FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ahabibov
Staff
Staff
Article Id 334374
Description

The article describes the advertisement of BGP routes with the 'network' command and the importance of making the route prefix the same as in the routing table.

Scope All FortiGate or VDOM running in NAT mode.
Solution

The following is a simple BGP configuration with no additional settings and neighbor information:

 

config router bgp

    config neighbor
        edit "10.109.49.20"
            set remote-as 65001
        next
    end

end

 

For example, the following directly connected networks are in the routing table:

 

get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 10.109.63.254, mgmt, [1/0]
C 10.109.16.0/20 is directly connected, port1
C 10.109.48.0/20 is directly connected, mgmt

 

When advertising the 10.109.16.0/20 network using a different subnet (/16 in this example), the following will be seen:

 

config router bgp

    config network
        edit 1
            set prefix 10.109.0.0 255.255.0.0
        next
    end

end

 

get router info bgp neighbors 10.109.49.20 advertised-routes
% No prefix for neighbor 10.109.49.20

 

get router info bgp network

 

 

In this case, there are two options:

  • While using the 'network' command, the prefix should be exactly the same as the one in the routing table. It will be necessary to make the following changes for the network to be advertised:

         config router bgp

config network

edit 1

set prefix 10.109.16.0 255.255.240.0

next

end

end

 

    

get router info bgp neighbors 10.109.49.20 advertised-routes
VRF 0 BGP table version is 1, local router ID is 10.109.49.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*>i10.109.16.0/20 10.109.49.1 100 32768 0 i <-/->

Total number of prefixes 1

 

get router info bgp network
VRF 0 BGP table version is 1, local router ID is 10.109.49.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.109.16.0/20 0.0.0.0 100 32768 0 i <-/1>

Total number of prefixes 1

    

  • If the plan is for the subnet to be advertised with /16 prefix, it will be necessary to use the 'aggregate-address' option:

config router bgp

config aggregate-address

edit 1

set prefix 10.109.0.0 255.255.0.0

set summary-only enable

next

end

end

   

get router info bgp neighbors 10.109.49.20 advertised-routes
VRF 0 BGP table version is 2, local router ID is 10.109.49.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*>i10.109.0.0/16 10.109.49.1 100 32768 0 i <-/->

Total number of prefixes 1

 

get router info bgp network

VRF 0 BGP table version is 2, local router ID is 10.109.49.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path

*> 10.109.0.0/16 0.0.0.0 32768 0 i <-/1>

s> 10.109.16.0/20 0.0.0.0 100 32768 0 i <-/1>

 

Here, the ā€˜sā€™ in front of the /20 network indicates this route is suppressed by BGP.

 

Related article:

Technical Tip: How to implement BGP route summary (aggregation) on a FortiGate                        

 

Contributors