Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
roxy_kk
New Contributor

How to avoid Assymetric Routing with Fortigate with a new BGP link

HI All,

 

Have a setup where I have a pair of Fortigate FW cluster (A-P)  connected into ACI Fabric under a VRF1. Have BGP configured to learn routes dynamically . There is a new requirement to create a new VRF2 on the Fabric and move this BGP connection onto that .While configuring this on the firewall we plan to create a new interface in the same zone and plan to move traffic from Link 1 to Link 2. Now it is understood that when we do this we will end up breaking existing connections which are in the session table ( with successful 3 way handshakes) . Trying to find a solution where by we can move the traffic from the primary link to secondary link without impacting existing connections. Any ideas ?

2 REPLIES 2
spoojary
Staff
Staff

To move traffic from the primary link to the secondary link without impacting existing connections when transitioning to a new VRF and interface setup in a FortiGate firewall cluster connected to an ACI fabric, mplement route leaking between VRF1 and VRF2 using BGP to allow communication between the two VRFs without impacting existing connections. This ensures that traffic can flow between the VRFs seamlessly. Create policy routes to redirect specific traffic from the primary link to the secondary link without affecting existing connections. By configuring policy routes, you can control the flow of traffic based on specific criteria, such as source address or protocol.

Siddhanth Poojary
Toshi_Esumi
SuperUser
SuperUser

Until seeing and examining the detailed network diagram including HA compoenents, two VRFs and BGP neighborings, probably nobody would be able to provide any useful information toward the "solutions". Besides, VRF separation and route leaking are two networking mechanisms that could work against each other. There are certain situations leaking specific routes, such as management traffice, while all other other routes/traffic need to be separated/isolated each others.

Also it's not clear if you're concerning about the migration without having a maintenance window or fail-over situations after the migration is done.
But this kind of design consideration is probably beyond this FTNT community.

Toshi

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors