Technical Tip: How to add a third BGP peer on FortiManager with SD-WAN provisioning templates

[mricardez]

Description	This article explains how to add another BGP peer out of the SD-WAN provisioning templates.
Scope	FortiManager v7.4 and 7.6.
Solution	FortiManager v7.4 and FortiManager 7.6 use the SD-WAN Overlay Template wizard to create all the SD-WAN provisioning Templates for deployments of FortiGate HUB & Spoke topology network. This article is focused on a network topology Single HUB, but can be used on the other topologies available. In some network deployments there is requirement to have external BGP peers which are out of the FortiGate SD-WAN domain. To implement it when an SD-WAN deployment via FortiManager already exists, use the SD-WAN Provisioning Templates as follows: After the SD-WAN Overlay Template wizard has been completed and is already installed, FortiManager will have two Template Groups: SDWAN_Fabric_HUB1 and SDWAN_Fabric_BRANCH. Each of them are associated the multiple Provisioning Templates (i.e. IPsec Tunnel Template, BGP Template, SD-WAN Template, Static Route Template, etc.) In FortiManager 7.4, go to Device Manager -> Provisioning Templates -> Template Group. In FortiManager 7.6, go to SD-WAN Manager -> Template Group. The Template Groups are associated with the FortiGate in accordance with their roles: HUB or BRANCH. Because the SDWAN_Fabric_BRANCH is associated with two spokes, any change to the template will affect the other spokes, so another Template Group is needed. It is therefore possible to clone the Template Group SDWAN_Fabric_BRANCH and associate the Clone_SDWAN_Fabric_BRANCH with the spoke with the additional BGP peer, and the rest of the remaining spokes with the Template Group SDWAN_Fabric_BRANCH. Clone the BGP Template SDWAN_Fabric_BRANCH_BGP in order to ensure that Clone_SDWAN_Fabric_BRANCH_BGP will have the additional BGP Peer. Associate the BGP Template Clone_SDWAN_Fabric_BRANCH_BGP with the Template Group Clone_SDWAN_Fabric_BRANCH_BGP and Install Device Settings to the FortiGate BRANCH. Instead of adding the BGP peer to the BGP Template, it is also possible to use a CLI Script. Repeat step 1. Create a CLI Template Script which the new BGP Peer, i.e. SDWAN_Fabric_BRANCH_CLI_AdditionalBGP. Clone the CLI Template Group SDWAN_Fabric_BRANCH_CLIGRP and add the CLI Template Script previously created in step 6. Associate the Clone of SDWAN_Fabric_BRANCH_CLIGRP with the Template Group Clone_SDWAN_Fabric_BRANCH and Install Device Settings to the FortiGate BRANCH.