BGP - should network be advertised if interface is down?

[Ashley_Gibbon]

If i add a network in BGP page for dynamic routing, on say the DMZ interface and that interface goes down, shouldnt that route be removed for the routes that the fortigate is advertising. i am finding that if I use networks, or if i add the commnd line redistirbute connected the router will be distributed even if the interface is down. Device is a Fortigate 60 MR7 patch 2 Thanks

[emnoc]

If the route is not in your table ( no floating static route present), than BGP should send a update to remove that route from all peers. when you shut that interface down, what does your get router info routing-table all inform shows ? or what does your WEBGui router>monitor show?

[Ashley_Gibbon]

get router info routing-table ALL shows several hundred BGP routes, but that same command with connected shows the local networks as connected, even though the interface is down. See below, 10.17.21.0 is on the fortigate in question. and it shows as directly connected, despite the fact that the interface is down. see bottom. That show the interfaces as up despite the fact that they are down. internal is showing as up despite the fact it is not. Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default S* 0.0.0.0/0 [10/0] via 10.19.21.1, 101_Backup B 1.2.3.4/32 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.0.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.1.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.2.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.3.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.5.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.6.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.7.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.8.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 B 10.17.20.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 C 10.17.21.0/24 is directly connected, DATA B 10.17.22.0/24 [20/0] via 10.19.21.1, 101_Backup, 00:09:03 == [ internal ] name: internal mode: static ip: 10.18.21.129 255.255.255.240 status: up netbios-forward: disable type: physical mtu-override: disable == [ dmz ] name: dmz mode: static ip: 192.168.0.1 255.255.255.0 status: up netbios-forward: disable type: physical mtu-override: disable == [ wan1 ] name: wan1 mode: static ip: 69.2.166.102 255.255.255.0 status: up netbios-forward: disable type: physical mtu-override: disable == [ wan2 ] name: wan2 mode: static ip: 0.0.0.0 0.0.0.0 status: down netbios-forward: disable type: physical mtu-override: disable == [ modem ] name: modem == [ ssl.root ] name: ssl.root ip: 0.0.0.0 0.0.0.0 status: up netbios-forward: disable type: tunnel == [ 101_Backup ] name: 101_Backup ip: 10.19.21.2 255.255.255.255 status: up netbios-forward: disable type: tunnel == [ DATA ] name: DATA mode: static ip: 10.17.21.1 255.255.255.0 status: up netbios-forward: disable type: vlan mtu-override: disable == [ VOIP ] name: VOIP mode: static ip: 172.16.21.1 255.255.255.0 status: up netbios-forward: disable type: vlan mtu-override: disable == [ Vendor ] name: Vendor mode: static ip: 10.18.21.1 255.255.255.128 status: up netbios-forward: disable type: vlan mtu-override: disable

[journeyman]

It seems that you think the internal interface is down but the FGT thinks it is up? Since the unit is in switch mode, are all ports on the internal interface down (sorry it' s a very obvious question). Not saying you don' t have a problem, but I think the routing side is doing the right thing.

[Ashley_Gibbon]

Yes, I think the FG is reporting the interface status incorrectly. I dont have maintainence on it so i cant try any other firmware. Thanks for your help.

[journeyman]

I implied above using interface mode to split up the internal interface, but I can' t remember if this is possible on the 60 (definitely on the 60B and 60C). If the unit does support interface mode, that might help if one of the internal ports is faulty. Or, can you migrate the internal interface config to wan2 which is currently unused?