AWS IPSEC on BGP routing (how to control traffic preference for each tunnel?)

Hi @FortDoog, 

I hope this article will help: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-redundant-IPSEC-tunnel-to-AWS-VPC/ta-p/253018

Regards, 

One question I forgot to ask.

Does these settings work with ECMP enabled or not? that on the AWS side.

Good day, I  wanted to add a closure to this. 

Me and my team were able to configure the 4 tunnels in cascade disabling the ECMP on the AWS side (that´s what management wanted so, ye).

One thing that came up was the route filtering. Which I think I did not understand the concept well.

With the Prefix List, I found somehting. The subnets I have on AWS are all /16. My UNDERSTANDING was that setting the prefix list to accept /11 will actually bring those /16 networks using it in the following way:

edit "AWS_Brazil_in"
config rule
edit 1
set prefix a.b.c.d 255.224.0.0
set ge 11
unset le

BUT, it did ot work like that, instead, in the log I was seeing that it was denying the routes because of that filter. I found it odd, because I thought that filter meant: allow all routes that are enclosed by /11, being /16 is inside it.

What I DID find out was that I had to setup the filter likes this:

edit "AWS_Brazil_in"
config rule
edit 1
set prefix a.b.c.d 255.224.0.0
set ge 15
set le 25

With that, the firewall filtered the routes correctly. That´s the only thing I found odd, because I wanted to summarize as much as possible to have fewer filters as possible. If anyone can give me a "simple man terms" explanation on how to use it (remember, english is NOT my first language) I would apreciate it.

The rest of the instructions given were applied and worked flawlessly.

I'm not sure if I understand your requirement. But the prefix-list matches what you specify and let matched ones come in (or go out) and take them into BGP table (or send them to neighbors) "as is". It wouldn't summarize to /16 when a /27 matches the prefix-list and place the /16 into the local BGP table.

If you, instead, want to summarize routes when the FGT advertise, like multile /24s into one /16, to its neighbors, you can use "aggregation" below.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-implement-BGP-route-summary-aggregation-on/ta-p/196101

But I don't know if AWS side support route aggretation on its end. You can probably ask AWS support if they support or not. My guess is they would support though.

Toshi

Hi,

Hi FortDoog,
I think what you planned to do with BGP prefixes was right. However, to work with the prefix list, I believe you should change it slightly.
I think the common rule for prefix-list is "len <GE <=LE"
In your case the prefix you configured a.b.c.d 255.224.0.0 ==> the len is 8+7 =15 (225 use 8 bits, 224 use 7 bits)
==> It should be "ge 15"
1. you can do "ge 15" only.
2. or ge 15 le 25
(In your first case, ge 11 is an invalid one, I think)
HTH
Bill

ge and le length need to be longer than the network length. The error message says it all

FGTxxxxx1 (1) # next
Invalid prefix range -- make sure: len < ge-value <= le-valueobject check operator error, -650, discard the setting
Command fail. Return code 1

I think this is common with other routers like Cisco. Or FTNT copied this spec from Cisco.

Toshi

Ok, now I understand.

For posterity or anyone reading this. The filters (ge and or le) MUST be different than the subnet you are trying to filter.

Like Bill and Toshi said:

• set prefix a.b.c.d /20 for example.

The ge would NOT be 20, neither le.

It has to be:

• in case of ge, 19. So it will take all network greater than 19, those will be, 20, 21, and so on.
• Or the reverse of it,  in case of le, 21. Is kinda like a math equation.