FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Dongfang_Li_FTNT
Article Id 362539
Description

This article describes how FortiGate can choose the preferred neighbor when receives the same prefix from different BGP neighbors by using local preferences.     

Scope FortiOS all versions
Solution
  1. In this example, FortiGate has two BGP neighbors:

 

FortiGate-50E # get router info bgp summary

BGP router identifier 192.168.138.1, local AS number 65001

BGP table version is 5

1 BGP AS-PATH entries

0 BGP community entries

 

Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd

192.168.138.3   4      65001    1656    1662        4    0    0 00:50:52        1

192.168.138.5   4      65001      89      89        3    0    0 00:50:38        1

 

Total number of neighbors 2

 

  1. Receive the same route 192.168.1.0 from both neighbors:

     

    FortiGate-50E # get router info bgp neighbors 192.168.138.3 received-route

    BGP table version is 5, local router ID is 192.168.138.1

    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal

    Origin codes: i - IGP, e - EGP, ? - incomplete

     

       Network          Next Hop            Metric LocPrf Weight RouteTag Path

    *>i192.168.1.0      192.168.138.3                 100      0        0 i <-/->

     

    Total number of prefixes 1

     

    FortiGate-50E # get router info bgp neighbors 192.168.138.5 received-route

    BGP table version is 5, local router ID is 192.168.138.1

    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal

    Origin codes: i - IGP, e - EGP, ? - incomplete

     

       Network          Next Hop            Metric LocPrf Weight RouteTag Path

    *>i192.168.1.0      192.168.138.5                 100      0        0 i <-/->

     

    Total number of prefixes 1

     

     

  2. FortiGate prefers the lowest neighbor BGP router ID: When all attributes are equal, FortiGate selects the path from the neighbor with the lowest BGP router ID. The route from neighbor 192.168.138.3 will be chosen and added to the active routing table.

     

    FortiGate-50E # get router info routing-table all

     

    Routing table for VRF=0

    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

           O - OSPF, IA - OSPF inter area

           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

           E1 - OSPF external type 1, E2 - OSPF external type 2

           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

           * - candidate default

     

    S*      0.0.0.0/0 [10/0] via 10.9.15.254, wan1

    C       10.9.0.0/20 is directly connected, wan1

    C       169.254.1.0/24 is directly connected, fortilink

    C       172.16.1.0/24 is directly connected, lan

    B       192.168.1.0/24 [200/0] via 192.168.138.3, wan2, 00:00:29  

    C       192.168.138.0/24 is directly connected, wan2

     

     

  3. The user prefers the neighbor 192.168.138.5. The local preference in the route map can be used to set prefer neighbors. Set higher local preference in neighbor 192.168.138.5 than 192.168.138.3.

     

     

    1. Config prefix list:

      FortiGate-50E (prefix-list) # show

      config router prefix-list

          edit "prefix-test"

              config rule

                  edit 1

                      set prefix 192.168.1.0 255.255.255.0

                      unset ge

                      unset le

                  next

              end

          next

      end

       

       

    2. Config route map:

       

      FortiGate-50E (route-map) # show

      config router route-map

          edit "route-map-prefer-200"

              config rule

                  edit 1

                      set match-ip-address "prefix-test"

                      set set-local-preference 200  

                  next

              end

          next

          edit "route-map-prefer-100"

              config rule

                  edit 1

                      set match-ip-address "prefix-test"

                      set set-local-preference 100   

                  next

              end

          next

      end

       

       

    3. Config route map in BGP:

       

      FortiGate-50E (bgp) # sh

      config router bgp

          set as 65001

          set router-id 192.168.138.1

          set network-import-check disable

              config neighbor

                  edit "192.168.138.3"

                      set soft-reconfiguration enable

                      set remote-as 65001

                      set route-map-in "route-map-prefer-100"  

                      set update-source "wan2"

                  next

                  edit "192.168.138.5"

                      set soft-reconfiguration enable

                      set remote-as 65001

                      set route-map-in "route-map-prefer-200"   

                      set update-source "wan2"

                  next

              end

              config network

                  edit 1

                      set prefix 192.168.20.0 255.255.255.0

                  next

              end
      end

       

  4. Active routing table:


    FortiGate-50E # get router info routing-table all

     

    Routing table for VRF=0

    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

           O - OSPF, IA - OSPF inter area

           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

           E1 - OSPF external type 1, E2 - OSPF external type 2

           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

           * - candidate default

     

    S*      0.0.0.0/0 [10/0] via 10.9.15.254, wan1

    C       10.9.0.0/20 is directly connected, wan1

    C       169.254.1.0/24 is directly connected, fortilink

    C       172.16.1.0/24 is directly connected, lan

    B       192.168.1.0/24 [200/0] via 192.168.138.5, wan2, 00:00:09  

    C       192.168.138.0/24 is directly connected, wan2