Technical Tip: How to change administrative distance for BGP learned routes received for a particular neighbor

Description

This article describes how to modify the administrative distance of routes learned from specific iBGP or eBGP neighbors. Adjusting the administrative distance allows BGP-learned routes to be preferred over, or deprioritized relative to, routes learned through other routing protocols.

Scope

FortiGate.

Solution

In FortiOS, administrative distance determines which route is installed in the routing table when the same prefix is learned from multiple routing protocols. Routes with a lower administrative distance are preferred over routes with higher values.
By default, eBGP routes have an administrative distance of 20, OSPF routes 110, and iBGP routes 200.

In the following example, the prefix 172.16.21.0/24 is learned from both an OSPF neighbor (172.16.24.5) and an iBGP peer (10.200.1.1).

Since the default administrative distance of the iBGP-learned route (200) is higher than that of the OSPF-learned route (110), the OSPF route is preferred and installed in the routing table.

As a result, traffic destined for 172.16.21.0/24 is forwarded using the OSPF route.

get router info routing-table details 172.16.21.3 

Routing table for VRF=0
Routing entry for 172.16.21.0/24
  Known via "bgp", distance 200, metric 0
  Last update 00:00:55 ago
    vrf 0 10.200.1.2 priority 1 (recursive is directly connected, S1-P1)

Routing entry for 172.16.21.0/24
  Known via "ospf", distance 110, metric 2, best
  Last update 1d22h46m ago
  * vrf 0 172.16.24.5, via port4

To prefer the iBGP-learned route over the OSPF-learned route, the administrative distance must be adjusted.
In the following example, the administrative distance for the BGP neighbor is set to 50, making the iBGP route more preferred than the OSPF route with an administrative distance of 110.

The configuration is shown below:

config router bgp
    config admin-distance
        edit 1
            set neighbour-prefix 10.200.1.1 255.255.255.255            
            set distance 50
        next
    end
end

After making changes, it is advised to perform a soft BGP reset:

execute router clear bgp ip 10.200.1.1 soft 

After the change, the iBGP learned route will be installed with administrative distance of 50 and hence will be preferred over the OSPF peer:

get router info routing-table details  172.16.21.0

Routing table for VRF=0
Routing entry for 172.16.21.0/24
  Known via "bgp", distance 50, metric 0, best
  Last update 00:00:19 ago
  * vrf 0 10.200.1.2 priority 1 (recursive is directly connected, S1-P1)

Routing entry for 172.16.21.0/24
  Known via "ospf", distance 110, metric 2
  Last update 1d22h57m ago
    vrf 0 172.16.24.5, via port4

If route filtering is required for a specific prefix, an access list can be configured and applied to the BGP neighbor.
This ensures that only the matching prefix is assigned an administrative distance of 50, while all other prefixes learned from the neighbor retain their default administrative distance.

config router access-list
    edit "access-172.16.21.0"
        config rule
            edit 1
                set prefix 172.16.21.0 255.255.255.0
            next
        end
    next
end

config router bgp
    config admin-distance
        edit 1
            set neighbour-prefix 10.200.1.1 255.255.255.255
            set route-list "access-172.16.21.0"
            set distance 50
        next
    end
end

Observe that only the prefix 172.16.21.0/24 is installed with administrative distance 50, other are installed with the default administrative distance 200.

get router  info routing-table bgp 
Routing table for VRF=0
B    10.10.36.0/24 [200/0] via 10.100.0.2 (recursive via 10.9.15.254, port1), 00:00:12, [1/0]
B    10.100.0.1/32 [200/0] via 10.200.1.1 (recursive via S1-P1 tunnel 10.9.10.106), 00:00:12, [1/0]
B    10.100.0.2/32 [200/0] via 10.100.0.2 (recursive via 10.9.15.254, port1), 00:00:12, [1/0]
B    172.16.21.0/24 [50/0] via 10.200.1.2 (recursive is directly connected, S1-P1), 00:00:12, [1/0]

To troubleshoot BGP communication after performing changes on the BGP configuration, run the following debug commands:

diagnose ip router bgp all enable
diagnose ip router bgp level info
diagnose debug enable

To disable the debugging:

diagnose ip router bgp all disable
diagnose debug disable