Technical Tip: FortiGate BGP flapping due to IPv6 advertisement

When FortiGate peers with other devices, there are instances where the BGP peering with IPV4 would flap even though the link is stable.

When the BGP is configured using the GUI, the 'config network6' would be added.

The BGP debug would also show 'Update MP Reach: Prefix ::/128'.

Enable BGP debugs: 

diagnose ip router bgp all enable

diagnose ip router bgp level info

diagnose debug enable

To disable BGP debugs:

diagnose ip router bgp all disable

diagnose ip router bgp level none

diagnose debug reset

From the BGP error message, it could be seen that 'UPDATE Message Error/Optional Attribute Error.' was received from the peer. 

This would cause the peer to bring down the peering due to not accepting the IPv6 prefix.

To avoid the advertisement for the IPv6 prefix over BGP, the following command can be configured:

config router bgp

    config neighbor

        edit "NEIGHBOR-PEER-IP"

            set activate6 disable

        next

    end

end

The FortiGate will stop advertising the IPv6 prefix to the neighbor or use an outbound route-map to block any IPv6:

config router prefix-list6
    edit "deny-all-ipv6"
        config rule
            edit 1
               set prefix6 any
               set action deny
            next
        end
    next
end

config router route-map
    edit "block-ipv6-out"
        config rule
            edit 1
                set match-ip6-address "deny-all-ipv6"
                set action deny
            next
        end
    next
end

config router bgp
    config neighbor
        edit "<peer-ip>"
            set route-map-out6 "block-ipv6-out"
        next
    end
end