Troubleshooting Tip: BGP debug log message 'denied due to filter'

[mpandya]

Description	This article explains how to troubleshoot the message 'denied due to filter' when it appears in BGP debug logs.
Scope	FortiGate.
Solution	Assume the following scenario: HUB ---------------SPOKE. On the HUB side, see for the specific network route advertised and the Spoke side also received the route but still not installed in the routing table. Starting from v7.2.0+, it is possible to collect BGP debugs for a specific neighbor by using the filter command 'diag ip router bgp set-filter neighbor <neighbor address>'. Follow this KB article for more details: Technical Tip: Capture BGP debugs for a specific neighbor. To verify the BGP debug command: diagnose ip router bgp all di diagnose ip router bgp updates en diagnose ip router bgp level info diagnose debug enable execute router clear bgp ip <neighbour ip> soft   Run for 3 minutes after disabling with the below command: dia deb reset The below logs on denied due to filter: 2024-12-06 13:26:34 BGP: 10.100.100.1-Outgoing [RIB] Update: Prefix 10.148.148.0/22 path_id 1 denied due to filter Configuration: config router prefix-list     edit "PL_Receive_Routes"         config rule             edit 1                 set action deny                 set prefix 10.148.148.0 255.255.252.0 <----- Due to denied.                 unset ge                 set le 32             next             edit 2                 set prefix any                 unset ge                 unset le             next         end     next end config router route-map     edit "RM_Receive_Routes"         config rule             edit 1                 set match-ip-address "PL_Receive_Routes"             next         end     next end Related article: Technical Tip: How to check BGP advertised and received routes on a FortiGate