COOKBOOK GUIDE: ADVPN - BGP on Loopback

[djp]

Cookbook: ADVPN s/BGP on Loopback

Guide on how to properly setup ADVPN with on Loopback.

This is a quick and easy configuration. Don't let MSP's charge you 40-50k for this solution. We've been in three scenarios this year, where we had to come in and fix a customers install that their MSP did for 50k, and rip it completely out and start over.

Full Testing proof Dual-Hub / 15 overlays: https://youtu.be/04BjjyMYEEk?si=o6qpHrprttcPCyHG

Creating templates and deploying with FMG: https://youtu.be/h42MymcAVng?si=nhaJUHNVnrCqcrp8

Proving cross overlay traffic works: https://youtu.be/3SmNWZGlIgw?si=QCXi7reaJq3eKQDY

Importance of sla-min-meet: https://youtu.be/WMpTmdnr**bleep**?si=tlp2o-xPlCrPVt3E

Proof aux-sessions is bad, turn it off: https://youtu.be/2ay5iQkZOf8?si=WiT8teo5dklebGbK

Reach out to me if you need help, guidance, or just want it done quickly and correct by a US based Fortinet partner.

=======================
== Pre-TASKS ==

Plan this out, watch this first

I truncated it because I got too many messages as folks didnt study the first 10 minutes: https://youtu.be/7dCeUA5rhKQ?si=CZCbloyG9PucyGjE

I cannot stress how important it is to watch the above video. As it is how you need to design your setup based on which paths you want to take. If you dont understand this, your configuration will fail, as you need to match HUB and SPOKE path decisions accordingly. This is especially important once you get to multiple hubs as well as multiple overlays. Example in that video is 15-overlays.... thus you need to make sure you plan it properly from the spoke perspective and also the hub perspective so they match.

- Gather a list of all of your site
- Assign sites identifiers 3-254 to each site
- Make HUB1 = 1
- Make HUB2 = 2
- Choose a address space for BGP peering: (10.254.99.x/24)
- Choose a single /32 for each HUB's healthcheck (10.254.100.1/32 & .2)
- Gather each Site's local address space
- Gather HUBs public IP's

==== HUB ====
-==Create BOTH of your loopbacks, mandatory because of kernel routes
- Loopback for HealthCheck (lo.HC)
- Loopback for BGP (lo.BGP)
-==Create VPN Phase 1/2
- dialup tunnels
- use network-id
- set DPD
-== Create your Blackhole routes
- to all VPN destinations with distance 254
-== Create SDWAN ZONE (ADVPN)
-== Create SDWAN members
- default cost/prioirty
-== Create SDWAN healthcheck
- one for each overlay
- type = remote
- set in/out priority
-== Create SDWAN rules
- source your-internal-networks
- dest route-tag (or you can do address space like rfc1918)
- type Manual
- tie break fib
-== Create RouteMaps
- set tag
- set routetag (only if you are using route tags in your sdwan rules)
- set community (optional, but great for future use and suggested by me)
-== Configure BGP
- set router ID to lo.BGP
- set recurse NH & Priority
- set neighborGroup
- int/src lo.BGP
- set route reflector
- set graceful restart
- advertise the entire BGP address space
- advertise lo.HC
- advertise HUB address space
- advertise summary route of your spoke networks (eg. 10.0.0.0/8)
-== Firewall Policies
- ADVPN <> ADVPN
- ADVPN > lo.HC
- ADVPN > lo.BGP
- ADVPN > LAN
- LAN > ADVPN

==== SPOKE ====

-== Create loopback
- Loopback for BGP (lo.BGP)
-== Create VPN Phase 1/2
- static tunnels
- use network-id
- set DPD
-== Create Blackhole routes
- distance 254
-== Create SDWAN ZONE (ADVPN)
-== Create SDWAN members
- default cost/priority
-== Create SDWAN healthcheck
- source as lo.BGP
- set embedded SLA
-== Create SDWAN rules
- source lan (rfc1918)
- dest route-tag (or address space instead rfc1918)
- type lowestcost (add load balance if you wish)
- sla = your hub healthcheck
- set min meet 1 (optional but depends on your ruleset and flow)
- members all hub1 paths
(duplicate above for hub2 - or combine into one if using anycast for hub sla's)
-== Create RouteMaps
- set tag
- set routetag (optional)
- set community
- (you wont use but you'll want for future)
-== Configure BGP
- set router ID lo.BGP
- set recurse NH & Priority & tag merge
- set neighbor
- int/source lo.BGP
- set graceful restart
- advertise your own space
-== Firewall Policies
- lo.BGP > ADVPN
- ADVPN > lo.BGP
- ADVPN > LAN
- LAN > ADVPN

[Jean-Philippe_P]

Thanks a lot :)