Troubleshooting: BGP 'set next-hop-self-rr' enable does not work for VPNv4 routes

To resolve this issue, upgrade to FortiOS 8.0.0, which includes the feature to set next-hop-self-rr for VPNv4 routes.

The release date is scheduled for March 17, 2026.

Use the syntax below to configure a VPNv4 route reflector for a specific BGP neighbor:

config router bgp
    config neighbor
        edit <name>
            set next-hop-self-rr-vpnv4 {enable|disable}
            set next-hop-self-rr-vpnv6 {enable|disable}
        next
    end
end

Use the syntax below to configure a VPNv4 route reflector for a BGP neighbor group:

config router bgp
    config neighbor-group
        edit <name>
            set next-hop-self-rr-vpnv4 {enable|disable}
            set next-hop-self-rr-vpnv6 {enable|disable}
        next
    end
end

Verify BGP routes using the following CLI command:

get router info routing-table all

Since the NEXT_HOP attribute must be changed to a correct value, a new gateway should be visible for the specific BGP prefix.

get router info routing-table all

C 30.3.3.0/24 is directly connected, lo3
S V 30.3.3.1/32 [10/0] via tunnel_VRF3 tunnel 192.168.2.1, [1/0]
B V 30.5.5.5/32 [200/0] via 10.0.0.2 (recursive is directly connected, port4), 00:11:58, [1/0]

B V 101.101.101.101/32 [200/0] via 10.0.0.2 (recursive is directly connected, port4), 00:11:58, [1/0]

Workaround:

1. Configure the BGP neighbor group with the set next-hop-self-rr enable command.
2. Use incoming route-maps on the spokes to set the next-hop for VPNv4 routes using the set-vpnv4-nexthop option.

Related documents:

• Technical Tip: FortiOS BGP Resource List 
• Technical Tip: Explanation of 'set next-hop-self-rr enable' 
• Technical Tip: Understanding unexpected Next-Hop behavior in FortiGate ADVPN with BGP 
• Technical Tip: How to modify BGP next hop for route reflector peering