FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
akushwaha
Staff
Staff
Article Id 423892
Description This article describes a scenario in which a BGP route is received on Spoke-2 from Spoke-1 but is not installed in the BGP network table and routing table of the device.
Scope FortiGate.
Solution

In the network topology shown below, two spokes are connected to a hub using iBGP:

 

AK-BGP.png

 

Spoke-1 is advertising 20.20.20.1/24 to the HUB:

# get router info bgp neighbors 10.10.1.1 advertised-routes
VRF 0 BGP table version is 6, local router ID is 192.168.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i20.20.20.0/24    10.10.1.3                     100  32768        0 i <-/->

Total number of prefixes 1

 

On the hub, the route is received from Spoke-1 and then advertised to Spoke-2:

 

HUB # get router info bgp neighbors 10.10.1.3 received-routes
VRF 0 BGP table version is 16, local router ID is 10.212.134.201
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i20.20.20.0/24    10.10.1.3                     100      0        0 i <-/->

Total number of prefixes 1


HUB # get router info bgp neighbors 10.10.1.2 advertised-routes 
VRF 0 BGP table version is 16, local router ID is 10.212.134.201
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i20.20.20.0/24    10.10.1.3                     100      0        0 i <-/->

Total number of prefixes 1

 

On Spoke-2, the route is received from the HUB but is not being installed in the BGP Table:

SPK_2# get router info bgp neighbors 10.10.1.1 received-routes
VRF 0 BGP table version is 5, local router ID is 192.168.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i1.1.1.1/32       10.10.1.1                     100      0        0 i <0/0>
*>i10.100.0.0/18    10.10.1.1                     100      0        0 i <0/0>
*>i20.20.20.0/24    10.10.1.3                     100      0        0 i <0/0>

Total number of prefixes 3

 

The 20.20.20.1/24 network is not present in the BGP table:

# get router info bgp network 
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

VRF 0 BGP table version is 5, local router ID is 192.168.1.1
   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i1.1.1.1/32       10.10.1.1       0             100      0        0 i <0/1>
*>i10.100.0.0/18    10.10.1.1       0             100      0        0 i <0/1>
*> 10.176.0.0/18    0.0.0.0                       100  32768        0 i <0/1>

Total number of prefixes 3

 

Solution:

 

Enable BGP debug processes on Spoke-2: 

 

diagnose ip router bgp all enable

diagnose ip router bgp level info

diagnose debug enable

 

To disable BGP debug processes:

 

diagnose ip router bgp all disable

diagnose ip router bgp level none

diagnose debug reset

 

Debug output:

[root] BGP: [RIB] Scanning BGP Network Routes for VRF 0...
[root] BGP: 10.10.1.1-Outgoing [DECODE] Msg-Hdr: type 2, length 53
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (34), msg_size (34)
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: NLRI Len(9)
[root] BGP: 10.10.1.1-Outgoing [FSM] State: Established Event: 27
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: Received Prefix 1.1.1.1/32 path_id 0
[root] BGP: [DAMP] bgp_rfd_rt_update(): Route State: NONE, ret=0
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: ...duplicate route ignored
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: Received Prefix 10.100.0.0/18 path_id 0
[root] BGP: [DAMP] bgp_rfd_rt_update(): Route State: NONE, ret=0
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: ...duplicate route ignored
[root] BGP: 10.10.1.1-Outgoing [DECODE] Msg-Hdr: type 2, length 62
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (43), msg_size (43)
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: NLRI Len(4)
[root] BGP: 10.10.1.1-Outgoing [FSM] State: Established Event: 27
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: Prefix 20.20.20.0/24 path_id 0 denied due to originator is us
[root] BGP: bgp_ipc_server_accept:670 create ipc_handler=0x7fb004efb0c0 for sock=29

This issue occurs due to Spoke-1 and Spoke-2 being configured with the same router ID. Manually changing the router ID on either spoke resolves the issue, allowing the route to be installed successfully.

 

To change Router-ID:

 

config router bgp

    set router-id x.x.x.x   <----- Replace x.x.x.x with the IP address that will be used as the router ID.

end

Contributors