FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
dbabic
Staff
Staff
Article Id 193043

Description

 

This article describes how to change BGP parameters when advertising default-route (0.0.0.0/0) with the command 'set capability-default-originate enable'. 

For a default route advertised using set capability-default-originate enable, the standard route-map used for all advertised prefixes will not work.

Solution

FGT1 < eBGP > FGT2.

From FGT2 prefixes are advertised to FGT1 including a default-route. As-path prepend is required for all routes advertised by FGT2.

 

FGT2 (root) # show router bgp

config router bgp
    set as 65000
    set router-id 2.2.2.2
        config neighbor
            edit "10.109.16.85"
                set capability-default-originate enable
                set soft-reconfiguration enable
                set remote-as 65001
                set route-map-out "prepend_all"
            next
        end
        config network
            edit 1
                set prefix 2.2.2.2 255.255.255.255
            next
        end
end


FGT2 (root) # show router route-map

config router route-map
    edit "prepend_default_route"
        config rule
            edit 1
                set match-ip-address "default_route_only"
                set set-aspath "65000 65000"
            next
        end
    next
    edit "prepend_all"
        config rule
            edit 1
                set match-ip-address "any_prefix"
                set set-aspath "65000 65000 65000 65000"
            next
        end
    next
end


FGT2 (root) # show router prefix-list

config router prefix-list
    edit "any_prefix"
        config rule
            edit 1
                set prefix any
                unset ge
                unset le
            next
        end
    next


Status on FGT1:

 

FGT1 # get router info bgp neighbors 10.109.16.62 received-routes
BGP table version is 9, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight RouteTag Path
*> 0.0.0.0/0        10.109.16.62                           0        0 65000 i <-/->
*> 2.2.2.2/32       10.109.16.62                           0        0 65000 65000 65000 65000 65000 i <-/->

Total number of prefixes 2

 

Subnet 2.2.2.2 is received with the correct as-path, but for the default-route no AS-path prepend was added.

The solution is to use the option 'default-originate-routemap' that will appear in CLI once capability-default-originate is enabled.

 

FGT2 (root) # show router prefix-list

config router prefix-list
    edit "default_route_only"
        config rule
            edit 1
                set prefix 0.0.0.0 0.0.0.0
                unset ge
                unset le
            next
        end
    next
end

 

FGT2 (root) # show router route-map

config router route-map
    edit "prepend_default_route"
        config rule
            edit 1
                set match-ip-address "default_route_only"
                set set-aspath "65000 65000"
            next
        end
    next

 

FGT3 (root) # show router bgp

config router bgp
    set as 65000
    set router-id 2.2.2.2
        config neighbor
            edit "10.109.16.85"
                set capability-default-originate enable
                set soft-reconfiguration enable
                set default-originate-routemap "prepend_default_route"        ---> Adding the prepend here.
                set remote-as 65001
                set route-map-out "prepend_all"
            next
end

 

Status on FGT1 after adding the route-map using default-originate-routemap:

 

FGT1 # get router info bgp neighbors 10.109.16.62 received-routes
BGP table version is 9, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight RouteTag Path
*> 0.0.0.0/0        10.109.16.62                           0        0 65000 65000 65000 i <-/->
*> 2.2.2.2/32       10.109.16.62                           0        0 65000 65000 65000 65000 65000 i <-/->
Total number of prefixes 2

 

As shown in the above output, for default route as-path has been added as configured in the route-map.