Technical Tip: Advertising SSL VPN IP pool over BGP

[srajapratap]

Description	This article describes how to advertise the SSL VPN pool over BGP. Topology: FGT-HO-----Internet-----FGT-BO. FGT-HO has SSL VPN clients connected to it using the pool of 15.0.0.0/24 subnet, and it is required to advertise that pool over BGP (either eBGP or iBGP) and make the route accessible on FGT-BO.
Scope	All FortiGate models and FortiOS versions.
Solution	SSL VPN clients receive the IP address from the IP space, which is neither a subnet address object nor a directly connected network. As a result, a BGP configuration is typically unable to see the SSL VPN pool. To resolve this, create a static route with the SSL VPN pool subnet as the destination and map the exit interface as 'ssl.root'. FGT-HO # get router info routing-table all | grep ssl.root S 15.0.0.0/24 [10/0] is directly connected, ssl.root, [1/0] Secondly, ensure that in BGP -> Networks configuration on the GUI, the SSL VPN pool subnet has been advertised, i.e., 15.0.0.0/24 in the example. After this configuration, the SSL VPN pool will be advertised over the BGP to the BGP peer. Before the creation of SSL VPN static route: get router info routing-table all | grep ssl.root get router info bgp neighbors 201.1.1.1 advertised-routes % No prefix for neighbor 201.1.1.1 get router info bgp neighbors 200.1.1.1 received-routes % No prefix for neighbor 200.1.1.1 After the creation of SSL VPN static route: get router info routing-table all | grep ssl.root S 15.0.0.0/24 [10/0] is directly connected, ssl.root, [1/0] get router info bgp neighbors 201.1.1.1 advertised-routes VRF 0 BGP table version is 8, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network          Next Hop            Metric     LocPrf Weight RouteTag Path *>i15.0.0.0/24      200.1.1.1                     100  32768        0 i <-/-> Total number of prefixes 1 get router info bgp neighbors 200.1.1.1 received-routes VRF 0 BGP table version is 4, local router ID is 3.3.3.3 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete    Network          Next Hop            Metric     LocPrf Weight RouteTag Path *>i15.0.0.0/24      200.1.1.1                     100      0        0 i <-/-> Total number of prefixes 1 Note:  If the named address is not available for the static route, it is possible to use a subnet instead. Address ranges will not work for this: it must be a subnet with 'static route configuration' enabled. This behavior is the same for remote access IPsec VPN, a static route is required to get the subnet advertised over BGP. Remember to replace the ssl.root interface on the Static Route configuration for the name of the tunnel interface of the subnet to be advertised.