FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
mkatary
Staff
Staff
Article Id 203124

 

Description

This article describes the BGP behavior in case the BGP prefix being compared to a locally originated static route.

Scope

In case prefix via BGP is learnt and there is a static route with higher AD to act as backup in case of BGP is down.

 

BGP route will not be installed in routing table if this static route is redistributed into BGP as locally originated weight is 32768 and learnt prefix default weight is 0 (none).

Solution

Set higher weight for incomplete BGP prefix.

 

FGT50E-2 # show router static

# config router stati

    edit 4

        set dst 10.116.0.1 255.255.255.255

        set distance 50

        set device "50E_200E"

    next

end

 

FGT50E-2 # get router info bgp network 10.116.0.1

BGP routing table entry for 10.116.0.1/32

Paths: (2 available, best #2, table Default-IP-Routing-Table)

  Advertised to non peer-group peers:

   10.109.17.3

  65200

    10.109.17.3 from 10.109.17.3 (10.109.17.3)

      Origin incomplete metric 0, localpref 100, valid, external

      Last update: Thu Jan 13 11:39:07 2022

 

  Local

    0.0.0.0 from 0.0.0.0 (10.109.16.105)

      Origin incomplete, localpref 100, weight 32768, valid, sourced, best

      Last update: Thu Jan 13 11:38:44 2022

 

FGT50E-2 # get router info routing-table all

 

Routing table for VRF=0

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

       O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default

 

S*      0.0.0.0/0 [10/0] via 10.109.31.254, wan1

C       10.109.16.0/20 is directly connected, wan1

S       10.116.0.0/20 [10/0] is directly connected, 50E_200E

S       10.116.0.1/32 [50/0] is directly connected, 50E_200E

C       10.132.0.0/20 is directly connected, lan

C       169.254.1.0/24 is directly connected, fortilink

 

In this case it is necessary to set a higher weight for the BGP prefix as to be preferred over the static when BGP is restored.

 

# config router prefix-lis

    edit "acl-weight"

            config rule

                edit 1

                    set prefix 10.116.0.1/32

                    unset ge

                    unset le

                next

            end

    next

end

 

# config router route-ma

    edit "weight-in"

            config rule

                edit 1

                    set match-ip-address "acl-weight"

                    set set-weight 40000

                next

            end

    next

end

 

# config router bg

    # config neighbo

        edit "10.109.17.3"

            set route-map-in "weight-in"

            next

        end

end

 

Check now, it is now possible to see the new route preferred due to higher weight.

 

FGT50E-2 # get router info bgp network 10.116.0.1

BGP routing table entry for 10.116.0.1/32

Paths: (1 available, best #1, table Default-IP-Routing-Table)

  Not advertised to any peer

  65200

    10.109.17.3 from 10.109.17.3 (10.109.17.3)

      Origin incomplete metric 0, localpref 100, weight 40000, valid, external, best

      Last update: Thu Jan 13 11:46:55 2022

 

FGT50E-2 # get router info routing-table all

 

Routing table for VRF=0

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

       O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default

 

S*      0.0.0.0/0 [10/0] via 10.109.31.254, wan1

C       10.109.16.0/20 is directly connected, wan1

S       10.116.0.0/20 [10/0] is directly connected, 50E_200E

B       10.116.0.1/32 [20/0] via 10.109.17.3, wan1, 00:00:26

C       10.132.0.0/20 is directly connected, lan

C       169.254.1.0/24 is directly connected, fortilink

 

 

Related articles

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Use-BGP-Weight-attribute-to-prefer-default...

Contributors