Skip to main content
robdog
robdog
New Member
November 22, 2017
Question

Multiple BGP AS

  • November 22, 2017
  • 4 replies
  • 16541 views

Anyone know if it is possible to have the fortigate to connect to multiple BGP as ?

 

If so, does this have to be done by creating additional vdom's?

 

What I want to do is connect configure ipsec vpns to two separate aws environments via BGP.

 

Cheers

4 replies

robdog
robdogAuthor
New Member
November 23, 2017

I found the answer, if any one else needs to configure multiple local BGP AS

 

config router bgp  config neighbor  edit "IP of the neighbor"  ...  set local-as 300  set local-as-no-prepend disable|enable  set local-as-replace-as disable|enable  end  Enable local-as-no-prepend if you do not want to prepend local-as to incoming updates.  Enable local-as-replace-as to replace a real AS with local AS in outgoing updates. 

    cntx
    cntx
    Visitor III
    August 30, 2023

    Thumbs up. Though not applicable to my case but really appreciate the solution. 

     

     

    Network_Team
    Network_Team
    New Member
    April 24, 2024

    Did you get the answer, I have similar scenario. 

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    April 24, 2024

    What is your "scenario"? Original post was asking about multiple BGP neighbors. Of course it would work.

    Toshi

      Network_Team
      Network_Team
      New Member
      April 25, 2024

      I have Paloalto firewall with two ISP connection and below are the current setup

      1. static route 0.0.0.0/0 pointing to primary ISP AD 10

      2. static route 0.0.0.0/0 pointing to next virtual router(vr) which is connected secondary ISP ad 20

      3. bgp route 10.0.0.0/8 pointing to primary tunnel using secondary ISP link Lolal preference (200)

      4. bgp route 10.0.0.0/8 pointing to backup tunnel using primary ISP link Local preference (100)

      Basically my internet traffic go through primary internet and intanet traffic prefer secondary link. In case of link fail automatically failover happen.

      I need to do same thing on FortiGate.

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      April 25, 2024

      Your description doesn't make sense. If 10.0.0.0/8 is an aggregated route for the other side of the tunnel, it has nothing to do with the BGP neighboring to your ISP. ISP doesn't know anything about the 10/8 network. It has to be advertised from the opposite side if BGP, but more like you're talking about static routes into those two tunnels to the opposite side.

      What is/are your BGP neighbors: your ISPs or the other end of the tunnel?

      Toshi

        Network_Team
        Network_Team
        New Member
        April 25, 2024

        My requirement is simple, I want to use both isp links same time. For internet primary isp and intranet (remote site) secondary isp (through ipsec tunnel). Any link fail automatic failover should happen. How do we achive this in Fortigate. 

        funkylicious
        SuperUser
        funkylicious
        SuperUser
        April 25, 2024

        Your requirement seems quite simple.

         

        If your ISP1 fails, traffic should route towards ISP2 , while having IPsec tunnels ending/created on both links and preferring ISP1-IPsec tunnel for remote site and if ISP1 fails , traffic should exit towards internet on ISP2 and ISP2-IPsec for remote site.

         

        One thing you can do is configure a link-monitor, https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/360563/dual-internet-connections

         

        Another thing you can do is to configure an SDWAN zone for underlay ( Internet traffic / ISP interfaces ) and overlay for IPsec tunnels ( IPsec interfaces, one for each WAN link ).

        https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/942095/sd-wan-members-and-zones

        "jack of all trades, master of none"
          uskvishnu90
          uskvishnu90
          New Member
          May 21, 2024

          You understand my requirement correctly but small correction my internet traffic has to go through ISP1 incase of fail automatically failover to ISP2 and two ipsec tunnels configured using ISP1 & ISP2, my intranet traffic has to go through specifically ISP2 tunnel. How to achieve this using BGP. Please help me.

           

          Regards

          Vishnu (Network_Team is my official id)

          Terms & ConditionsAccessibility statement