Technical Tip: BGP route advertisements not received BGP neighbor over IPsec site-to-site tunnel
Description
This article describes that the BGP peering up between two Fortigates over an IPsec tunnel. The routes are being advertised by hub towards spoke, however, spoke is not receiving all the routes. Checking the advertised-routes on hub, it can be seen that almost 2250 are being advertised. The spoke is only receiving a single default route.
Routes Advertised.
HUB # get router info bgp neighbors 10.10.10.2 advertised-routes
BGP table version is 52383, local router ID is 10.10.10.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight RouteTag Path
Total number of prefixes 2250 <----- Advertised routes by Hub FortiGate.
Spoke received:
Spoke # get router info bgp neighbors 10.10.10.1 received-routes
BGP table version is 35, local router ID is 10.10.10.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight RouteTag Path
*> 0.0.0.0/0 10.10.10.1 0 0 64831 13009 64753 i
Total number of prefixes 1 <----- Received routes by Spoke FortiGate.
Troubleshooting Commands:
# diagnose ip router bgp all disable
# diagnose ip router bgp updates enable
# diagnose ip router bgp level info
# diagnose debug enable
# diagnose debug disable ---> to stop the debugs.
Note:
Starting from v7.2.0+, it is possible to collect BGP debugs for a specific neighbor by using the filter command 'diag ip router bgp set-filter neighbor <neighbor address>'. Follow this KB article for more details: Technical Tip: Capture BGP debugs for a specific neighbor
Spoke Debugs:
BGP: 10.10.10.1-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (44), msg_size (44)
BGP: 10.10.10.1-Outgoing [DECODE] Update: NLRI Len(1)
BGP: 10.10.10.1-Outgoing [FSM] State: Established Event: 27
BGP: 10.10.10.1-Outgoing [RIB] Update: Received Prefix 0.0.0.0/0 <----- Only default prefix is received.
Scope
With larger updates, ESP packets are dropped or blocked because of a firewall or routing issue somewhere in the path between the FortiGate's WAN interface and the remote VPN peer, which prevents VPN traffic from flowing properly.
Solution
- In such case, enforce NAT-T over the IPsec tunnel can help in fixing the issue.
config vpn ipsec phase1-interface
edit "s2s-ipsec"
set interface "wan1"
set peertype any
set nattraversal forced ïƒ Add the following command
set proposal aes128-sha256 aes256-sha256 3des-sha256
set npu-offload disable
set remote-gw x.x.x.x
set psksecret ENC
next
- If NAT-T does not help, it is advised to lower the MTU on the IPsec interface. This can be seen in scenarios where GRE over IPsec might be used.
config system interface
edit "s2s-ipsec"
set mtu-override enable/disable
set mtu 1300
end
end
Related article: