set interface under router bgp neighbor config

Forum|Forum|6 years ago
May 31, 2020
3 replies
13341 views

Good day everyone,

I am trying to understand what this command is used for to no avail. I did it under the neighbor configs and nothing seemed to happen. Any ideas?

Thanks.

Yuri.

config neighbor
    edit "12.12.12.12"
        set soft-reconfiguration enable
        set interface "Loop2"   <-- This one ?
        set prefix-list-in "accept-dflt-only"
        set remote-as 111
        set route-map-out "LocalOutACL"
        set update-source "Loop2"  <-- I thought these were interrelated but didn't find any link
        set weight 10
    next
end

Best answer by emnoc

Okay I will explain;

the port and update source in your setup is redundant. Lets say you had a bgp cfg similar to

config router bgp 5555

neighbor 1.1.1.1 remote-as 1111

And only the interface was defined, the update src=ip would be what ever that interface x.x.x.x address was set to.

If you set the update-source it uses that "address" and thru the interface.

Update sources are used when you are trying to use a loopback interface from my experience.

Ken Felix

emnocAnswer

New Member

Okay I will explain;

the port and update source in your setup is redundant. Lets say you had a bgp cfg similar to

config router bgp 5555

neighbor 1.1.1.1 remote-as 1111

And only the interface was defined, the update src=ip would be what ever that interface x.x.x.x address was set to.

If you set the update-source it uses that "address" and thru the interface.

Update sources are used when you are trying to use a loopback interface from my experience.

Ken Felix

YuriskAuthor

SuperUser

emnoc wrote:
If you set the update-source it uses that "address" and thru the interface.
Update sources are used when you are trying to use a loopback interface from my experience.
Ken Felix

Thanks Ken, you pointed me to the right direction.

Turns out "interface port1" works like in VPN SSL "source interface" - it makes BGP process LISTEN on port1 for INCOMING BGP port 179 connections. That is, it effectively makes local FG passive BGP peer - it does not initiate BGP peering, only accepts incoming BGP negotiations.

Setting "source update" on the other hand causes FG to initiate BGP peering with source of the Loopback, so it can act as active BGP peer.

The difference, I guess, can only matter if FG has security rules allowing just outgoing from Loopback connections. In my set up it was the case, so when I removed "source update", it turned local FG into passive BGP peer and w/o security rules allowing incoming TCP port 179, the session went down:

New config:

FG3-AS1680 # show router bgp
config router bgp
    set as 1680
    config neighbor
        edit "12.12.12.12"
            set ebgp-enforce-multihop enable <-- to be on the safe side added this as well but it didn't matter
            set soft-reconfiguration enable
            set interface "Loop2" <--- Left just this one, removed source update
            set prefix-list-in "accept-dflt-only"
            set remote-as 111
            set route-map-out "LocalOutACL"
            set weight 10
        next

The result is:

LOCAL FG:
BGP: 12.12.12.12-Outgoing [FSM] State: Idle Event: 3
BGP: 12.12.12.12-Outgoing [NETWORK] FD=23, Sock Status: 0-Success
BGP: 12.12.12.12-Outgoing [FSM] State: Connect Event: 17
BGP: 12.12.12.12-Outgoing [ENCODE] Msg-Hdr: Type 1
BGP: 12.12.12.12-Outgoing [ENCODE] Open: Ver 4 MyAS 1680 Holdtime 180
BGP: 12.12.12.12-Outgoing [ENCODE] Open: Msg-Size 61
BGP: 12.12.12.12-Outgoing [NETWORK] FD=23, Sock Status: 107-Transport endpoint is not connected
BGP: 12.12.12.12-Outgoing [FSM] State: OpenSent Event: 18

REMOTE FG:
BGP: 3.3.3.3-Outgoing [NETWORK] FD=22, Sock Status: 110-Connection timed out
BGP: 3.3.3.3-Outgoing [FSM] State: Connect Event: 18

The moment I allowed on local FG incoming TCP 179, session went up again.

yurisk.info - all things Fortinet blog, no ads