Technical Tip: Configuring eBGP MultiHop

[oarslan]

Description	This article describes how to configure eBGP MultiHop.
Scope	FortiGate.
Solution	By default, TTL is set to 1 for a eBGP session, meaning neighbors must be directly connected. To overcome that limitation, ebgp multihop can be used so that neighbors do not need to be directly connected. A common use case is load balancing between 2 routers connected via 2 or more links. Because of recursive lookup, load sharing toward a BGP destination always occurs if there are several equal-cost IGP paths to the BGP next hop. In the following example, the eBGP session must be established via Loopback interfaces. From this perspective, the neighbors are not directly connected. There are two links to provide the communication between the Loopback addresses: 194.1.1.1 and 194.1.1.2. Two static routes are added. To establish the session, the 'ebgp-enforce-multihop' must be enabled. See the settings below: When the 'ebgp-enforce-multihop' command is enabled the TTL for this peer is set to 255. This can be manually adjusted to a desired value with the command 'ebgp-multihop-ttl'. Below is an example. In this case, the TTL for this EBGP peer will be 10. config neighbor edit "194.1.1.2" set ebgp-enforce-multihop enable set ebgp-multihop-ttl 10 set remote-as 20 set update-source "Loop-root" next end Note: Enabling eBGP MultiHop exposes sessions to potential security risks, use BGP authentication like MD5 hashing to secure the connection. Ref: Technical Tip: Configuring and Troubleshooting BGP MD5 Authentication  Integrate Bidirectional Forwarding Detection (BFD) with eBGP MultiHop sessions for faster failure detection and reduced downtime. Ref: Administration Guide for BFD with eBGP MultiHop