FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
lgupta
Staff
Staff
Article Id 230377
Description

 

This article explains how to verify the routes/prefix received from the BGP Peer using Debugs.

 

Scope

 

FortiGate.

 

Solution

 

Topology:

 

lgupta_0-1668966599313.png

 

Hub: Router ID- 192.168.2.110.

Spoke_1: Router ID – 192.168.2.121.

Prefix Advertised: – 121.121.10.0/24, 121.121.20.0/24, 121.121.30.0/24.

 

Steps to follow:

Debugs will be run on the HUB FortiGate to confirm the prefix received from Spoke_1 Peer:

 

# diagnose ip router bgp all enable

# diagnose ip router bgp level info

# diagnose debug console timestamp enable

# diagnose debug enable

 

It is possible to use the command to do a soft reset of the Incoming routes:

 

# execute router clear bgp all soft in

 

Output:

 

2022-11-15 18:50:42 BGP: 192.168.2.121-Outgoing [FSM] State: OpenConfirm Event: 26

2022-11-15 18:50:42 id=20300 msg="BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 192.168.2.121 Up <----- Peers are UP confirmation.

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [FSM] State: Established Event: 34

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [ENCODE] Msg-Hdr: Type 2

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [ENCODE] Update: Msg #1 Size 23

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [DECODE] Msg-Hdr: type 2, length 56

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (60), msg_size (37)

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [DECODE] Update: NLRI Len(12)

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [DECODE] Msg-Hdr: type 2, length 23

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (4), msg_size (4)

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [FSM] State: Established Event: 27

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [RIB] Update: Received Prefix 121.121.10.0/24 path_id 0 <----- Prefix received.

2022-11-15 18:50:43 BGP: [NSM] Verified NH 192.168.2.121 with NSM

2022-11-15 18:50:43 BGP: VRF 0 NSM announce: 121.121.10.0/24

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [RIB] Update: Received Prefix 121.121.30.0/24 path_id 0 <----- Prefix received.

2022-11-15 18:50:43 BGP: VRF 0 NSM announce: 121.121.30.0/24

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [RIB] Update: Received Prefix 121.121.20.0/24 path_id 0 <----- Prefix received.

2022-11-15 18:50:43 BGP: VRF 0 NSM announce: 121.121.20.0/24

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [FSM] Update: IPv4 Unicast End-Of-Rib Marker Received <----- End-of-RIB Marker MUST be sent by a BGP speaker to its peer once it completes the initial routing update.

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [FSM] Process End-of-RIB: Received for afi/safi: 1/1

2022-11-15 18:50:43 BGP: 192.168.2.121-Outgoing [FSM] State: Established Event: 27

 

Check the BGP routing table on HUB: 

 

HUB # get router info routing-table bgp

Routing table for VRF=0

B       121.121.10.0/24 [200/0] via 192.168.2.121 (recursive is directly connected, port1), 00:08:02, [1/0]

B       121.121.20.0/24 [200/0] via 192.168.2.121 (recursive is directly connected, port1), 00:08:02, [1/0]

B       121.121.30.0/24 [200/0] via 192.168.2.121 (recursive is directly connected, port1), 00:08:02, [1/0]

 

CLI command to view received routes from a specific neighbor:

 

# get router info bgp neighbors <neighbor IP> received-routes

 

Note.

If an error shows up after running '# get router info bgp neighbors <neighbor IP> received-route', then enable 'set soft-reconfiguration enable' command under the BGP neighbor.

 

# get router info bgp neighbors <neighbor IP> routes

 

Command '# get router info bgp neighbors <neighbor IP> routes' shows only filtered(in) received routes.

 

Other useful links for Reference:

 

1) BGP Neighbor Adjacency States:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-BGP-Neighbor-Adjacency-States/ta-p/208989

 

2) How to check BGP advertised and received routes on a FortiGate:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-check-BGP-advertised-and-received-r...