90D BGP Setup

[90dcanuck]

Currently we have a setup which is as follows..

ISP Modem -> Router (BGP; running in bridged mode) -> Fortigate 90D

I would like to remove the router as it is redundant, all it does it bridge the traffic and there is no QOS or anything, from what I can tell the 90D can do more and supports BGP anyway. I didn't setup the router (and nor did the ISP) but we are getting a lot of packet loss when using VOIP and ideally I want to remove the router from the setup as essentially it is just acting like a switch in the middle.

In terms of setting up the Foritgate to use BGP, are there any step\guides available. Most of the examples I have seen are for a dual ISP setup. We have one ISP which uses BGP and we have a number of public IPs that are used for different services.

The details given to me by our ISP are...I have changed the values

LAN IP subnet. 60.100.190.200/28

Usable IPs. 60.100.190.200-210/28

WAN IP. 60.100.2.81/30 (Router ID)

WAN VLAN. 1500

BGP Local AS: 12345

BGP Neighbor IP. 60.100.2.82 (Peer)

BGP remote AS: 123

BGP Password: 12345

From what I can tell I will need to do most of the setup in the CLI as a password needs to be specified along with the VLAN.

Any help is much appreciated.

[btp]

The BGP setup on FortiGate is really easy. We use this all the time.

The VLAN is part of the interface setup - BGP doesn't care.

config router bgp     set as 12345     set router-id 60.100.2.81         config neighbor             edit "60.100.2.82"             set description "My BGP peering"             set remote-as 123             set password 12345

            set activate6 disable        // in case this is an

            set send-community6 disable  // IPv4 only setup

        next     end         config network             edit 1                 set prefix 60.100.190.200/28             next         end     end end

[90dcanuck]

Thank you for the reply, much appreciated. Didn't realize the VLAN was ignored by BGP.

[btp]

It only considers next-hop and reachability - thus, you must have reachability to (be able to ping) your PE router. And that requires correct vlan-id and IP config.

[90dcanuck]

Just to clarify, I am trying to replace the router and go directly into the Cable Modem so there would be a direct connection from the Cable Modem into the Firewall which will be set to use BGP. The ISP mentions the VLAN, so I assume it is required, my assumption was that the Fortigate would need to be set to be on the same VLAN for WAN traffic, by using a sub-interface which would allow me to specify a VLAN id.

[btp]

You are quite right. The *interface* must of course be configured correctly for this to work. The *BGP* config only looks at the IP - not the Ethernet.