FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes the solution for BGP dropped on the AWS transit gateway.
Scope
FortiGate and AWS transit gateway.
Solution
When configuring BGP with AWS transit gateway, it is required that the routes originate from an eBGP peer and should have next-hop-self configured. Otherwise, the routes will be dropped on AWS.
To achieve this, enable 'next-hop-self' on the FortiGate.
Run the following commands on FortiGate:
config router bgp
config neighbor
edit <neighbor>
set next-hop-self enable
next
end
If redistributing routes via route-reflector, the following change should be made:
config router bgp
config neighbor
edit <neighbor>
set route-reflector-client enable
set next-hop-self-rr enable
next
end
After that, the route is advertising correctly on the AWS side.
