Prevent BGP loop

when it comes to define particular advertised networks, i personally prefer to use prefix-lists to send/accept routes from peers, try creating and using those if in/out networks

you could also mark the routes from MLPS with a community and make sure to discard/reject it ( the community ) when received by a peer on VPN or the other way around.

Hi Funky,

Thanks so much for the reply, but I think you are misunderstand the situation.

FG run BGP with HUB on 2 peer. The route advertised on both of them to HUB. When the HUB learn routes on MPLS it advertise back to FG via VPN. The behavior the same when HUB learned route via VPN, it advertised back to FG via MPLS. That is situation I want to prevent.

I tested: on Hub I set community route map in for routes learned via VPN then deny it in route map out which applied on MPLS interface. But I cannot do the same for VPN because the Tunnel is peering with multi FG

So you’re saying you have only one phase1-interface for all remote FGTs connected to it? We almost never do that for simplicity. 
Anyway, regardless one phase1 or multiple, BGP works per neighbor. So as long as each remote FGT has a unique IP to peer with the HUB FGT, 
Then without a proper diagram, which shows your design/strategy with the communities, I can’t tell why or what’s not working.

Also, are you using eBGP or iBGP.

Toshi
 

Again, since you’re not providing a proper diagram, especially BGP topology, I still can’t anderstand what your problem is. If iBGP the routes came from an iBGP nighbor would never advertise to another iBGP peer. Even if eBGP, if the HUB FGT is directly peering with a spoke FGT, the ASN is the same so the HUB shouldn’t re-advertise the route from the same spoke back to it. Are you neighboring with MPLS provider with a different AS? At least provide some key AS numbers for HUB and spokes and MPLS provider.

Toshi