Configuration eBGP // HA cluster //

Hello @khaled88 ,

- you can check this optimizing the BGP when there is HA failover to  avoid traffic interruption:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-HA-and-BGP-graceful-restart/ta-p/196150 

In case of HA, please have a look this article for routing table update

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Controlling-how-HA-synchronizes-routing-table/ta-p/191310

Hi @khaled88 ,

Are you sharing IPv6 routes? If not, try disabling the ipv6 family.

config neighbor
edit "1.1.1.1"
set activate6 disable
next
end

regards

Hello, 

Thank you for your response. 

I will try to explain again the problem, I have tow fortigate en HA cluster (Active/Passive) in our side to onther Side we have tow Fortigate en standolone mode (ISP1 and ISP2) , the bgp session is up with ISP 1 and flapping with ISP2 FW. 
note that we have 2 nexus with vpc configuration in the middle. 

Still not clear the topology with many typos in your description. Do you have a diagram?
Do you have totally 4 FGTs, two in a-p HA and two more standalones? Which one of those is peering with ISP1 and ISP2? A simple diagram would clarify these.

Toshi

Hello, 

thank you for your answer. 

Find attached the design.

BGP session between FW2 and FW_ISP1 keep flapping (standby )
BGP session between FW2 and FW_ISP2 is stable (primary )

Best regards, 

Are those 3 parties (FW_ISP1, FW_ISP2, HA FGT) on the same VLAN through the switches within the same subnet (like a /29)? Then each has a different/unique AS (eBGP)? Or do the ISP1 and ISP2 FGTs have the same AS and they're not peering each other?

I'm assuming pinging each others don't show any sign of packet losses.
Please share us the BGP config ("config router bgp") at all parties.

Toshi

Hello, 

I'm sorry for the delay, the same problem when we disabling the BFD. 

KH

Hello, 

Thank you for your response. 

Bellow the configuration for the Other End : 
config router bgp
set as "public AS"
set router-id X.X.X.X
set holdtime-timer 240
edit "172.16.20.35"
set soft-reconfiguration enable
set prefix-list-in "PREFIXES_IN"
set prefix-list-out "PREFIXES_OUT"
set remote-as "Private_AS"

As you see BFD is not set. So leave it out on local end. And subnets are different (192.168.20.x and 172.16.20.35). There must be a routing device in between.
This troubleshooting requires getting in the FGTs and see what's going on then test something, which can't do over community posts. You have to open a ticket at TAC then let the TAC person to examine and troubleshoot this.

Toshi