BGP neighbor group not working, but neighbor works

[actocoa]

I am setting up a Hub and Spoke ADVPN with BGP. The VPN tunnel itself work well. I can ping both way within the tunnel. However, a BGP routing cannot be not established unless I created a neighbor instead of a neighbor group in my Hub BGP settings. The Hub BGP settings even worked with a neighbor alone and without a neighbor group.

Hub: FortiGate 60F FW: 7.2.8
Spoke: FortiGate 40F FW: 7.2.8

Hub BGP (working):

config router bgp

    set as 65000

    set ibgp-multipath enable

    set additional-path enable

    config neighbor

        edit "10.0.61.4"

            set soft-reconfiguration enable

            set remote-as 65000

            set route-reflector-client enable

        next

    end

    config neighbor-group

        edit "Globe Hub"

            set soft-reconfiguration enable

            set remote-as 65000

            set route-reflector-client enable

        next

    end

    config neighbor-range

        edit 1

            set prefix 10.0.61.4 255.255.255.255

            set max-neighbor-num 100

            set neighbor-group "Globe Hub"

        next

    end

    config network

        edit 1

            set prefix 192.168.0.0 255.255.255.0

        next

    end 

    config network6

        edit 1

            set prefix6 ::/128

        next

    end 

    ......

end 

Hub BGP (not working):

config router bgp

    set as 65000

    set ibgp-multipath enable

    set additional-path enable

    config neighbor-group

        edit "Globe Hub"

            set soft-reconfiguration enable

            set remote-as 65000

            set route-reflector-client enable

        next

    end

    config neighbor-range

        edit 1

            set prefix 10.0.61.4 255.255.255.255

            set max-neighbor-num 100

            set neighbor-group "Globe Hub"

        next

    end

    config network

        edit 1

            set prefix 192.168.0.0 255.255.255.0

        next

    end

    config network6

        edit 1

            set prefix6 ::/128

        next

    end 

    config redistribute "connected"

    ......

end

Hub VPN Interface:

config system interface

    edit "Globe Hub"

        set vdom "root"

        set ip 10.0.0.1 255.255.255.255

        set allowaccess ping

        set type tunnel

        set remote-ip 10.0.0.254 255.255.0.0

        set snmp-index 24

        set interface "wan1"

    next

end

Spoke BGP:

config router bgp

    set as 65000

    set ibgp-multipath enable

    set additional-path enable

    config neighbor

        edit "10.0.0.1"

            set soft-reconfiguration enable

            set remote-as 65000

        next

    end

    config network

        edit 1

            set prefix 192.168.15.0 255.255.255.0

        next

    end

    config network6

        edit 1

            set prefix6 ::/128

        next

    end

    config redistribute "connected"

end   

Spoke VPN Interface:

config system interface

    edit "advpn-wan"

        set vdom "root"

        set ip 10.0.61.4 255.255.255.255

        set allowaccess ping

        set type tunnel

        set remote-ip 10.0.0.1 255.255.0.0

        set snmp-index 16

        set interface "wan"

    next

end

Hub Debug Info:

BGP: bgp_ih_on_close:8 delete ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ipc_server_accept:508 create ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ih_on_read:434 request type=5 len=24 vfid=0 start=0 count=5 flags=0x0

BGP: bgp_ih_on_read:485 response type=5 len=68 vfid=0 start=0 count=1 flags=0x0 total=1 ret=76

BGP: bgp_ih_on_close:8 delete ipc_handler=0x7f84a68480 for sock=27

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP RIB for VRF 0...

BGP: [NETWORK] Accept Thread: Incoming conn from host 10.0.61.4 (FD=27 VRF=0)

BGP: [NETWORK] Accept Thread: 10.0.61.4 - No such Peer configured

BGP: bgp_ipc_server_accept:508 create ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ih_on_read:434 request type=4 len=24 vfid=0 start=0 count=10 flags=0x1

BGP: bgp_ih_on_read:485 response type=4 len=116 vfid=0 start=0 count=1 flags=0x1 total=1 ret=124

BGP: bgp_ih_on_close:8 delete ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ipc_server_accept:508 create ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ih_on_read:434 request type=5 len=24 vfid=0 start=0 count=5 flags=0x0

Spoke Debug Info:

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP RIB for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: 10.0.0.1-Outgoing [FSM] State: Active Event: 9

BGP: 10.0.0.1-Outgoing [FSM] State: Connect Event: 9

BGP: 10.0.0.1-Outgoing [NETWORK] FD=26, Sock Status: 0-Success

BGP: 10.0.0.1-Outgoing [FSM] State: Connect Event: 17

BGP: 10.0.0.1-Outgoing [ENCODE] Msg-Hdr: Type 1

BGP: 10.0.0.1-Outgoing [ENCODE] Open: Ver 4 MyAS 65000 Holdtime 180

BGP: 10.0.0.1-Outgoing [ENCODE] Open: Msg-Size 69

BGP: 10.0.0.1-Outgoing [NETWORK] FD=26, Sock Status: 107-Transport endpoint is not connected

BGP: 10.0.0.1-Outgoing [FSM] State: OpenSent Event: 18

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP RIB for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

[Toshi_Esumi]

BGP neighbor-group can be used to share the same neighbor attributes among the group members so that you don't have to repeat the same config for multiple neighbors. That being said you still need to define each neighbor under "config neighbor" configuration.

See a KB below which is putting the "password" attribute under "neighbor-group" configuration, then the neighbor "172.16.201.1" is referring to it while the neighbor-range is "172.16.201.0/24".

https://community.fortinet.com/t5/FortiGate/Technical-Tip-The-BGP-Neighbor-group-password/ta-p/27659...

Toshi

[actocoa]

Hi Toshi, thanks for your swift reply.

I read the link you provided. The setting in that tech tip defines only neighbor-group in its hub (R3). A Neighbor is defined only in its spoke (R4).

In my original post, I did define a neighbor in my spoke. 

To set the ADVPN/BGP up, I followed the official library https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/820072

 It defines neighbor group only in its hub. I also watched a youtube demonstration https://www.youtube.com/watch?v=_aI-ETTI1rU , which shows the whole setup process. It also set neighbor group only in its hub (at 3:50), and its BGP works (at 14:30).

So far, I did not see any instruction saying a neighbor should be defined in a hub. Please let me know if I misunderstood anything. Thanks.

[Toshi_Esumi]

Neighbor-group config is valid only local side. The other side doesn't know if you used the group or not on your local side. And again, using a group is only to save the amount of config you have to type, like in case there are 10 neighbors using the same password, you need to type at only one location, instead of typing 10 times. Or, more importantly you need to change it only one location when you need to change it.

The iBGP won't come up simply because your Hub doesn't have the neighbor config.

In other words, if ADVPN works or not is not decided by if you use a group config or not. It should work even without a neighbor-group. Unfortunatly I never configured ADVPN so I can't tell exactly what you have to do to make ADVPN work. But if you corrected the hub neighbor and neighbor-group config, at least the BGP should come up.

That's all I can say.

Toshi

[Toshi_Esumi]

Or a neighbor-group is necessary to make spork-to-sporks work for ADVPN. Wait for somebody else who knows how ADVPN would work to chime in.

My comment is because you chose the title as "BGP neighbor group not working...".

Toshi

[actocoa]

Hi Toshi,

I think I understand your point: a neighbor-group in hub only works for neighbors in hub.

What I cannot understand is that in the Official Library and YouTube, they have their BGP working with only one neighbor-group setting in Hub and one neighbor setting in Spoke. If their method is valid, there's no need to modify Hub BGP settings whenever a spoke is added. It saves works.

[Toshi_Esumi]

Just ignore whatever I said above. I wish I could delete my comments but it does't let me. In ADVPN context, the neighbor-group seems to be used specifically. My comments seem to be off the mark completely.

Toshi

[actocoa · Accepted solution]

I submitted a technical support ticket to Fortinet and they found a similar case that resolved the issue by creating the group name without the space.

config neighbor-group
        edit "Globe Hub" <<< GlobeHub

It works like a charm. A neighbor is no longer required on my Hub when a neighbor-group is created.