Issue advertised and received routes peering eBGP between Fortigate and Cisco router

Hi everyone,

I'm in charge of preparation and configuration of Peering eBGP between Fortigate 800D and Cisco ASR but unfortunately I meet different issues when I wanna advertised prefixes from Fortigate Firewall to ASR router.

I must execute the soft reset out command on Fortigate to apply the changement and seen my prefix appears on router.

execute router clear bgp ip 10.10.10.1 soft out

execute router clear bgp ip 10.10.10.3 soft out

When I changed the prefix-list on Firewall and add a new prefix to advertise (available on routing talbe), nothing change dynamically.

Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer Local

After execution of soft reset out, the Firewall advertised the prefix properly.

FORTIGATE

Paths: (1 available, best #1, table Default-IP-Routing-Table) Advertised to non peer-group peers: 10.10.10.1 10.10.10.3

BGP CISCO

*> 10.40.30.0/24  10.10.10.1             10    140      0 64520 ?

Please find below the 2 configurations :

Fortigate Firewall :

config router bgp set as 64520 set router-id 1.1.1.1 set keepalive-timer 10 set holdtime-timer 30 set graceful-restart enable

config neighbor edit "10.10.10.1" set capability-graceful-restart enable set capability-default-originate enable set soft-reconfiguration enable set as-override enable set remote-as 4XXXX set route-map-in "RM-IN-R1" set route-map-out "RM-OUT-R1-R2"

set keep-alive-timer 10 set holdtime-timer 30 set update-source "VLAN_1600" next edit "10.10.10.3" set capability-graceful-restart enable set capability-default-originate enable set soft-reconfiguration enable set as-override enable set remote-as 4XXXX set route-map-in "RM-IN-R2" set route-map-out "RM-OUT-R1-R2" set keep-alive-timer 10 set holdtime-timer 30 set update-source "VLAN_1601" next

config router route-map edit "RM-OUT-R1-R2" config rule edit 10 set match-ip-address "PFS-OUT-R1-R2" next end next edit "RM-IN-R1" config rule edit 10 set match-ip-address "PFS-IN-R1-R2" set set-local-preference 120 next end next edit "RM-IN-R2" config rule edit 10 set match-ip-address "PFS-IN-R1-R2" set set-local-preference 110 next end next

config router prefix-list edit "PFS-OUT-R1-R2" config rule edit 10 set prefix 10.40.30.0 255.255.255.0 unset ge unset le next end next edit "PFS-IN-R1-R2" config rule edit 10 set prefix 0.0.0.0 0.0.0.0 unset ge set le 32 next end

Router Cisco:

router bgp 4XXXX vrf CLIENT-A rd 4XXXX:207 address-family ipv4 unicast ! neighbor 10.10.10.2 remote-as 64520 address-family ipv4 unicast route-policy RM-IN-FW in route-policy RM-OUT-FW out as-override soft-reconfiguration inbound always !

neighbor 10.10.10.4 remote-as 64520

address-family ipv4 unicast route-policy RM-IN-FW in route-policy RM-OUT-FW out as-override soft-reconfiguration inbound always !

Do you have a similar behavior ? Let me know if you have best practices to configure eBGP peering on Fortigate.

Fortigate running v5.6.3,build1547 version

I'm looking forward to hearing from you.

Regards.