Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
robdog
New Contributor II

Multiple BGP AS

Anyone know if it is possible to have the fortigate to connect to multiple BGP as ?

 

If so, does this have to be done by creating additional vdom's?

 

What I want to do is connect configure ipsec vpns to two separate aws environments via BGP.

 

Cheers

11 REPLIES 11
robdog
New Contributor II

I found the answer, if any one else needs to configure multiple local BGP AS

 

config router bgp  config neighbor  edit "IP of the neighbor"  ...  set local-as 300  set local-as-no-prepend disable|enable  set local-as-replace-as disable|enable  end  Enable local-as-no-prepend if you do not want to prepend local-as to incoming updates.  Enable local-as-replace-as to replace a real AS with local AS in outgoing updates. 

cntx
New Contributor

Thumbs up. Though not applicable to my case but really appreciate the solution. 

 

 

Network_Team

Did you get the answer, I have similar scenario. 

Toshi_Esumi

What is your "scenario"? Original post was asking about multiple BGP neighbors. Of course it would work.

Toshi

Network_Team
New Contributor

I have Paloalto firewall with two ISP connection and below are the current setup

1. static route 0.0.0.0/0 pointing to primary ISP AD 10

2. static route 0.0.0.0/0 pointing to next virtual router(vr) which is connected secondary ISP ad 20

3. bgp route 10.0.0.0/8 pointing to primary tunnel using secondary ISP link Lolal preference (200)

4. bgp route 10.0.0.0/8 pointing to backup tunnel using primary ISP link Local preference (100)

Basically my internet traffic go through primary internet and intanet traffic prefer secondary link. In case of link fail automatically failover happen.

I need to do same thing on FortiGate.

Toshi_Esumi

Your description doesn't make sense. If 10.0.0.0/8 is an aggregated route for the other side of the tunnel, it has nothing to do with the BGP neighboring to your ISP. ISP doesn't know anything about the 10/8 network. It has to be advertised from the opposite side if BGP, but more like you're talking about static routes into those two tunnels to the opposite side.

What is/are your BGP neighbors: your ISPs or the other end of the tunnel?

Toshi

Network_Team

My requirement is simple, I want to use both isp links same time. For internet primary isp and intranet (remote site) secondary isp (through ipsec tunnel). Any link fail automatic failover should happen. How do we achive this in Fortigate. 

Toshi_Esumi

Still not quite understanding this. Are you saying those two different ISPs (I'm assuming) are requiring BGP peerings while you don't have any public subnets to advertise and only need to get the default route from them?
Otherwise, your description/requirement doesn't look like having anything to do with BGP.

Toshi

Shashwati

You can use SDWAN rules to use Primary ISP for the Internet traffic 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors