Technical Tip: BGP AS-Path prepending configuration example

Purpose:
For enterprise networks using BGP with a multi-homed solution (connected to more than one ISP). It is often required to design the internet link with a primary/backup setup where the lower speed/lower quality internet link should only be used when the primary link has failed.

Since both ISPs are independent, the local preference might be lower on the desired/primary internet link and resulting in the desired traffic flow through the lower speed/quality path.

Even though there is a higher local preference on the Primary ISP router and lower on the secondary ISP router, some reverse traffic may hit the FortiGate via the secondary ISP link.

As Local preference is a non-transitive attribute, routers in the Primary ISP exchange is only inside their own AS (AS65101 in the example) and cannot pass it to the Secondary ISP’s AS (AS65201). Due to this, Secondary ISP is unaware of the Local Preference value set on the Primary AS.

In this case, BGP route selection can be influenced by using the AS_PATH attribute with multiple copies of the local AS number (AS-path prepending).

Diagram:

• BGP route selection on an Internet router for the return path/traffic can be influenced by using AS_PATH, which is a transitive attribute.
• BGP prefers the shortest AS path to reach the destination.
  
• It is possible to manipulate the path used by the return traffic with AS_PATH prepending while advertising the FortiGate DMZ prefix 93.184.216.34/32 to the Secondary ISP rather than relying on the Local Preference configured at the ISP end.
• Even if Secondary ISP AS65201 has to reach DMZ prefix 93.184.216.34/32 behind the FortiGate, it will prefer the Primary ISP AS65101 as the next hop. It is because FortiGate advertises this prefix to the Secondary ISP with a longer AS_PATH compared to the same prefix advertised by the Primary ISP.
• To manipulate the outgoing traffic from the FortiGate and prioritize the Primary ISP connection over Secondary ISP, make sure to set a higher Local preference or Weight for Primary ISP BGP peer than the Secondary ISP peer.

Configuration:
Interface Configuration with WAN1 (Primary ISP) and WAN2 (Secondary ISP), DMZ is the prefix to be published out, which is simulated by a Loopback interface:

config system interface

    edit "port2"

        set vdom "root"
        set ip 202.1.1.1 255.255.255.240
        set allowaccess ping
        set type physical
        set alias "WAN1"

    next
    edit "port3"

        set vdom "root"
        set ip 202.2.2.1 255.255.255.240
        set allowaccess ping
        set type physical
        set alias "WAN2"

    next

    edit "DMZ"

        set vdom "root"
        set ip 93.184.216.34 255.255.255.255
        set allowaccess ping
        set type loopback

    next

end

Route-map to publish the AS-Path with pre-pending:

config router route-map

    edit "Secondary_ISP"

        config rule

            edit 1

                set set-aspath "65301 65301 65301"

            next

        end

    next

end

Route-map that sets a higher local preference for prefixes received from the Primary ISP:

config router route-map

    edit "Primary_ISP"

        config rule

            edit 1

                set set-local-preference 200

            next

        end

    next

end

The route-maps are applied to both BGP neighbors:

config router bgp

    set as 65301

        config neighbor

            edit "202.1.1.2"

                set remote-as 65101
                set route-map-in “Primary_ISP”

            next
            edit "202.2.2.2"

                set remote-as 65201
                set route-map-out "Secondary_ISP"

            next

        end

        config network

            edit 1

                set prefix 93.184.216.34 255.255.255.255

            next

        end

    set router-id 3.3.3.3

end

Verification:

The following output shows on the Secondary ISP router before the pre-pending technique is applied, the best path to reach 93.184.216.34/32 is via 202.2.2.1:

ISP2-R1 # get router info bgp network
BGP table version is 8, local router ID is 2.2.2.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

 S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

     Network        Next Hop       Metric LocPrf Weight RouteTag Path

*> 93.184.216.34/32 202.2.2.1            0             0        0 65301 i

* i                 101.1.1.1            0    100      0        0 65101 65301 i

*> 202.2.2.0/28     0.0.0.0                  100  32768        0 i

The following output shows on the Secondary ISP router after the pre-pending technique was applied, the best path to reach 93.184.216.34/32 is via 101.1.1.1 now:

ISP2-R1 # get router info bgp network
BGP table version is 10, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

      Network       Next Hop       Metric LocPrf Weight RouteTag Path
*>i93.184.216.34/32 101.1.1.1            0    100      0        0 65101 65301 i
* 202.2.2.1                              0             0        0 65301 65301 65301 65301 i
*> 202.2.2.0/28     0.0.0.0                   100  32768        0 i

Related articles:
Technical Note: Configuring BGP on a FortiGate with single-homed eBGP peering, iBGP peering, access-list and OSPF

Technical Tip: BGP dual-home example - solution to avoid RPF problem in asymetric routing scenario