Stop receiving default route via BGP

Forum|Forum|6 years ago
October 28, 2019
6 replies
5491 views

I currently do not have a default IPv6 static route installed; however, it appears BGP is installing a default route out to my ISP. If I were to apply a default static IPv6 route out, would I stop receiving this auto populated route?

I ask, because I am getting route to install another ISP and I do not want two equal default paths. I do not want to perform load-balancing.

I am looking for suggestions.

emnoc

New Member

build a prefix-list and set in on inbound for that peer.

E.g

config router prefix-list6 edit "dropit" config rule edit 1 set prefix6 ::/0 next end

config router route-map edit "dropinfromISP1" config rule edit 1 set match-ip-address "dropit" next end next end

config router bgp set as 5706 config neighbor edit 1.x.x.x set remote-as 174 set route-map-in6 "dropinfromISP1" next end

The above would allow just that prefix in the bgp6 table, if you wanted to drop it change to deny and maybe add a permit anything else. Test the match-statements and give it a try

Ken Felix

gradius85Author

New Member

Just to make sure I fully understand - but you are suggestion to create an Access Control List (ACL) to block in the inbound route. Then I would apply a default static route out, which would have an AD of 1 or 0 and a metric/priority of 0?

The end idea - after the second IPS is installed, I want to put a policy route for some of my Class C blocks being advertised by my ISP via BGP to route out via a specific ISP link. I can run with Asymmetric routing with no problem; however, or so I think. I noticed on some documentation that you can turn on 'set asymmetric enable', but how can you tell in the logs if your firewall is dropping traffic due to asymmetric routing?

emnoc

New Member

Not sure what you are trying to do, but back to 2x ISP, you firewall is not going to do load-balance unless you enable ecmp.

As far as policy-based routing, yes you can try that but I suspect asymmetrical routing will become an issue if your advertising the NETWORK via 2x ISP bgp-peers.

Also, heed fortios warning and especially with UDP datagrams. Your traveling into terrority that is dangerous

https://kb.fortinet.com/kb/documentLink.do?externalID=FD39943

Suggestion;

Can you not just use SDWAN and apply specific SDWAN rules for those destinations that you want to route?

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/22371/sd-wan-rules-best-quality

I never used BGP SDWAN interfaces, but I do not see why this would not work.

Ken Felix