Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Faresnani
New Contributor III

Fortigate Firewall BGP received routes not installed in routing table

I'm facing an issue with Fortigate receiving BGP routes from the IPVPN router but the routes are not showing in the routing table please refer to the below topology and show commands from FW-BR02 firewall and IPVPN Cisco router

 

 

IPVPN Cisco Router:

IPVPN#sh run | sec bg
router bgp 65000
bgp log-neighbor-changes
network 10.10.59.144 mask 255.255.255.252
network 10.10.63.100 mask 255.255.255.252
neighbor 10.10.59.146 remote-as 65272
neighbor 10.10.63.102 remote-as 65272

IPVPN#show ip bgp summary
BGP router identifier 10.10.63.101, local AS number 65000
BGP table version is 5, main routing table version 5
4 network entries using 576 bytes of memory
6 path entries using 504 bytes of memory
2/2 BGP path/bestpath attribute entries using 320 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1424 total bytes of memory
BGP activity 4/0 prefixes, 6/0 paths, scan interval 60 secs

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.10.59.146 4 65272 5 8 5 0 0 00:02:01 2
10.10.63.102 4 65272 5 8 5 0 0 00:02:01 2


IPVPN# sh ip bgp neighbors 10.10.59.146 advertised-routes
BGP table version is 5, local router ID is 10.10.63.101
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
t secondary path,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

Network Next Hop Metric LocPrf Weight Path
*> 10.10.59.144/30 0.0.0.0 0 32768 i
*> 10.10.63.100/30 0.0.0.0 0 32768 i
*> 10.76.0.0/16 10.10.59.146 0 65272 i
*> 10.121.0.0/16 10.10.63.102 0 65272 i

Total number of prefixes 4

 

IPVPN# sh ip bgp neighbors 10.10.59.146 received-routes
% Inbound soft reconfiguration not enabled on 10.10.59.146

IPVPN#sh ip int bri
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 10.10.59.145 
GigabitEthernet0/1 10.10.63.101 

 

 

FW-BR02:

 

Jeddah-BR-FW # get sys int phy
== [onboard]
==[port1]
mode: dhcp
ip: 0.0.0.0 0.0.0.0
ipv6: ::/0
status: down
speed: n/a
==[port2]
mode: static
ip: 10.121.253.254 255.255.255.0
ipv6: ::/0
status: up
speed: 10000Mbps (Duplex: full)
==[port3]
mode: static
ip: 10.10.63.102 255.255.255.252
ipv6: ::/0
status: up
speed: 10000Mbps (Duplex: full)
==[port4]
mode: static
ip: 0.0.0.0 0.0.0.0
ipv6: ::/0
status: up
speed: 10000Mbps (Duplex: full)

Jeddah-BR-FW # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

Routing table for VRF=0
B 10.10.59.144/30 [20/0] via 10.10.63.101 (recursive is directly connected, port3), 00:02:40
C 10.10.63.100/30 is directly connected, port3
C 10.80.80.4/32 is directly connected, HUB1-IPVPN1
C 10.80.81.4/32 is directly connected, HUB1_IPVPN2
C 10.80.82.4/32 is directly connected, HUB2_IPVPN
S 10.121.0.0/16 [10/0] via 10.121.253.253, port2
C 10.121.253.0/24 is directly connected, port2


Jeddah-BR-FW # get router info bgp summary
VRF 0 BGP router identifier 10.10.63.102, local AS number 65272
BGP table version is 8
3 BGP AS-PATH entries
0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.10.63.101 4 65000 129 123 7 0 0 00:03:41 2

Total number of neighbors 1

 

Jeddah-BR-FW # get router info bgp neighbors 10.10.63.101
<string> (advertised-routes|received prefix-filter|received-routes|routes)

Jeddah-BR-FW # get router info bgp neighbors 10.10.63.101 advertised-routes
VRF 0 BGP table version is 8, local router ID is 10.10.63.102
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.10.63.100/30 10.10.63.102 100 32768 0 i <-/->
*> 10.121.0.0/16 10.10.63.102 100 32768 0 i <-/->

Total number of prefixes 2


Jeddah-BR-FW # get router info bgp neighbors 10.10.63.101 received-routes
VRF 0 BGP table version is 8, local router ID is 10.10.63.102
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.10.59.144/30 10.10.63.101 0 0 0 65000 i <-/->
*> 10.10.63.100/30 10.10.63.101 0 0 0 65000 i <-/->
*> 10.76.0.0/16 10.10.63.101 0 0 65000 65272 i <-/->
*> 10.121.0.0/16 10.10.63.101 0 0 65000 65272 i <-/->

Total number of prefixes 4


Jeddah-BR-FW # show full-configuration router bgp
config router bgp
set as 65272
set router-id 10.10.63.102
set keepalive-timer 60
set holdtime-timer 180
set always-compare-med disable
set bestpath-as-path-ignore disable
set bestpath-cmp-confed-aspath disable
set bestpath-cmp-routerid disable
set bestpath-med-confed disable
set bestpath-med-missing-as-worst disable
set client-to-client-reflection enable
set dampening disable
set deterministic-med disable
set ebgp-multipath disable
set ibgp-multipath disable
set enforce-first-as enable
set fast-external-failover enable
set log-neighbour-changes enable
set network-import-check enable
set ignore-optional-capability enable
set multipath-recursive-distance disable
set recursive-next-hop enable
set cluster-id 0.0.0.0
set confederation-identifier 0
set default-local-preference 100
set scan-time 60
set distance-external 20
set distance-internal 200
set distance-local 200
set synchronization disable
set graceful-restart enable
set graceful-end-on-timer disable
config neighbor
edit "10.10.63.101"
set advertisement-interval 30
set allowas-in-enable disable
set allowas-in-enable6 disable
unset attribute-unchanged
unset attribute-unchanged6
set activate enable
set activate6 enable
set bfd enable
set capability-dynamic disable
set capability-orf none
set capability-orf6 none
set capability-graceful-restart disable
set capability-graceful-restart6 disable
set capability-route-refresh enable
set capability-default-originate disable
set capability-default-originate6 disable
set dont-capability-negotiate disable
set ebgp-enforce-multihop enable
set link-down-failover disable
set stale-route disable
set next-hop-self enable
set next-hop-self6 disable
set override-capability disable
set passive disable
set remove-private-as disable
set remove-private-as6 disable
set route-server-client disable
set route-server-client6 disable
set shutdown disable
set soft-reconfiguration enable
set soft-reconfiguration6 disable
set as-override disable
set as-override6 disable
set strict-capability-match disable
set description ''
set distribute-list-in ''
set distribute-list-in6 ''
set distribute-list-out ''
set distribute-list-out6 ''
set ebgp-multihop-ttl 255
set filter-list-in ''
set filter-list-in6 ''
set filter-list-out ''
set filter-list-out6 ''
set interface ''
set maximum-prefix 0
set maximum-prefix6 0
set prefix-list-in ''
set prefix-list-in6 ''
set prefix-list-out ''
set prefix-list-out6 ''
set remote-as 65000
set local-as 0
set retain-stale-time 0
set route-map-in ''
set route-map-in6 ''
set route-map-out ''
set route-map-out-preferable ''
set route-map-out6 ''
set route-map-out6-preferable ''
set send-community both
set send-community6 both
set keep-alive-timer 4294967295
set holdtime-timer 4294967295
set connect-timer 4294967295
set unsuppress-map ''
set unsuppress-map6 ''
set update-source ''
set weight 4294967295
set restart-time 0
set additional-path disable
set additional-path6 disable
set password ENC D9+eVB0dXCoX2PIg2scQaxufrcGMbMLmTz30OW+WQWc8pT8xB90F54DgvLJ9b8ynOKRO9TFieYXjP1+Od/jol3n719IA3bXqe4omy3hjNnHQJ8nUPqFkytq/U8HcgeWxRC6OrGJDfOpq6v1Jx3j+1RnbsrCCFcabuVO1rym7IddJJilyWFUMCGxdT2yehiAyPU7zqw==
next
end
config network
edit 1
set prefix 10.121.0.0 255.255.0.0
set backdoor disable
set route-map ''
next
edit 2
set prefix 10.10.63.100 255.255.255.252
set backdoor disable
set route-map ''
next
end
config network6
edit 1
set prefix6 ::/128
set backdoor disable
set route-map ''
next
end
config redistribute "connected"
set status disable
set route-map ''
end
config redistribute "rip"
set status disable
set route-map ''
end
config redistribute "ospf"
set status disable
set route-map ''
end
config redistribute "static"
set status disable
set route-map ''
end
config redistribute "isis"
set status disable
set route-map ''
end
config redistribute6 "connected"
set status disable
set route-map ''
end
config redistribute6 "rip"
set status disable
set route-map ''
end
config redistribute6 "ospf"
set status disable
set route-map ''
end
config redistribute6 "static"
set status disable
set route-map ''
end
config redistribute6 "isis"
set status disable
set route-map ''
end
set graceful-restart-time 120
set graceful-stalepath-time 360
set graceful-update-delay 120
end

 

 

TopologyTopology

Omran Mohamed
Network Security Engineer
Omran MohamedNetwork Security Engineer
7 REPLIES 7
Toshi_Esumi
SuperUser
SuperUser

Before looking into the detail, I see you split the same AS 65272 to two different networks on two sides of IPVPN router. What is the reason behind it?

Toshi

Faresnani

 

Certainly! Here is a more professional version of your sentences:


The current implementation in our environment is functioning correctly, but I'm experiencing issues in the eve-ng lab environment.

Our ISP, providing the IPVPN service, operates under AS 65000, while all our branches Fortigate Firewalls are configured with the same AS 65272.

 

 

Omran Mohamed
Network Security Engineer
Omran MohamedNetwork Security Engineer
Toshi_Esumi

It shouldn't work. To prevent routing loop the 65000 router won't readvertise routes learned from the 65272 niehbor(FW-BR01) to another neighbor with the same AS 65272 (FW-BR02).
You need to change the AS between two locations.

Same AS (iBGP) is used for the same network and all nodes are connected each other directly (meshed). So only if you have direct VPN between FW-BR01 and FW-BR02 then neighboring each other, your setup would work. But there is no point doing it because those are two different locations and eBGP is more appropriate and simple.

Toshi

Faresnani

It's working in real-life senario, and I believe there is an option in Fortinet configuration, but I can't remember it 

Omran Mohamed
Network Security Engineer
Omran MohamedNetwork Security Engineer
Elmir
New Contributor III

If you have newer version of FortiOS, you can use [Allow AS in ] option.

Elmir
New Contributor III

Faresnani
New Contributor III

Thank you Elmir for your support this is what I was looking for, and now it resolved

Omran Mohamed
Network Security Engineer
Omran MohamedNetwork Security Engineer
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors