Multiple BGP AS

[robdog]

Anyone know if it is possible to have the fortigate to connect to multiple BGP as ?

If so, does this have to be done by creating additional vdom's?

What I want to do is connect configure ipsec vpns to two separate aws environments via BGP.

Cheers

[robdog]

I found the answer, if any one else needs to configure multiple local BGP AS

config router bgp  config neighbor  edit "IP of the neighbor"  ...  set local-as 300  set local-as-no-prepend disable|enable  set local-as-replace-as disable|enable  end  Enable local-as-no-prepend if you do not want to prepend local-as to incoming updates.  Enable local-as-replace-as to replace a real AS with local AS in outgoing updates. 

[cntx]

Thumbs up. Though not applicable to my case but really appreciate the solution. 

[Network_Team]

Did you get the answer, I have similar scenario. 

[Toshi_Esumi]

What is your "scenario"? Original post was asking about multiple BGP neighbors. Of course it would work.

Toshi

[Network_Team]

I have Paloalto firewall with two ISP connection and below are the current setup

1. static route 0.0.0.0/0 pointing to primary ISP AD 10

2. static route 0.0.0.0/0 pointing to next virtual router(vr) which is connected secondary ISP ad 20

3. bgp route 10.0.0.0/8 pointing to primary tunnel using secondary ISP link Lolal preference (200)

4. bgp route 10.0.0.0/8 pointing to backup tunnel using primary ISP link Local preference (100)

Basically my internet traffic go through primary internet and intanet traffic prefer secondary link. In case of link fail automatically failover happen.

I need to do same thing on FortiGate.

[Toshi_Esumi]

Your description doesn't make sense. If 10.0.0.0/8 is an aggregated route for the other side of the tunnel, it has nothing to do with the BGP neighboring to your ISP. ISP doesn't know anything about the 10/8 network. It has to be advertised from the opposite side if BGP, but more like you're talking about static routes into those two tunnels to the opposite side.

What is/are your BGP neighbors: your ISPs or the other end of the tunnel?

Toshi

[Network_Team]

My requirement is simple, I want to use both isp links same time. For internet primary isp and intranet (remote site) secondary isp (through ipsec tunnel). Any link fail automatic failover should happen. How do we achive this in Fortigate. 

[funkylicious]

Your requirement seems quite simple.

If your ISP1 fails, traffic should route towards ISP2 , while having IPsec tunnels ending/created on both links and preferring ISP1-IPsec tunnel for remote site and if ISP1 fails , traffic should exit towards internet on ISP2 and ISP2-IPsec for remote site.

One thing you can do is configure a link-monitor, https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/360563/dual-internet-connect...

Another thing you can do is to configure an SDWAN zone for underlay ( Internet traffic / ISP interfaces ) and overlay for IPsec tunnels ( IPsec interfaces, one for each WAN link ).

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/942095/sd-wan-members-and-zo...