Technical Tip: Use BGP backdoor to prefer IGP over EBGP

[ppatel]

Description

This article describes the use of BGP backdoor to prefer IGP over EBGP.

Scope

FortiGate.

Solution

Diagram:

• As illustrated, EBGP is running between 'FGT-A' and 'FGT-C' as well as 'FGT-B' and 'FGT-C'.
  
• As an example, consider an IGP protocol running between 'FGT-A' and 'FGT-B'. It can be OSPF, IS-IS or RIP protocol.
• EBGP has distance of 20, which is less than the IGP distances. The IGP protocol default distances are:

• 'FGT-A' will learn the 172.16.20.0/24 via 'FGT-C' EBGP (distance-20) and with IGP from FGT-B with a distance greater than 20. Hence, 'FGT-A' will install the route via 'FGT-C' EBGP as it has lower distance.
  
• However, the user wants the 'FGT-A' to prefer 172.16.20.0/24 route via IGP from 'FGT-B'.
• If the user wants 'FGT-A' to prefer 172.16.20.0/24 route via IGP RIP from 'FGT-B', use BGP backdoor.
• Assume IGP RIP protocol is running between 'FGT-A' and 'FGT-B'.
• Configure 'set backdoor enable' for network 172.16.20.0/24 under the 'FGT-A' BGP network configuration as the user wants to prefer this network via IGP.
• Due to BGP backdoor enabled, 'FGT-A' will learn the 172.16.20.0/24 route from 'FGT-B' via RIP with distance 120.

FGT-B Configuration:

config router rip

    config network
        edit 1
            set prefix 172.16.20.0 255.255.255.0
        next
    end

FGT-A Configuration:

config router rip

    config network
        edit 1
            set prefix 172.16.10.0 255.255.255.0
        next
    end

config router bgp
    set as 10

        config neighbor
            edit "10.10.10.30"
                set ebgp-enforce-multihop enable
                set remote-as 30
                set update-source "loopback"
            next
        end
        config network
            edit 1
                set prefix 172.16.20.0 255.255.255.0
                set backdoor enable
            next
        end

By enabling the FortiGate backdoor feature and setting the administrative distance (AD) of the backdoor route to 200, the RIP route—with an AD of 120—becomes preferred over the BGP route. As a result, the routing table will select the OSPF path to reach the destination network.

B 172.16.20.0/24 [200/0] via ...
O *> 172.16.20.0/24 [110/101] via ...

In this case, the RIP route is selected because its administrative distance (120) is lower than the backdoor BGP route (200).