Skip to main content
santosp
santosp
Visitor III
August 10, 2022
Question

DSCP marking for BGP

  • August 10, 2022
  • 5 replies
  • 3775 views

Hi, 

It seems the FortiGate is marking BGP routing traffic with TOS Hex (tos=ff/ff) which seems to be not getting preserved causing BGP dropouts during high link usage.

Is there a way to tag BGP traffic ? I tried creating a shaper matching port 179 but that didnt help. 

Thank you.

5 replies

jiahoong112
Staff
jiahoong112
Staff
August 10, 2022

You may find both of these resources useful:-

https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/672387/using-bgp-tags-with-sd-wan-rules  -> Binding BGP tags with SDWAN rules. 

SD-WAN rules can use BGP learned routes as dynamic destinations.

 

https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/380145/configuring-sd-wan-rules -> On the SDWAN rules, you can specify the TOS value

santosp
santospAuthor
Visitor III
August 11, 2022

Hi @jiahoong112  Thanks for sharing. Yes those are good references for SDWAN with community and TOS marking. But I am looking for a plane BGP routing marked with CS6 with high priority so that the peering stays up even in case of high link utilization. Fortigate seems to be marking it with tos=ff/ff which seems to be not preserved. A manual shaper setting DSCP and reserving bandwidth is not helping.

BGP control plane traffic is not matching or getting remarked to DSCP CS6 and there should be something which I am missing in the configuration.

jiahoong112
Staff
jiahoong112
Staff
August 12, 2022

Actually, those are using BGP dynamic routing in an SDWAN configuration. My thought process of linking both documents is because you can configure SDWAN Rules to use BGP routing whilst using the TOS marking on those SDWAN rules, which in a way, might achieve what you're seeking. I personally have not tested this myself.

santosp
santospAuthor
Visitor III
August 12, 2022

Yes you are correct in marking DSCP via SDWAN network. I am looking for peer to peer (CE-PE) routing protocol control traffic preservance. Fortigate seems to be not tagging it with CS6 why is why peering drops.

RogersKuvalis
RogersKuvalis
New Member
August 11, 2022

I'm incredibly impressed with your post because it has caught my curiosity so much. I anticipate seeing more fantastic posts. geometry dash

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.