Skip to main content
roxy_kk
New Member
November 12, 2024
Question

How to avoid Assymetric Routing with Fortigate with a new BGP link

  • November 12, 2024
  • 2 replies
  • 997 views

HI All,

 

Have a setup where I have a pair of Fortigate FW cluster (A-P)  connected into ACI Fabric under a VRF1. Have BGP configured to learn routes dynamically . There is a new requirement to create a new VRF2 on the Fabric and move this BGP connection onto that .While configuring this on the firewall we plan to create a new interface in the same zone and plan to move traffic from Link 1 to Link 2. Now it is understood that when we do this we will end up breaking existing connections which are in the session table ( with successful 3 way handshakes) . Trying to find a solution where by we can move the traffic from the primary link to secondary link without impacting existing connections. Any ideas ?

2 replies

spoojary
Staff
Staff
November 12, 2024

To move traffic from the primary link to the secondary link without impacting existing connections when transitioning to a new VRF and interface setup in a FortiGate firewall cluster connected to an ACI fabric, mplement route leaking between VRF1 and VRF2 using BGP to allow communication between the two VRFs without impacting existing connections. This ensures that traffic can flow between the VRFs seamlessly. Create policy routes to redirect specific traffic from the primary link to the secondary link without affecting existing connections. By configuring policy routes, you can control the flow of traffic based on specific criteria, such as source address or protocol.

Toshi_Esumi
SuperUser
SuperUser
November 12, 2024

Until seeing and examining the detailed network diagram including HA compoenents, two VRFs and BGP neighborings, probably nobody would be able to provide any useful information toward the "solutions". Besides, VRF separation and route leaking are two networking mechanisms that could work against each other. There are certain situations leaking specific routes, such as management traffice, while all other other routes/traffic need to be separated/isolated each others.

Also it's not clear if you're concerning about the migration without having a maintenance window or fail-over situations after the migration is done.
But this kind of design consideration is probably beyond this FTNT community.

Toshi

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!