Redistribute OSPF over BGP Between to FotiGates (wrong next hop ip)

[Sowie]

Hi,

I'm trying to redistribute OSPF over BGP. The Neighbors are getting the routes but the routes are using wrong recursive next hop IP on one of the sides...

When you look at the routing table on the right side it is using the WAN IP instead of the tunnel IP

DEFLE-FW01 $ get router info routing-table bgp
Routing table for VRF=0
B 10.1.2.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 10.1.3.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 10.1.4.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 10.1.5.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 10.1.6.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 10.1.90.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 10.1.91.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 10.1.91.100/32 [200/0] via 172.30.0.254 (recursive via ADVPN tunnel "WAN IP"), 02:32:12
B 10.1.100.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38
B 172.21.1.0/30 [200/0] via 172.30.0.1 (recursive via ADVPN tunnel "WAN IP"), 02:32:12
B 172.21.1.4/30 [200/0] via 172.30.0.1 (recursive via ADVPN tunnel "WAN IP"), 02:32:12
B 192.168.4.0/24 [200/0] via 172.30.0.1 (recursive via ADVPN tunnel "WAN IP"), 02:27:33

But when you look on the left side everything seems fine

DKAAR-FW01 $ get router info routing-table bgp
Routing table for VRF=0
B 10.2.2.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.2), 01:48:55
B 10.2.3.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.2), 01:48:55
B 10.2.4.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.2), 01:48:55
B 10.2.5.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.2), 01:48:55
B 10.2.6.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.2), 01:48:55
B 10.2.90.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.2), 01:48:55
B 10.2.91.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.2), 01:48:55
B 10.2.91.100/32 [200/0] via 172.30.0.1 (recursive is directly connected, ADVPN), 03:21:57
B 10.2.100.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN tunnel 172.30.0.254), 01:48:55
B 172.21.2.0/30 [200/0] via 172.30.0.1 (recursive is directly connected, ADVPN), 03:21:57

If you have idea on how to fix this please let me know.

Both Fortigates are running version 7.0.11

[Faiza_Emam_Delhi]

Hello,

From the output you have provided, it appears that the issue is with the recursive next-hop IP address on the right side. It is using the WAN IP instead of the ADVPN tunnel IP address.

To fix this issue, you may need to check the BGP configuration on the right side FortiGate to ensure that the correct next-hop IP address is being advertised to the BGP peers. You may also need to check the routing settings on the right side FortiGate to ensure that the ADVPN tunnel IP address is being used as the next-hop IP address for the redistributed routes.

Here are some steps you can try:

1. Check the BGP configuration on the right side FortiGate to ensure that the correct next-hop IP address is being advertised to the BGP peers. You can use the "get router info bgp summary" command to check the BGP peer status and the advertised next-hop IP address.

2. Check the OSPF configuration on the left side FortiGate to ensure that the redistributed routes are using the correct next-hop IP address. You may need to configure a static route or modify the OSPF configuration to ensure that the ADVPN tunnel IP address is being used as the next-hop IP address for the redistributed routes.

3. Verify the routing table on both FortiGate devices to ensure that the correct next-hop IP address is being used for the redistributed routes.

4. If the issue persists, you may need to provide more information about the network topology and the configuration settings on both FortiGate devices to help diagnose the issue.

I hope this helps! Let me know if you have any further questions.

[Faiza_Emam_Delhi]

Hi,

Based on the routing table output you provided, it appears that the issue is with the recursive next hop IP address on the right side FortiGate device. The BGP routes are using the WAN IP instead of the tunnel IP as the recursive next hop.

To fix this issue, you can try the following steps:

1. Check BGP configuration on the right side FortiGate device: Verify that the BGP configuration on the right side FortiGate device is correct and that the tunnel interface is specified as the next hop for the redistributed OSPF routes.

2. Check IPsec configuration on the right side FortiGate device: Verify that the IPsec configuration on the right side FortiGate device is correct and that the tunnel interface is reachable via the IPsec tunnel.

3. Check BGP configuration on the left side FortiGate device: Verify that the BGP configuration on the left side FortiGate device is correct and that the tunnel interface is configured as the next hop for the redistributed OSPF routes.

4. Check IPsec configuration on the left side FortiGate device: Verify that the IPsec configuration on the left side FortiGate device is correct

[Sowie]

Hi Faiza,

Thanks for the response!

1. Check BGP configuration on the right side FortiGate device: Verify that the BGP configuration on the right side FortiGate device is correct and that the tunnel interface is specified as the next hop for the redistributed OSPF routes.
How would I do this? I have tried to set the "next-hop-self-rr" and "next-hop-self". 

2. Check IPsec configuration on the right side FortiGate device: Verify that the IPsec configuration on the right side FortiGate device is correct and that the tunnel interface is reachable via the IPsec tunnel.

I have check and the VPN is working as it should. The only thing that is different is that on the right side I've had to set a remote gateway. I don't know if that is what is causing the issue here.

3. Check BGP configuration on the left side FortiGate device: Verify that the BGP configuration on the left side FortiGate device is correct and that the tunnel interface is configured as the next hop for the redistributed OSPF routes.

When looking at the routing table this side dosn't seem to have an issue with the recursive route.

Routing table for VRF=0
B 10.2.2.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 10.2.3.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 10.2.4.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 10.2.5.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 10.2.6.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 10.2.90.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 10.2.91.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 10.2.91.100/32 [200/0] via 172.30.0.1 (recursive is directly connected, ADVPN-HUB), 00:38:22
B 10.2.100.0/24 [200/20] via 172.21.2.2 (recursive via ADVPN-HUB tunnel 172.30.0.1), 00:00:02
B 172.21.2.0/30 [200/0] via 172.30.0.1 (recursive is directly connected, ADVPN-HUB), 00:38:22

4. Check IPsec configuration on the left side FortiGate device: Verify that the IPsec configuration on the left side FortiGate device is correct
Also correct

[Sowie · Accepted solution]

Hi all,

I would like to express my gratitude for your assistance in resolving my issue. Your time and support have been greatly appreciated.

Upon reflection, I realized that I neglected to perform a simple ping test between the sites after resetting both Fortigates. Consequently, I am uncertain about the exact cause of the problem. However, I attempted to rectify the situation by implementing static routes instead of relying on OSPF. Surprisingly, everything appears to be functioning correctly, albeit with an incorrect tunnel IP on the recursive route. To my surprise, I successfully executed a ping test. Subsequently, I decided to remove the static routes, and to my amazement, the connection still remains functional. This turn of events has left me perplexed as to why the ADVPN tunnel now exhibits the WAN IP of the HUB instead of the tunnel IP and why it is working. Perhaps it is related to setting the remote Gateway to that address...

Thank you once again for your assistance and understanding.