FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Nivedha
Staff
Staff
Article Id 409326
Description This article describes how to configure Dynamic BGP for ADVPN 2.0.
Scope FortiGate v7.4.2+.
Solution

To implement Dynamic BGP peering, please ensure these points are addressed

  • All Spokes should have LAN subnets placed serially. If not Hub has to advertise all private IP subnets on BGP.
  • No route reflection is enabled on the hub
  • BGP peering between spokes is on-demand and shortcut-triggered
  • Spokes learn only relevant routes from direct BGP peers

Active dynamic BGP neighbor triggered by ADVPN shortcut 7.4.1 can be configured on BGP overlay or BGP loopback. 
To configure BGP on overlay, refer to Technical Tip: Configuring BGP overlay for ADVPN 2.0


Hub configuration:
The route reflection is not enabled on the Hub, and the Hub is advertising 192.168.0.0/16, which is the LAN summary of all spokes.


BGP settings:

 

Hub1 # sh router bgp
config router bgp
set as 65400
set ibgp-multipath enable
set additional-path enable
set additional-path-select 3
config neighbor-group
edit "PrimarySpoke"
set soft-reconfiguration enable
set remote-as 65400
set route-map-in "test"
set additional-path both
next
edit "SecondarySpoke"
set soft-reconfiguration enable
set remote-as 65400
set additional-path both
next
end
config neighbor-range
edit 1
set prefix 10.250.255.0 255.255.255.0
set neighbor-group "PrimarySpoke"
next
edit 2
set prefix 10.254.255.0 255.255.255.0
set neighbor-group "SecondarySpoke"
next
end
config network
edit 1
set prefix 192.168.1.0 255.255.255.0
next
edit 2
set prefix 192.167.1.1 255.255.255.255
next
edit 3
set prefix 192.168.0.0 255.255.0.0
set network-import-check disable
next
end
end

Spoke configuration:
Spoke will have a passive disable added to the config, as Spoke needs to initiate neighbourship with another Spoke after the shortcut is created

BGP configuration:

 

Spoke.png

 

Routing table.
Hub:


Hub routing.png

 

Spoke (before shortcuts):


Spoke routing.png

 

Spoke routing table (after shortcuts):

 

Spoke routing after shortcuts.png

Contributors