Configuration eBGP // HA cluster //

[khaled88]

Hello,

I have a BGP flapping issue between two Fortigate ISPs in standalone mode and my Fortigate firewall in HA mode. I need your help, and could you please provide the recommended configuration?

Thank you.

[dbhavsar]

Hello @khaled88 ,

- you can check this optimizing the BGP when there is HA failover to  avoid traffic interruption:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-HA-and-BGP-graceful-... 

[Mrinmoy]

In case of HA, please have a look this article for routing table update

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Controlling-how-HA-synchronizes-routing-ta...

[hhasny]

Hi @khaled88 ,

Are you sharing IPv6 routes? If not, try disabling the ipv6 family.

config neighbor
edit "1.1.1.1"
set activate6 disable
next
end

regards

[khaled88]

Hello, 

Thank you for your response. 

I will try to explain again the problem, I have tow fortigate en HA cluster (Active/Passive) in our side to onther Side we have tow Fortigate en standolone mode (ISP1 and ISP2) , the bgp session is up with ISP 1 and flapping with ISP2 FW. 
note that we have 2 nexus with vpc configuration in the middle. 

[Toshi_Esumi]

Still not clear the topology with many typos in your description. Do you have a diagram?
Do you have totally 4 FGTs, two in a-p HA and two more standalones? Which one of those is peering with ISP1 and ISP2? A simple diagram would clarify these.

Toshi

[khaled88]

Hello, 

thank you for your answer. 

Find attached the design.

BGP session between FW2 and FW_ISP1 keep flapping (standby )
BGP session between FW2 and FW_ISP2 is stable (primary )

Best regards, 

[Toshi_Esumi]

Are those 3 parties (FW_ISP1, FW_ISP2, HA FGT) on the same VLAN through the switches within the same subnet (like a /29)? Then each has a different/unique AS (eBGP)? Or do the ISP1 and ISP2 FGTs have the same AS and they're not peering each other?

I'm assuming pinging each others don't show any sign of packet losses.
Please share us the BGP config ("config router bgp") at all parties.

Toshi

[khaled88]

Hello, 

yes all firewalls are in the same Vlan, same Subnte /24, 

Yes with the ISP FWs we have eBGP configuration. 

ISP1 and ISP2 FGTs with the same Public AS.

config router bgp
set as Privte AS
set router-id 192.168.20.35
set holdtime-timer 240
config neighbor
edit "192.168.20.135"
set bfd enable
set soft-reconfiguration enable
set remote-as Public AS
set weight 1000
next
edit "192.168.20.136"
set bfd enable
set soft-reconfiguration enable
set remote-as Public AS
set weight 900

[Toshi_Esumi]

What do you see when you keep entering "get router info bgp sum" a couple of times? Would the state change for the neighbor?
Then try disabling BFD to see if it would change the situation.
And, why did you have to change the hold-timer from the default 180 to 240 while using BFD to fasten the transition?

Toshi