Technical Tip: Control BGP route advertisement using distribution-list

The distribution-list allows control on route advertisement based on the prefixes or subnet mask defined in the access-list. 

In the following example, FortiGate-A has 3 loopback networks, 1.1.1.1/32, 2.2.2.2/32, and 3.3.3.3/32. The distribution-list is applied on FortiGate-A so that it only advertises network 2.2.2.2/32 and 3.3.3.3/32 to FortiGate-B.

Configuration on FortiGate-A:

config router access-list

    edit "block001"

        config rule

            edit 1

                set action deny
                set prefix 1.1.1.1 255.255.255.255
                set exact-match enable

            next
            edit 2

                set prefix any
                set exact-match enable

            next

        end

    next

end

config router bgp

    config neighbor

        edit "10.10.10.2" 

            set distribute-list-out "block001"

        next

    end

end

Without a distribution-list, FortiGate-A advertises network 1.1.1.1/32 to FortiGate-B:

FortiGate-A # get router info bgp neighbors 10.10.10.2 advertised-routes
VRF 0 BGP table version is 2, local router ID is 10.47.2.158
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*>i1.1.1.1/32 10.10.10.1 100 32768 0 i <-/->
*>i2.2.2.2/32 10.10.10.1 100 32768 0 i <-/->
*>i3.3.3.3/32 10.10.10.1 100 32768 0 i <-/->

FortiGate-B # # get router info bgp neighbors 10.10.10.1 received-routes
VRF 0 BGP table version is 4, local router ID is 10.47.4.192
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*>i1.1.1.1/32 10.10.10.1 100 0 0 i <-/->
*>i2.2.2.2/32 10.10.10.1 100 0 0 i <-/->
*>i3.3.3.3/32 10.10.10.1 100 0 0 i <-/->

With the distribution-list, FortiGate-A only advertises network 2.2.2.2/32 and 3.3.3.3/32. The network 1.1.1.1/32 is filtered out.

FortiGate-A # get router info bgp neighbors 10.10.10.2 advertised-routes
VRF 0 BGP table version is 2, local router ID is 10.47.2.158
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*>i2.2.2.2/32 10.10.10.1 100 32768 0 i <-/->
*>i3.3.3.3/32 10.10.10.1 100 32768 0 i <-/->

FortiGate-B # get router info bgp neighbors 10.10.10.1 received-routes
VRF 0 BGP table version is 3, local router ID is 10.47.4.192
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*>i2.2.2.2/32 10.10.10.1 100 0 0 i <-/->
*>i3.3.3.3/32 10.10.10.1 100 0 0 i <-/->

BGP debug on FortiGate-A shows that network 1.1.1.1/32 is filtered. 

id=20300 msg="BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 10.10.10.2 Up "
BGP: 10.10.10.2-Outgoing [RIB] Announce Check: 1.1.1.1/32 is filtered