Troubleshooting Tip: Configuring priority for BGP default routes to establish a primary (preferred) and backup path

Description

This article describes the situations where, because of Reverse Path Forwarding (RPF) considerations, the FortiGate requires two default BGP routes across two external interfaces. The setup must satisfy these requirements: incoming traffic is permitted on both interfaces (port1 and port2), while outgoing traffic should prefer port1 exclusively, making ECMP unnecessary.

Scope

FortiGate.

Solution

In the below setup, eBGP is configured between FortiGate and the two ISPs:

FortiGate is getting a default route from both ISPs through BGP with the same AD value(20) and Priority (1):

The recommended approach is to configure different priorities for both the default routes. The route with the lowest priority value will serve as the best and primary route.

With the configuration below, it can be achieved:

Configure prefix list:

config router prefix-list
edit "Default-Route"
   config rule 
    edit 1
   set prefix 0.0.0.0 0.0.0.0
   next
 end
   next
end

Configure two Route-maps for both ISPs and set priority :

config router route-map    edit "ISP-1"
config rule
edit 1
set match-ip-address "Default-Route"
set set-priority 100   
next
end
next
end

 set set-priority 100 --> Route Priority for ISP-1.

config router route-map
edit "ISP-2"
config rule
edit 1
set match-ip-address "Default-Route"
set set-priority 200  
next
end
next
end

 
set set-priority 200  --> Route Priority for ISP-2.

Apply the route-map to each BGP neighbor:

config router bgp
config neighbor
edit "10.5.139.114"
set route-map-in "ISP-1"
next
edit "10.5.209.34"
set route-map-in "ISP-2"
next
end
end

In most environments, when setting priority in a BGP route-map, the 'recursive-inherit-priority' setting should also be disabled in the router bgp configuration. This ensures the intended priority assigned in the route-map is not overwritten by the priority of a route used to resolve the next-hop to an egress interface.

config router bgp
set recursive-inherit-priority disable
end

Note:

When to Enable or Disable recursive-inherit-priority:

Enable:

Use it when hubs or routers need to inherit SD-WAN/SLA or recursive route priorities dynamically through BGP.

Disable:

(Default in many basic setups): Keep it disabled if you are manually setting route priorities via route-maps and want to prevent the system from overwriting your custom priority with the next-hop resolution route's priority.


Note:

After applying the route-maps, perform a soft reset for BGP neighbors. See the article Technical Tip: BGP soft reset to refresh BGP routing table without tearing down existing peering sessions

Run one of the following commands to soft reset the incoming routes:

execute router clear bgp ip A.B.C.D soft in
execute router clear bgp ip A.B.C.D in

Here, A.B.C.D will be the neighbor's IP address.

Now the route will be installed with different priority values:

Note:

If routes are not visible, the following BGP debugs can be performed for troubleshooting:

diagnose ip router bgp all enable

diagnose ip router bgp level info

diagnose debug enable

To stop it:

diagnose debug reset