BGP Route Priority

[Rat1001]

hi Gents,

just a quick question- can you configure a priority for routes learned from BGP like you do for static routes?

bgp config - i have changed the admin distance to match that on static routes

gbp route map - I have set the metric same as the one on static routes

what i want to achieve is have  a static default route and a default route learnt from BGP peers in the routing-table, I have seen the route in the database

[balding-eagle]

Apologies for reviving an old topic, but I could not find a more relevant one, since the issue I am facing could be potentially solved by having simultaneously in the routing table 0/0 routes that are of static and BGP origin.

We are running a small SD-WAN setup with basically default settings on the 7.2 code train, where the client insists on using central Internet breakout, to inspect traffic on their own HQ FWs.

I don't think I am the first one hitting this issue, but somehow I am unable to find a proper solution for the spoke sites (the hub is easy, as you have competing static routes and you can have ECMP there).

Each spoke has a static 0/0 towards wan1 and also learns 0/0 via iBGP from the hub. Changing AD or priority leads to one or the other 0/0 being installed in the routing table, but never simultaneously.

I don't really need ECMP for this case, just both 0/0 routes present in the routing table simultaneously, to apply SD-WAN rules and have them actually steer traffic.

This is how the routing table looks like:

Routing table for VRF=0
B *> 0.0.0.0/0 [200/0] via 10.50.63.253 (recursive is directly connected, HUB1-VPN1), 00:00:39, [1/0]
S 0.0.0.0/0 [200/0] via [GW-ip-redacted], wan1, [1/0]

If the static 0/0 wins - customer can't use the central breakout. SD-WAN rules require a valid route, so one option would be to disable this check as described here - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explaining-the-SD-WAN-rule-matching-proces...

I'd really like to avoid using this option, if I can help it.

If the BGP 0/0 wins - great for the customer, but the FGT connections to FMG/FAZ/Fortiguard and so on are out of luck, as I have to set /32 static routes for them on the individual FGTs, otherwise this traffic goes to the customer HQ FW.

Has anyone hit this issue and if so - what solution did you use, as I don't see any option beside disabling the SDWAN check for a valid route in the routing table or some wild PBR setup.

[balding-eagle]

Since Fortinet support was able to fix this issue for me, I want to help people hitting it by mentioning how it was done.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Controlling-internet-traffic-using-SD-WAN-...- this is the KB in question, basically you have to split 0/0 into 2 more specific routes and use SD-WAN rules or PBR, depending on your specific setup.

If this still doesn't help you with local out traffic, you have to do it manually for the traffic you care about, like Fortiguard, DNS, etc. as described here - https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/848980/local-out-traffic

[Toshi_Esumi]

First, why don't you start a new thread? Using an old thread always causes trouble for all parties for searching/status control/other management issues.

If all internet-bound traffic needs to go through the HUB locations/FW, spoke locations can't have 0/0 route toward wan/wan1 interface (underlay). The spokes needs to have a /32 route to wan/wan1 to get to the HUB to establish the VPN tunnel. Then either the HUB-advertised 0/0 route or local static 0/0 pointing to the tunnel takes all traffic to the HUB.

Toshi