Skip to main content
mhdganji
mhdganji
Explorer III
July 14, 2022
Solved

EIGRP between routers connecting to fortigate

  • July 14, 2022
  • 3 replies
  • 4467 views

Hi,

I have two routers serving a lot of EIGRP neighbors and are neighbors together. I have to use a Fortigate device between two routers and prefer to configure it in NAT mode. Putting the Fortigate in between, the EIGRP neighborship breaks and the dynamic routing protocol fails even if I set any any allow rule between two points. As a matter of fact, somehow it is not possible to use different IP sets at both sides and fire up the routing protocol. So, what are my choices?

 

Do static routing?

configure the firewall in transparent mode?

do any special config to make the EIGRP protocol work in this way?

 

Any help is appreciated

 

 

Best answer by mhdganji

I used a transparent VDOM, a little challenges but done !

3 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
July 14, 2022

Without having much knowledge about EIGRP, the first thing came to my mind is a tunnel like GRE or IPSec between them through the FGT, then you can use a single subnet for neighboring.

 

Then when I looked up "EIGRP multihop" on the internet, I found a bunch of documentation with "EIGRP OTP(over the top)" like below:
https://www.packet-forwarding.net/2014/10/09/eigrp-otp-example/

 

The concept seems to be similar to setting up a tunnel but originally designed to use BGP over the internet as underlying protocol. But seems to work even without it as long as both ends can reach each other like in the above article.

In any case, it's about how to set up Cisco routers at both ends so it's much proper to ask it at Cisco Community instead for this option.

 

Toshi

 

mhdganji
mhdganjiAuthor
Explorer III
July 14, 2022

If you tunnel via GRE or anything, traffic will not be examined and no security policy works. I already tested it to make sure and was right and it should be this way.

 

BGP, OSPF and route redistribution is a choice but complex to implement and tshoot.

 

I will ask in Cisco forums but the first answer is routing protocols redistribution and static routing. I'm asking here because maybe something like Wire Pair or Multicasting or transparent mode is an option ...

 

EIGRP OTP ... I should read about it 

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
July 15, 2022

Transparent mode should always be an option. I never used it before so I let someone else to comment.

 

Toshi

mhdganji
mhdganjiAuthorAnswer
Explorer III
July 17, 2022

I used a transparent VDOM, a little challenges but done !

Terms & ConditionsAccessibility statement