiple users confirming that the peer ASN must represent the remote side's configuration. Comment [1] explicitly clarifies that 'the peer ASN should be the local ASN on the other side,' reinforcing the bidirectional nature of BGP parameters. Consensus remains absolute across all votes, indicating this is a straightforward parameter-mapping exercise rather than a complex troubleshooting scenario.Official Reference
- https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/configure-networking/configure-routing-features/configure-bgp-configuration/configure-a-cloud-router-for-bgp-over-sites-to-site-vpn-tunnels
- https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/configure-networking/configure-routing-features/configure-bgp-configuration/configure-bgp-neighbors
- RFC 4271 Section 8 (BGP Peering State Machine)
Exam Strategy
Always map the 'peer' fields to the remote device's exact specifications before committing BGP configurations. Verify that your local ASN differs from the peer ASN when designing eBGP topologies, and remember that tunnel interface IPs directly serve as BGP neighbor addresses in site-to-site deployments.
Related Analysis
Practice All PCNE Questions
Access 80 questions with complete answers and detailed explanations.
View Full PCNE Practice Test →