Technical Tip: 'BGP won't exchange routes after a reboot'

Problem Overview

BGP sessions may fail to establish when a FortiGate is rebooted, and routes will not be shared. This occurs because the BGP connect-timer is set to its maximum value (65535), causing the FortiGate to wait over 18 hours before attempting to establish a BGP connection.

Troubleshooting Steps:

Check BGP neighbor status.
The BGP summary shows neighbors in the 'Active' state in ADVPN spoke.

get router info bgp summary

VRF 0 BGP router identifier 4.4.4.4, local AS number 65000

BGP table version is 1

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd

10.4.9.2 4      65000       0       0        1    0    0 00:02:07        Active

Analyze network traffic:
Running packet capture on TCP port 179 (BGP) shows no BGP traffic between devices, suggesting that FortiGate is not attempting to initiate BGP connections.

FW#  diagnose sniffer packet any '10.4.9.2 and tcp and port 179' 4 10

Configuration Review:

config router bgp
  set as 65000
    set router-id 9.9.9.9
    config neighbor
    edit "10.4.9.1"
    set remote-as 65000
    set connect-timer 65535  <-----
   next
end

Explanation:

The issue can be seen when using FortiManager's BGP provisioning templates in v7.4.6 and 7v.4.7. When creating BGP templates, an invalid default connect-timer value is initially set.

While FortiManager validates this and allows correction, the value typically defaults to 65535 seconds. This excessive delay prevents BGP connections from establishing in a reasonable timeframe.