Technical Tip: BGP configuration behavior updated from FortiGate

Description

This article describes the behavior of BGP configuration (router map, prefix list, distribution list, filter list, and others) changes on the FortiGate that are not updated in the FortiManager ADOM Database.

In this context, FortiGate managed by FortiManager is using a Provisioning Template, and consists of a BGP Template assigned to the FortiGate.

Scope

FortiManager and FortiGate.

Solution

When changes are made on FortiGate, for example, Prefix List In, by adding another rule under Network -> BGP -> Select Neighbors -> IPv4 Filtering -> Prefix list in -> Select prefix-list -> Select the pencil icon -> Rules -> Create New.

Where these changes are not updated in FortiManager ADOM Database, under Policy & Objects -> Advanced -> CLI Configurations -> Under Search Bar type 'prefix-list' -> Select prefix-list.

The Device Level Database is updated, which is expected to use the BGP configuration at the device level. This can be observed in Device Manager -> Device & Groups -> Managed FortiGate -> Select FortiGate -> CLI Configurations -> Under Search Bar type 'prefix-list' -> Select router prefix-list.

Even though the Import Policy Package is performed, it will not update the database since it is not being used at the policy level.

To address this, since FortiGate is assigned to the BGP Template, the template value will take precedence if not updated from there; either update the value from the template or perform an import for the template.

Update BGP Template.
Under Device Manager -> Provisioning Template -> BGP -> Select BGP Template -> Edit -> Select Neighbors -> IPv4 Filtering -> Prefix List In -> Select Prefix List -> Select pencil icon -> Rules -> Create New.

Import BGP Template.
Under Device Manager -> Provisioning Template -> BGP -> More -> Import -> Enter Template Name and select the specific device related to BGP config changes.

Once the BGP Template is imported, check that the prefix-list rules are updated in the ADOM Database.

Make sure that once the BGP Template is updated, the device needs to be assigned to the template or under Template Groups if it is assigned.

Related article:

Technical Tip: Import (IPsec, BGP, SDWAN) configuration as template in FortiManager