Hello,
I have a BGP flapping issue between two Fortigate ISPs in standalone mode and my Fortigate firewall in HA mode. I need your help, and could you please provide the recommended configuration?
Thank you.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello @khaled88 ,
- you can check this optimizing the BGP when there is HA failover to avoid traffic interruption:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-HA-and-BGP-graceful-...
In case of HA, please have a look this article for routing table update
Hi @khaled88 ,
Are you sharing IPv6 routes? If not, try disabling the ipv6 family.
config neighbor
edit "1.1.1.1"
set activate6 disable
next
end
regards
Hello,
Thank you for your response.
I will try to explain again the problem, I have tow fortigate en HA cluster (Active/Passive) in our side to onther Side we have tow Fortigate en standolone mode (ISP1 and ISP2) , the bgp session is up with ISP 1 and flapping with ISP2 FW.
note that we have 2 nexus with vpc configuration in the middle.
Still not clear the topology with many typos in your description. Do you have a diagram?
Do you have totally 4 FGTs, two in a-p HA and two more standalones? Which one of those is peering with ISP1 and ISP2? A simple diagram would clarify these.
Toshi
Hello,
thank you for your answer.
Find attached the design.
BGP session between FW2 and FW_ISP1 keep flapping (standby )
BGP session between FW2 and FW_ISP2 is stable (primary )
Best regards,
Are those 3 parties (FW_ISP1, FW_ISP2, HA FGT) on the same VLAN through the switches within the same subnet (like a /29)? Then each has a different/unique AS (eBGP)? Or do the ISP1 and ISP2 FGTs have the same AS and they're not peering each other?
I'm assuming pinging each others don't show any sign of packet losses.
Please share us the BGP config ("config router bgp") at all parties.
Toshi
Hello,
yes all firewalls are in the same Vlan, same Subnte /24,
Yes with the ISP FWs we have eBGP configuration.
ISP1 and ISP2 FGTs with the same Public AS.
config router bgp
set as Privte AS
set router-id 192.168.20.35
set holdtime-timer 240
config neighbor
edit "192.168.20.135"
set bfd enable
set soft-reconfiguration enable
set remote-as Public AS
set weight 1000
next
edit "192.168.20.136"
set bfd enable
set soft-reconfiguration enable
set remote-as Public AS
set weight 900
What do you see when you keep entering "get router info bgp sum" a couple of times? Would the state change for the neighbor?
Then try disabling BFD to see if it would change the situation.
And, why did you have to change the hold-timer from the default 180 to 240 while using BFD to fasten the transition?
Toshi
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.