FortiGate BGP Route leaks

[smorty11]

Hi, I am hoping someone may be able to help. I currently have BGP peers set up for the Internal network and then the DMZ, separate VRFs in the DC but same VRF on the FortiGate.

Servers in the DMZ currently can’t access the internal networks because they are not learning the routes so I need to leak the learned routes from the Internal BGP peers so traffic coming from the DMZ knows which way to route via the FortiGate.

I can see the DMZ traffic hitting the DMZ interface but then not traversing the firewall. IPv4 policies are in place.

I’ve been reading forums and the advice is route-maps but unsure how to go about this.

Any help would be greatly appreciated.

[Adam19892000]

Thanks Adrian, so I would still be in the situation that I would have to specify every route that should be passed from the Internal VRF to the DMZ VRF in a route-map as it would show in the routing table so each subnet, not able to just allow all to be leaked. 

At the moment I have the peers configured but no route-maps. Would you be able to show the examples of the route-maps please? 

Adam

[akristof]

Hi.

Well, with the route-maps you can do whatever you want. In prefix-list used in route-map you can either list of the prefixes you want to use or you can use keyword any and it should leak all routes from one VRF to another.

[Adam19892000]

Thanks Adrian, I shall have a look at how I configure the route-maps based on my configuration without VRFs on the FortiGate and then creating those route-leaks between Internal and DMZ and then the default route from External to DMZ. 

[Toshi_Esumi]

By the way, why do you need to separate both sides with FGT's VRFs? Are there any route overlaps between them? Generally policies are the ones isolate DMZ from internal and external network.

Toshi

[Adam19892000]

Hi Toshi, 

Unsure whether this question is aimed at me but at the moment I don't have VRFs created on the FortiGate. I have VRFs configured on our ACI DC infrastructure that then connect into the FortiGate. This is where I then need to allow routes to traverse the FortiGate so the DMZ knows to route traffic internally and everything else via the Internet. I'm trying not to create VRFs on the FortiGate as well, just allow the DMZ servers to learn where to send the traffic. 

Adam

[Toshi_Esumi]

I see I misunderstood your original statement. So from FGT's view it's get a plain IP (or vlan tagged) packets from outside. Then this design has nothing to do with VRF at all.

Toshi

[Adam19892000]

Not on the VRF No. Different VLANs (on the FortiGate) providing access to specific networks with routes being learned via BGP Peers. 

I just need the DMZ servers to learn all the routes the FortiGate is learning from "10.9.4.17" [Internal Peer] and "10.9.4.18" [Internal Peer] and then learn the default route via "26.98.214.220" [External Peer] and "26.98.214.221" [External Peer]. 

Still trying to get my head around exactly how I configure this and I'm really trying not to just set up static routes with local preference when we're using BGP for resilience everywhere else. 

Adam

[Toshi_Esumi]

Are these iBGP or eBGP peers? If eBGPs each other, all routes coming from one side will be forwarded to all other neighbors. So I'm assuming you set the same ASN for iBGP, which would cause this kind of situation if those "DMZ" peer and "internal" peers don't be neighboring directly each others in mesh. You need to use eBGP.

Toshi

[Adam19892000]

Thanks Toshi, I didn't specify iBGP or eBGP, just used the BGP GUI to set up the peers so I assume the default is iBGP. Is there a way of changing the default so then all the current settings will switch to eBGP? 

Adam

[Toshi_Esumi]

For BGP config, GUI is very limited. We almost always have to configure in CLI. Most of the config is under "config router bgp" except route-maps, prefix-list and community-list. First check what's in there to see how its own ASN and neighbors' are configured. "show" will show you all once you got in the config router bgp. Then you can adjust the ASNs. But you have to change them on the peer sides as well.