FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Anonymous
Not applicable
Article Id 199678
Description This article describes the next-hop behavior in BGP.
Scope FortiGate.
Solution

Refer to the topology below:

 

ranand_0-1637918827806.png

 

  1. eBGP Next-Hop Behavior:
    In eBGP, when a route is advertised between different ASes, the next-hop is automatically set to the IP address of the eBGP neighbor that sent the update.

  2. iBGP Next-Hop Behavior:
    When a route is advertised within the same AS (iBGP), the next-hop IP is not changed by default.
    That means Router B will advertise 172.16.0.0 to Router C, keeping the next-hop as 10.10.10.3 (which belongs to Router A).

  3. The Problem with the Default Behavior:
    Router C is in AS 65000 and does not have a route to reach 10.10.10.3, since 10.10.10.3 belongs to AS 64520 (outside its IGP domain). Therefore, Router C cannot reach the next hop, and the route becomes unusable until the IGP advertises that network.

  4. The Problem with the Default Behavior:
    Router C is in AS 65000 and does not have a route to reach 10.10.10.3, since 10.10.10.3 belongs to AS 64520 (outside its IGP domain).
    Therefore, Router C cannot reach the next hop, and the route becomes unusable until the IGP advertises that network.

  5. Solutions to the Next-Hop Reachability Issue:
    Option 1: Use an IGP (OSPF, EIGRP, etc.)
    Configure an IGP within AS 65000 to carry reachability information for 10.10.10.3.
    This allows Router C to resolve the next-hop address and successfully reach 172.16.0.0.

    Option 2: Configure the next-hop-self command on Router B.

    Option 3: Use a Route Reflector.
    In larger iBGP deployments, a Route Reflector (RR) can be used to reduce the requirement for a full iBGP mesh.
    The RR reflects routes between iBGP clients within the same AS.