FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ojacinto
Staff
Staff
Article Id 280033
Description This article describes how to apply the 'additional-path-select' and 'adv-additional-path' under BGP settings on the ADVPN scenario.
Scope ADVPN scenario on FortiGate v6.4.0, v7.0.0, v7.2.0 and later.
Solution

Consider the following scenario:


                                                      ------ ISP1 ----                  ------ ISP1 ----
 192.168.101.0/24    -- SPOKE1   ------ ISP2 ----     HUB      ------ ISP2 ----   SPOKE2 --- 192.168.102.0/24

                                                      ------ MPLS ----                ------ MPLS ----

Each spoke has 3 connections to the HUB. A VPN is established on every connection, so each Spoke will have three VPN tunnels to the HUB.

On the HUB side, there is the following BGP configuration:

 

B00_FG1-HUB # show router bgp
config router bgp
   set as 65001
   set router-id 192.168.10.254
   set ibgp-multipath enable 

         config neighbor-group
              edit "HUB_ISP1"
                set next-hop-self enable
                set remote-as 65001
                 set route-reflector-client enable
        next
              edit "HUB_ISP2"
                 set next-hop-self enable
                 set remote-as 65001
                set route-reflector-client enable
           next
              edit "HUB_MPLS"
                 set next-hop-self enable
                 set remote-as 65001
                 set route-reflector-client enable
             next
           end


config neighbor-range
    edit 1
        set prefix 172.16.30.0 255.255.255.0
        set neighbor-group "HUB_ISP1"
    next
        edit 2
            set prefix 172.16.31.0 255.255.255.0
            set neighbor-group "HUB_ISP2"
        next
            edit 3
                set prefix 172.16.32.0 255.255.255.0
                set neighbor-group "HUB_MPLS"
            next
        end


config network
    edit 1
        set prefix 10.212.134.0 255.255.255.0
    next
end


config network6
    edit 1
        set prefix6 ::/128
    next
end


config redistribute "connected"
end
config redistribute "rip"
end
config redistribute "ospf"
end
config redistribute "static"
end
config redistribute "isis"
end
config redistribute6 "connected"
end
config redistribute6 "rip"
end
config redistribute6 "ospf"
end
config redistribute6 "static"
end
config redistribute6 "isis"
end
end

B00_FG1-HUB #

 

After BGP is established over the VPNs, the HUB will only select one path for each prefix on spokes:


The HUB Routing table will show the 3 paths for every route:

 

ScreenHunter_77 Oct. 19 18.28.jpg

 

However, when the prefix is advertised to the other spoke, the HUB will select only the best path:

 

ScreenHunter_78 Oct. 19 18.31.jpg

 

For prefix 192.168.102.0/24 there are 3 paths displayed.

 

'*' means the path is installed into the local RIB.

'>' means the path is selected to advertise to peers.

 

ScreenHunter_79 Oct. 19 18.32.jpg

 

This will cause Spoke1 to see the same next-hop  through the 3 VPN tunnels for the BGP route:

 

B01_FG-SPOKE1 # get router info routing-table all

...

B 192.168.102.0/24 [200/0] via 172.16.30.3 [3] (recursive is directly connected, HUB_ISP1_0), 00:27:54, [1/0]

 

ScreenHunter_80 Oct. 19 19.10.jpg

 

To allow the HUB to advertise the 3 paths for the prefix to Spokes, it is necessary to enable the settings 'additional-path-select' and 'adv-additional-path' under BGP settings.

On  the HUB side:

 

B00_FG1-HUB: config router bgp
B00_FG1-HUB (bgp) # set additional-path enable
B00_FG1-HUB (bgp) # set additional-path-select 3

 

Under each neighbor:

 

B00_FG1-HUB (bgp) # config neighbor-group
B00_FG1-HUB (neighbor-group) # edit HUB_ISP1
B00_FG1-HUB (HUB_ISP1) # set additional-path both
B00_FG1-HUB (HUB_ISP1) # set adv-additional-path 3
B00_FG1-HUB (HUB_ISP1) # next

 

B00_FG1-HUB (neighbor-group) # edit HUB_ISP2
B00_FG1-HUB (HUB_ISP2) # set additional-path both
B00_FG1-HUB (HUB_ISP2) # set adv-additional-path 3
B00_FG1-HUB (HUB_ISP2) # next

 

B00_FG1-HUB (neighbor-group) # edit HUB_MPLS
B00_FG1-HUB (HUB_MPLS) # set additional-path both
B00_FG1-HUB (HUB_MPLS) # set adv-additional-path 3
B00_FG1-HUB (HUB_MPLS) # end
B00_FG1-HUB (bgp) # end

 

With the above configuration, the HUB selects now the 3 paths to be advertised:

 

ScreenHunter_81 Oct. 19 19.24.jpg

 

ScreenHunter_82 Oct. 19 19.26.jpg

 

On Spoke side, enable the same parameters:


B01_FG-SPOKE1 # config router bgp
B01_FG-SPOKE1 (bgp) # set additional-path enable
B01_FG-SPOKE1 (bgp) # set additional-path-select 9

 

B01_FG-SPOKE1 (bgp) # config neighbor

B01_FG-SPOKE1 (neighbor) # edit 172.16.30.1
B01_FG-SPOKE1 (172.16.30.1) # set additional-path both
B01_FG-SPOKE1 (172.16.30.1) # set adv-additional-path 3
B01_FG-SPOKE1 (172.16.30.1) # next

 

B01_FG-SPOKE1 (neighbor) # edit 172.16.31.1
B01_FG-SPOKE1 (172.16.31.1) # set additional-path both
B01_FG-SPOKE1 (172.16.31.1) # set adv-additional-path 3
B01_FG-SPOKE1 (172.16.31.1) # next

 

B01_FG-SPOKE1 (neighbor) # edit 172.16.32.1
B01_FG-SPOKE1 (172.16.32.1) # set additional-path both
B01_FG-SPOKE1 (172.16.32.1) # set adv-additional-path 3
B01_FG-SPOKE1 (172.16.32.1) # end

B01_FG-SPOKE1 (bgp) # end

 

Verification: 

Now, on the Spoke1 side, the routing-table the three paths for prefix 192.168.102.0/24:

ScreenHunter_83 Oct. 19 19.34.jpg

 

ScreenHunter_84 Oct. 19 19.37.jpg

 

 

 

Contributors