Technical Tip: BGP neighborship failure after upgrading to v7.4.0 and above

The behavior is observed after upgrading the FortiGate to v7.4.0 and above and downgrading back to v7.2.x and below solves the issue.

The following error or related AFI error will be seen on the peer device, the below shows the error code in a Cisco router :

"error: BGP: 10.11.1.1- Outgoing [DECODE] Open MPC: Invalid AFI(25)"

On FortiGate packet capture, the Peer is sending the FIN ACK packet after the Open Message packet, and as a result the BGP neighborship will not be successful.

This is because FortiGate is sending a capability parameter which is an unsupported Address Family Identifier (AFI) value of 25 not recognized by the Cisco router.

The capability parameter sent by FortiGate can be seen on Wireshark in the Open Message packet as per below:

AFI: value 25 is nothing but EVPN capabilities and this is enabled on versions 7.4.x by default. To disable this, run the command below:

config router bgp
    config neighbor
        edit x.x.x.x <----- Replace x.x.x.x with neighbor IP.
            set activate-evpn disable <----- Set this to disable.
        end
    end

Related document:

config router bgp