FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
akushwaha
Staff
Staff
Article Id 423892
Description This article describes a scenario in which a BGP route is received on Spoke-2 from Spoke-1 but is not installed in the BGP network table or routing table because the BGP router ID is duplicated between the spokes.
Scope FortiGate.
Solution

In the network topology shown below, two spokes are connected to a hub using iBGP:

 

AK-BGP.png

 

Spoke-1 is advertising 20.20.20.1/24 to the HUB:

SPK_1 # get router info bgp neighbors 10.10.1.1 advertised-routes
VRF 0 BGP table version is 6, local router ID is 192.168.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i20.20.20.0/24    10.10.1.3                     100  32768        0 i <-/->

Total number of prefixes 1

 

On the hub, the route is received from Spoke-1 and then advertised to Spoke-2:

 

HUB # get router info bgp neighbors 10.10.1.3 received-routes
VRF 0 BGP table version is 16, local router ID is 10.212.134.201
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i20.20.20.0/24    10.10.1.3                     100      0        0 i <-/->

Total number of prefixes 1


HUB # get router info bgp neighbors 10.10.1.2 advertised-routes 
VRF 0 BGP table version is 16, local router ID is 10.212.134.201
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i20.20.20.0/24    10.10.1.3                     100      0        0 i <-/->

Total number of prefixes 1

 

On Spoke-2, the route is received from the HUB but is not being installed in the BGP Table:

SPK_2 # get router info bgp neighbors 10.10.1.1 received-routes
VRF 0 BGP table version is 5, local router ID is 192.168.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i1.1.1.1/32       10.10.1.1                     100      0        0 i <0/0>
*>i10.100.0.0/18    10.10.1.1                     100      0        0 i <0/0>
*>i20.20.20.0/24    10.10.1.3                     100      0        0 i <0/0>

Total number of prefixes 3


Note: If soft reconfiguration is not enabled, received-routes will show no results. This is expected, see this article: Technical Tip : BGP Routing process when 'Soft Reconfiguration' is enabled.

SPK_2 # get router info bgp neighbors 10.10.1.1 received-routes 
% Inbound soft reconfiguration not enabled
% No prefix for neighbor 10.10.1.1

 

The 20.20.20.1/24 network is not present in the BGP table:

SPK_2 # get router info bgp network 
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

VRF 0 BGP table version is 5, local router ID is 192.168.1.1
   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*>i1.1.1.1/32       10.10.1.1       0             100      0        0 i <0/1>
*>i10.100.0.0/18    10.10.1.1       0             100      0        0 i <0/1>
*> 10.176.0.0/18    0.0.0.0                       100  32768        0 i <0/1>

Total number of prefixes 3

 

Diagnostics:

Enable BGP debug messages on Spoke-2: 

 

diagnose ip router bgp all enable

diagnose ip router bgp level info

diagnose debug enable

 

Trigger a route refresh of inbound routes on Spoke-2: 


execute router clear bgp ip 10.10.1.1 soft in

 

Debug output:

 

[root] BGP: [RIB] Scanning BGP Network Routes for VRF 0...
[root] BGP: 10.10.1.1-Outgoing [DECODE] Msg-Hdr: type 2, length 53
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (34), msg_size (34)
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: NLRI Len(9)
[root] BGP: 10.10.1.1-Outgoing [FSM] State: Established Event: 27
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: Received Prefix 1.1.1.1/32 path_id 0
[root] BGP: [DAMP] bgp_rfd_rt_update(): Route State: NONE, ret=0
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: ...duplicate route ignored
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: Received Prefix 10.100.0.0/18 path_id 0
[root] BGP: [DAMP] bgp_rfd_rt_update(): Route State: NONE, ret=0
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: ...duplicate route ignored
[root] BGP: 10.10.1.1-Outgoing [DECODE] Msg-Hdr: type 2, length 62
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (43), msg_size (43)
[root] BGP: 10.10.1.1-Outgoing [DECODE] Update: NLRI Len(4)
[root] BGP: 10.10.1.1-Outgoing [FSM] State: Established Event: 27
[root] BGP: 10.10.1.1-Outgoing [RIB] Update: Prefix 20.20.20.0/24 path_id 0 denied due to originator is us
[root] BGP: bgp_ipc_server_accept:670 create ipc_handler=0x7fb004efb0c0 for sock=29

 

To disable BGP debug messages:

 

diagnose ip router bgp all disable

diagnose ip router bgp level none

diagnose debug reset

 

The issue occurs because Spoke-1 and Spoke-2 are configured with the same router ID. To resolve the issue, change the router ID on either spoke to a unique value. Note that if no router-id is configured, FortiOS will use the assigned IP address of an existing interface. If spoke devices use the same IP addresses for local interfaces, this issue will be encountered with higher frequency.

 

Warning: Changing router-id restarts all BGP neighborships on the affected spoke and may cause network disruption for affected BGP networks while the peers re-establish.

 

config router bgp

    set router-id x.x.x.x   <----- Replace x.x.x.x with the IP address that will be used as the router ID.

end

 

Related articles:

Troubleshooting Tip: Troubleshooting BGP over IPsec

Technical Tip: FortiOS BGP Resource List