| Description |
This article describes how to do not advertise all routes received from one BGP peer to other peers. |
| Scope |
FortiGate v6.0, v6.2, v6.4, v7.0. |
| Solution |
Topology:
By default, routes learned from eBGP are advertised to other eBGP peers. This can be confirmed by two useful commands that is run on both the advertising router and the receiving router:
get router info bgp neighbors x.x.x.x received-routes get router info bgp neighbors x.x.x.x advertised-routes
The idea is to use route-map to first tag all routes learned from one peer to a number and then deny advertising all routes match to such tag number. In this topology, 200 on routes received will be tagged from eBGP peer FGTA, 300 on routes received from eBGP peer FGTB, and will apply routes removal for routes that match such tag. In the end, routes learned from FGTA will not be advertised to FGTB, and routes learned from FGTB will not be advertised to FGTA.
config router route-map edit "tag200" config rule edit 1 set set-tag 200 next end next edit "remove-tag200" config rule edit 1 set action deny set match-tag 200 next edit 2 next end next edit "tag300" config rule edit 1 set set-tag 300 next end next edit "remove-tag300" config rule edit 1 set action deny set match-tag 300 next edit 2 next end next end
config router bgp set as 65001 set router-id 192.168.1.1 set graceful-restart enable config neighbor edit "192.168.1.150" <-----(FGT-B). set capability-graceful-restart enable set capability-default-originate enable set soft-reconfiguration enable set remote-as 65003 set route-map-in "tag300" next edit "192.168.1.58" <-----(FGT-A). set capability-graceful-restart enable set soft-reconfiguration enable set remote-as 65000 set route-map-in "tag200" set route-map-out "remove-tag300" next end end
Result of the analysis.
Below is the route learned from FGTA:
FGT1 (root) # get router info bgp neighbors 192.168.1.58 received-route Network Next Hop Metric LocPrf Weight RouteTag Path Before the config changes, this is the default behavior:
FGT1 (root) # get router info bgp neighbors 192.168.1.150 adv Network Next Hop Metric LocPrf Weight RouteTag Path
Total number of prefixes 6
After applying the changes, run the following command to clear the BGP neighbors:
execute router clear bgp all
Network Next Hop Metric LocPrf Weight RouteTag Path Total number of prefixes 5
In the case that FGTA and FGTB belong to the same AS #, the method mentioned above would still work, but may be unnecessary as the FGTA/B will see the routes come from its own AS # and drop such routes. This means routes will be received but will not get inserted into the RIB. |
