FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
subramanis
Staff
Staff
Article Id 190639

Description

 

This article describes that BGP Route reflectors have the special ability to advertise routes learned from an iBGP peer to other iBGP peers. The route reflector will reduce the number of iBGP peering’s but it does not change the next hop.

 

Scope

 

FortiGate.

Solution

 

In the following diagram, eBGP peering is configured over directly connected interfaces. The iBGP peerings are configured over Loopback addresses. An IGP is running to advertise Loopback addresses.

Each router advertises its Loopback address (/32) into BGP.

R4 is configured as a Route Reflector.

The BGP configurations are as follows:
R1:
 
config router bgp
    set as 65002
    set router-id 1.1.1.1
        config neighbor
            edit "10.1.0.2"
                set remote-as 65001
            next
        end
        config network
            edit 1
                set prefix 1.1.1.1 255.255.255.255
            next
        end
 
R3:
 
config router bgp
    set as 65001
    set router-id 3.3.3.3
        config neighbor
            edit "10.1.0.1"
                set remote-as 65002
            next
            edit "4.4.4.4"
                set remote-as 65001
                set update-source "Lo3"
            next
        end
        config network
            edit 1
                set prefix 3.3.3.3 255.255.255.255
            next
        end
 
R4:
 
config router bgp
    set as 65001
    set router-id 4.4.4.4
        config neighbor
            edit "3.3.3.3"
                set remote-as 65001
                set update-source "Lo4"
                set route-reflector-client enable
            next
            edit "2.2.2.2"
                set next-hop-self-rr enable
                set remote-as 65001
                set update-source "Lo4"
                set route-reflector-client enable
            next
        end
        config network
            edit 1
                set prefix 4.4.4.4 255.255.255.255
            next
        end

R2:
 
config router bgp
    set as 65001
    set router-id 2.2.2.2
        config neighbor
            edit "4.4.4.4"
                set remote-as 65001
                set update-source "Lo2"
            next
        end
        config network
            edit 1
                set prefix 2.2.2.2 255.255.255.255
            next
        end
 
The expectation is that:
  • R4 sees R3 (3.3.3.3) as the next hop for the eBGP route(1.1.1.1).
  • R2 sees R4 (4.4.4.4) as the next hop for iBGP and eBGP routes.
  • R3 sees R4 (4.4.4.4) as the next hop for iBGP routes and R1 (10.1.3.1) for eBGP route.

 

Updating next hop for non-reflected routes:

By design, when R3 advertises the eBGP route for 1.1.1.1/32 received from R1, it will not change the next hop. This can be overridden using 'set next-hop-self enable' on iBGP peering with R4.

R3:

 

config router bgp
    config neighbor

        edit "4.4.4.4"
            set next-hop-self enable
        next
    end
end

 

Verification on R4:

 

R4 # get router info bgp network
VRF 0 BGP table version is 2, local router ID is 4.4.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight RouteTag Path
*>i1.1.1.1/32       3.3.3.3                  0    100      0        0 65002 i <-/1> <----- Originated in external AS
*>i2.2.2.2/32       2.2.2.2                  0    100      0        0 i <-/1>
*>i3.3.3.3/32       3.3.3.3                  0    100      0        0 i <-/1>
*> 4.4.4.4/32       0.0.0.0                       100  32768        0 i <-/1>

Total number of prefixes 4

 

R4 installs external route (1.1.1.1/32) in RIB with R3 as the next hop.

 

Updating next hop for reflected routes:

In this environment, R4 acts as a route reflector. Enabling 'next-hop-self' in the BGP neighbor configuration will not affect reflected routes, it modifies the next hop for local and eBGP learned routes only. In v6.4.2 and later, 'next-hop-self-rr' can be used to update the next hop for reflected routes.


Before the change, 
R4 is not changing the next-hop to 4.4.4.4 for the networks 1.1.1.1/32 and 3.3.3.3/32 when advertising to R2.
 
R2# get router info bgp  network
VRF 0 BGP table version is 4, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight RouteTag Path
*>i1.1.1.1/32       3.3.3.3                  0    100      0        0 65002 i <-/1> <-----
*> 2.2.2.2/32       0.0.0.0                       100  32768        0 i <-/1>
*>i3.3.3.3/32       3.3.3.3                  0    100      0        0 i <-/1>       <-----
*>i4.4.4.4/32       4.4.4.4                  0    100      0        0 i <-/1>
Total number of prefixes 

R4 is also not changing the next-hop to 4.4.4.4 for the network 2.2.2.2/32 when advertising to R3.
 
R3 # get router info bgp  network
BGP table version is 11, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight RouteTag Path
*> 1.1.1.1/32       10.1.0.1                 0             0        0 65002 i
*>i2.2.2.2/32       2.2.2.2                  0    100      0        0 i
*> 3.3.3.3/32       0.0.0.0                       100  32768        0 i
*>i4.4.4.4/32       4.4.4.4                  0    100      0        0 i
Total number of prefixes 4
 
To apply the change, 'next-hop-self-rr' is enabled for each of R4's route reflector clients.
 
R4:
 
config router bgp
    set as 65001
    set router-id 4.4.4.4
        config neighbor
            edit "3.3.3.3"
                set next-hop-self-rr enable          <--
                set remote-as 65001
                set update-source "Lo4"
                set route-reflector-client enable
            next
            edit "2.2.2.2"
                set next-hop-self-rr enable          <--
                set remote-as 65001
                set update-source "Lo4"
                set route-reflector-client enable
            next
        end
        config network
            edit 1
                set prefix 4.4.4.4 255.255.255.255
            next
        end
end
 
Then 'execute router clear bgp all soft' is applied on R4 to force a new route advertisement.
 
R2 # get router info bgp network
VRF 0 BGP table version is 5, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network          Next Hop            Metric LocPrf Weight RouteTag Path
*>i1.1.1.1/32       4.4.4.4                  0    100      0        0 65002 i <-/1>  <-----
*> 2.2.2.2/32       0.0.0.0                       100  32768        0 i <-/1>
*>i3.3.3.3/32       4.4.4.4                  0    100      0        0 i <-/1>        <-----
*>i4.4.4.4/32       4.4.4.4                  0    100      0        0 i <-/1>
 
Total number of prefixes 4
 
R3# get router info bgp network
BGP table version is 12, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight RouteTag Path
*> 1.1.1.1/32       10.1.0.1                 0             0        0 65002 i
*>i2.2.2.2/32       4.4.4.4                  0    100      0        0 i             <--
*> 3.3.3.3/32       0.0.0.0                       100  32768        0 i
*>i4.4.4.4/32       4.4.4.4                  0    100      0        0 i
 
Total number of prefixes 4
 
The next hop is now 4.4.4.4 for all iBGP routes reflected by R4.
 
If 'next-hop-self-rr' is not available, a similar effect can be achieved using route-map-in on R2 and R3.

 

Related article:

Technical Tip: Configuring BGP route reflector