Multiple BGP AS

[robdog]

Anyone know if it is possible to have the fortigate to connect to multiple BGP as ?

If so, does this have to be done by creating additional vdom's?

What I want to do is connect configure ipsec vpns to two separate aws environments via BGP.

Cheers

[robdog]

I found the answer, if any one else needs to configure multiple local BGP AS

config router bgp  config neighbor  edit "IP of the neighbor"  ...  set local-as 300  set local-as-no-prepend disable|enable  set local-as-replace-as disable|enable  end  Enable local-as-no-prepend if you do not want to prepend local-as to incoming updates.  Enable local-as-replace-as to replace a real AS with local AS in outgoing updates. 

[cntx]

Thumbs up. Though not applicable to my case but really appreciate the solution. 

[Network_Team]

Did you get the answer, I have similar scenario. 

[Toshi_Esumi]

What is your "scenario"? Original post was asking about multiple BGP neighbors. Of course it would work.

Toshi

[Network_Team]

I have Paloalto firewall with two ISP connection and below are the current setup

1. static route 0.0.0.0/0 pointing to primary ISP AD 10

2. static route 0.0.0.0/0 pointing to next virtual router(vr) which is connected secondary ISP ad 20

3. bgp route 10.0.0.0/8 pointing to primary tunnel using secondary ISP link Lolal preference (200)

4. bgp route 10.0.0.0/8 pointing to backup tunnel using primary ISP link Local preference (100)

Basically my internet traffic go through primary internet and intanet traffic prefer secondary link. In case of link fail automatically failover happen.

I need to do same thing on FortiGate.

[Toshi_Esumi]

Your description doesn't make sense. If 10.0.0.0/8 is an aggregated route for the other side of the tunnel, it has nothing to do with the BGP neighboring to your ISP. ISP doesn't know anything about the 10/8 network. It has to be advertised from the opposite side if BGP, but more like you're talking about static routes into those two tunnels to the opposite side.

What is/are your BGP neighbors: your ISPs or the other end of the tunnel?

Toshi

[Network_Team]

My requirement is simple, I want to use both isp links same time. For internet primary isp and intranet (remote site) secondary isp (through ipsec tunnel). Any link fail automatic failover should happen. How do we achive this in Fortigate. 

[Toshi_Esumi]

Still not quite understanding this. Are you saying those two different ISPs (I'm assuming) are requiring BGP peerings while you don't have any public subnets to advertise and only need to get the default route from them?
Otherwise, your description/requirement doesn't look like having anything to do with BGP.

Toshi

[Shashwati]

You can use SDWAN rules to use Primary ISP for the Internet traffic