Troubleshooting Tip: Routes being filter unexpectedly when using distribution-list

Description

This article describes that when a route/prefix is being filtered unexpectedly when using a distribution-list.

Scope

FortiOS.

Solution

In this example, FortiGate is advertising the following prefix to its BGP neighbor:

• 192.168.1.0/24.

• 192.168.2.0/24.

• 192.168.3.0/24.

• 192.168.4.0/24.

• 192.168.5.0/24.

FortiGate is using a distribution-list to filter the routes being advertised to its neighbor.

config router bgp

    set as 65400

    set router-id 128.1.7.251

    config neighbor

        edit "10.47.35.71"

            set distribute-list-out "spoke_route"

            set remote-as 65500

        next

    end



config router access-list

    edit "spoke_route"

        config rule

            edit 1

                set prefix 192.168.1.0 255.255.255.0

                set exact-match enable

            next

            edit 3

                set prefix 192.168.3.0 255.255.255.0

                set exact-match enable

            next

            edit 2

                set prefix 192.168.2.0 255.255.255.0

                set exact-match enable

            next

            edit 4

                set prefix 192.168.4.0 255.255.255.0

                set exact-match enable

            next

            edit 6

                set prefix 192.168.5.0 255.255.255.0

                set exact-match enable

            next

            edit 5

                set action deny

                set prefix any

            next

        end

    next

end

At first glance, an administrator may assume the configuration is correct; however, the FortiGate is not advertising the 192.168.5.0/24 prefix to its BGP neighbor.

Neo-kvm33 # get router info bgp neighbors 10.47.35.71 advertised-routes

VRF 0 BGP table version is 1, local router ID is 128.1.7.251

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path

*> 192.168.1.0      10.47.35.33                   100  32768        0 i <-/->

*> 192.168.2.0      10.47.35.33                   100  32768        0 i <-/->

*> 192.168.3.0      10.47.35.33                   100  32768        0 i <-/->

*> 192.168.4.0      10.47.35.33                   100  32768        0 i <-/->

Total number of prefixes 4

Neo-kvm33 # get router info bgp network 192.168.5.0

VRF 0 BGP routing table entry for 192.168.5.0/24

Paths: (1 available, best #1, table Default-IP-Routing-Table)

  Not advertised to any peer

  Original VRF 0

  Local

    0.0.0.0 from 0.0.0.0 (128.1.7.251)

      Origin IGP, localpref 100, weight 32768, valid, sourced, local, best

      Last update: Mon Jun  8 19:34:30 2026

When running BGP debugging, it can be confirmed that the 192.168.5.0/24 prefix is being filtered.

Neo-kvm33 # diagnose  ip router bgp all enable
Debug messages will be on for 30 minutes.

Neo-kvm33 # diagnose ip router bgp level info 
Debug messages will be on for 30 minutes.

Neo-kvm33 # diagnose debug enable 

Neo-kvm33 # diagnose debug console timestamp  enable 

Neo-kvm33 # execute router  clear  bgp ip 10.47.35.71 out

2026-06-08 19:44:44 BGP: 10.47.35.71-Outgoing [RIB] Announce Check: 192.168.5.0/24 is filtered

To resolve the issue, the access-list must be adjusted because the FortiGate processes entries based on Rule ID rather than the sequence order shown in the configuration file. This means the deny rule (Rule ID #5) is evaluated before Rule ID #6, even if Rule ID #6 appears above Rule ID #5.

config router access-list

    edit "spoke_route"

        config rule

            edit 1

                set prefix 192.168.1.0 255.255.255.0

                set exact-match enable

            next

            edit 3

                set prefix 192.168.3.0 255.255.255.0

                set exact-match enable

            next

            edit 2

                set prefix 192.168.2.0 255.255.255.0

                set exact-match enable

            next

            edit 4

                set prefix 192.168.4.0 255.255.255.0

                set exact-match enable

            next

            edit 5

                set prefix 192.168.5.0 255.255.255.0

                set exact-match enable

            next

            edit 1000

                set action deny

                set prefix any

            next

        end

    next

end

After applying the fix, it can be verified that the 192.168.5.0/24 prefix is now being advertised.

Neo-kvm33 # get router info bgp neighbors 10.47.35.71 advertised-routes
VRF 0 BGP table version is 1, local router ID is 128.1.7.251
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*> 192.168.1.0      10.47.35.33                   100  32768        0 i <-/->
*> 192.168.2.0      10.47.35.33                   100  32768        0 i <-/->
*> 192.168.3.0      10.47.35.33                   100  32768        0 i <-/->
*> 192.168.4.0      10.47.35.33                   100  32768        0 i <-/->
*> 192.168.5.0      10.47.35.33                   100  32768        0 i <-/->

Total number of prefixes 5

As a best practice, when configuring router access lists in their initial stage, the deny rule should be assigned the last possible Rule ID in the list. Note that assigning Rule IDs through the GUI is currently not supported.