Technical Tip: How to check BGP advertised and received routes on a FortiGate

Description

This article describes how to check BGP-advertised and received routes on a FortiGate.

Scope

FortiGate.

Solution

Topology:

EBGP peering between FGT1 and FGT2 is up. In this lab setup, both FortiGates are advertising their Loopback interfaces via eBGP to each other.

Outputs from FortiGate1:

FortiGate1# get router info bgp summary
BGP router identifier 3.3.3.3, local AS number 65003
BGP table version is 11
2 BGP AS-PATH entries
0 BGP community entries

Neighbor        V         AS  MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.56.240.2   4      65004    670      667       10            0    0        2d15h37m        2

Total number of neighbors 1

Once a BGP connection is established, the field State/PfxRcd will be updated if local FortiGate receives any prefixes from its BGP peer. BGP announces networks in the BGP 'UPDATE' packet. If routes are not advertised or received, the following capture should be performed on the FortiGate:

diagnose sniffer packet any ' Host <BGP Neighbour IP>  and  port 179' 6 0 l 

This capture can be performed from the FortiGate GUI as it provides a Wireshark-readable file: Troubleshooting Tip: Packet Capture on FortiOS GUI.

Example:

FortiGate1 is advertising and is learning two routes. 

The command to verify the routes FortiGate1 is advertising to FortiGate2 is:

get router info bgp neighbors <neighbor IP> advertised-routes

For example:

FortiGate1 # get router info bgp neighbors 10.56.240.2 advertised-routes
BGP table version is 11, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric  LocPrf   Weight   RouteTag Path
*> 3.3.3.3/32       10.56.240.1                     100     32768        0              i
*> 50.50.50.50/32   10.56.240.1               100     32768        0              i

Total number of prefixes 2

The command to verify routes that FGT1 is receiving from the BGP peer FGT2 is:

get router info bgp neighbors 

The command 'get router info bgp neighbors' shows details of the neighbors, including: Peer IP address, router ID, remote AS, BGP state, and the negotiated capabilities.

get router info bgp neighbors <neighbor IP> received-routes

The command 'get router info bgp neighbors <neighbor IP> routes' shows only filtered (in) received routes. If received routes are not filtered, the output of these commands will be the same. 

For example:

FortiGate1 # get router info bgp neighbors 10.56.240.2 route
BGP table version is 11, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight RouteTag Path
*> 4.4.4.4/32       10.56.240.2                              0           0       65004 i
*> 75.75.75.75/32   10.56.240.2                        0            0       65004 i

Total number of prefixes 2

FortiGate1 # get router info routing-table bgp

Routing table for VRF=0
B       4.4.4.4/32 [20/0] via 10.56.240.2, port1, 00:50:26
B       75.75.75.75/32 [20/0] via 10.56.240.2, port1, 00:50:26

For testing purposes, filter received routes on FortiGate1. Apply a prefix-list to allow only 75.75.75.75/32:

FortiGate1 # config router prefix-list
    edit "ALLOW-ONLY-75"
        config rule
            edit 1
                set prefix 75.75.75.75 255.255.255.255
                unset ge
                unset le
            next
        end
    next
end

FortiGate1 # config router bgp
    set as 65003
    set router-id 3.3.3.3
        config neighbor
            edit "10.56.240.2"
                set soft-reconfiguration enable
                set prefix-list-in "ALLOW-ONLY-75"
                set remote-as 65004
            next
end

As seen with 'set prefix-list-in "ALLOW-ONLY-75"', the prefix-list is filtering received routes.

The output below shows all received routes.

FortiGate1 # get router info bgp neighbors 10.56.240.2 received-routes
BGP table version is 11, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight RouteTag Path
*> 4.4.4.4/32       10.56.240.2                                0          0         65004 i
*> 75.75.75.75/32   10.56.240.2                           0          0          65004 i
 
Total number of prefixes 2

The output below shows only filtered (in) received routes.

FortiGate1 # get router info bgp neighbors 10.56.240.2 route
BGP table version is 11, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network                   Next Hop            Metric LocPrf  Weight  RouteTag  Path
*> 75.75.75.75/32   10.56.240.2               0                    0          0             65004 i

Total number of prefixes 1

FortiGate1 # get router info routing-table bgp

Routing table for VRF=0
B       75.75.75.75/32 [20/0] via 10.56.240.2, port1, 00:55:45

It is possible to filter specific subnets or routes based on AS number etc, with the 'grep' keyword:

get router info bgp neighbors <x.x.x.x> advertised-routes | grep <network subnet>
get router info bgp neighbors <x.x.x.x> advertised-routes | grep <AS number>

The following commands will show the IPv6 neighbors, network, the routing table, and received and advertised routes in the CLI:

get router info6 bgp neighbors
get router info6 bgp network bgp
get router info6 routing-table bgp
get router info6 bgp neighbors <x.x.x.x> received-routes 
get router info6 bgp neighbors <x.x.x.x> advertised-routes 

Note:

If an error occurs after running the 'get router info bgp neighbors <neighbor IP> received-route', then enable the 'set soft-reconfiguration enable' command under the BGP neighbor.

For example:
 

FortiGate1 # get router info bgp neighbors 10.56.240.2 received-routes
% Inbound soft reconfiguration not enabled

To enable soft configuration:

config router bgp
    config neighbor
        edit "10.56.240.2
            set soft-reconfiguration enable      
end

This option enables (or disables) allowing IPv4 inbound soft reconfiguration. Once enabled, FortiGate starts storing BGP neighbor-received updates.

Note:

For BGP to advertise any prefixes, the prefixes need to be installed on the RIB first, either by static routes, directly connected, or learned by other dynamic routing protocols. This is not a FortiOS design, but how the BGP protocol works. When the port goes down, the connected route will be removed from the routing table.

BGP prefers the route with the longest prefix length when multiple routes exist to the same destination.

To allow routes to be advertised in BGP that are not installed on the routing table, use the following command:

config router bgp
    set network-import-check disabled
end

This configuration can be applied to a per-prefix network according to the following settings, where 'set network-import-check disable' will override the global 'enable' settings for this prefix.

config router bgp
    set network-import-check enable
        config network
            edit 1
                set prefix 75.75.75.75 255.255.255.255
                set network-import-check disable
        end
end

Under 'config network', the available options for 'network-import-check' are:

• global: Use global network synchronization value (default).

• enable: Enable network synchronization per prefix.

• disable: Disable network synchronization per prefix.

Related article:

Technical Tip: FortiOS BGP Resource List