Redistribute iBGP routes to OSPF in FortiGate

[arie_arie]

Hi,

I need to know whether iBGP routes that learnt in FortiGate can be redistributed to OSPF by default or not?

Because in other router like Cisco, iBGP can't be redistributed to OSPF by default, it needs command like 'bgp redistribute-internal'

Thank you

[Toshi_Esumi · Accepted solution]

I was not sure about this either and I couldn't find any documentation as well. So, I decided to test it myself.
I set up three FGTs and one side is iBGP peering and the other side is OSFP peering and, of course, the middle one is redistributing from iBGP to OSPF. The config snippet at the middle FGT is below. 192.168.150.0/24 is advertised from iBGP neighbor. So I set a filter to allow only this prefix to be redistributed to OSPF side.

config router bgp
  set as 64512
  set router-id 10.10.1.2
  config neighbor
    edit "10.10.1.1"
      set next-hop-self enable
      set soft-reconfiguration enable
      set remote-as 64512
    next
  end
<snip>
end

config router ospf
  set router-id 10.10.11.2
  config area

    edit 0.0.0.0
    next
  end
  config network
    edit 1
      set prefix 10.10.11.0 255.255.255.252
    next
  end
  <snip>
  config redistribute "bgp"
    set status enable
    set routemap "allow_192_168_150_only"
  end
  <snip>
end

The result was below:
<both at ASBR FGT and OSPF neighbor FGT>

FortiGate-60E # get router info ospf database brief

                OSPF Router with ID (10.10.11.2) (Process ID 0, VRF 0)

                   Router Link States (Area 0.0.0.0)

Link ID       ADV Router Age  Seq#        CkSum Flag Link count
10.10.11.1 10.10.11.1   748   80000005 e1e9    0012 1
10.10.11.2 10.10.11.2   1565 80000006 dde9    0021 1

                  Net Link States (Area 0.0.0.0)

Link ID       ADV Router Age   Seq#        CkSum Flag
10.10.11.2 10.10.11.2    1538 80000002 7365    0031

                  AS External Link States

Link ID           ADV Router Age Seq#         CkSum Flag Route                       Tag
10.253.240.0 10.10.11.1   1168 80000002 3786    0012 E2 10.253.240.0/20 0
192.168.1.0 10.10.11.1     98     80000002 8ab2    0012 E2 192.168.1.0/24   0
192.168.150.0 10.10.11.2 1565 80000001 198e    0021 E2 192.168.150.0/24 0

Conclusion:
iBGP learned routes are redistributed to OSPF side without any special command to allow, which is the case for Cisco. (Juniper's route redistribution is always going through RIB, not directly from iBGP to OSPF, so it wouldn't apply).

Toshi

[HarshChavda]

Hello @arie_arie ,

You can refer this document: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Redistribute-BGP-routes-learnt-through-dif...

[arie_arie]

Hi,

In FortiGate, by default, the iBGP can redistribute to OSPF by using route-map and redistribute config, is it correct?

Thanks

[Toshi_Esumi · Accepted solution]

I was not sure about this either and I couldn't find any documentation as well. So, I decided to test it myself.
I set up three FGTs and one side is iBGP peering and the other side is OSFP peering and, of course, the middle one is redistributing from iBGP to OSPF. The config snippet at the middle FGT is below. 192.168.150.0/24 is advertised from iBGP neighbor. So I set a filter to allow only this prefix to be redistributed to OSPF side.

config router bgp
  set as 64512
  set router-id 10.10.1.2
  config neighbor
    edit "10.10.1.1"
      set next-hop-self enable
      set soft-reconfiguration enable
      set remote-as 64512
    next
  end
<snip>
end

config router ospf
  set router-id 10.10.11.2
  config area

    edit 0.0.0.0
    next
  end
  config network
    edit 1
      set prefix 10.10.11.0 255.255.255.252
    next
  end
  <snip>
  config redistribute "bgp"
    set status enable
    set routemap "allow_192_168_150_only"
  end
  <snip>
end

The result was below:
<both at ASBR FGT and OSPF neighbor FGT>

FortiGate-60E # get router info ospf database brief

                OSPF Router with ID (10.10.11.2) (Process ID 0, VRF 0)

                   Router Link States (Area 0.0.0.0)

Link ID       ADV Router Age  Seq#        CkSum Flag Link count
10.10.11.1 10.10.11.1   748   80000005 e1e9    0012 1
10.10.11.2 10.10.11.2   1565 80000006 dde9    0021 1

                  Net Link States (Area 0.0.0.0)

Link ID       ADV Router Age   Seq#        CkSum Flag
10.10.11.2 10.10.11.2    1538 80000002 7365    0031

                  AS External Link States

Link ID           ADV Router Age Seq#         CkSum Flag Route                       Tag
10.253.240.0 10.10.11.1   1168 80000002 3786    0012 E2 10.253.240.0/20 0
192.168.1.0 10.10.11.1     98     80000002 8ab2    0012 E2 192.168.1.0/24   0
192.168.150.0 10.10.11.2 1565 80000001 198e    0021 E2 192.168.150.0/24 0

Conclusion:
iBGP learned routes are redistributed to OSPF side without any special command to allow, which is the case for Cisco. (Juniper's route redistribution is always going through RIB, not directly from iBGP to OSPF, so it wouldn't apply).

Toshi

[srajeswaran · Accepted solution]

You are fast, I just did this test and confirmed the same :)

[Toshi_Esumi]

haha, @srajeswaran, you're sooo slow.
It's interesting to find a FGT's behavior is different from Cisco's. For routing, FortiOS is almost strictly copied from Cisco IOS including the command line details.

Toshi

[arie_arie]

Yes, I also find a bit tricky in FortiGate, where the behavior is different from Cisco in term of redistribute iBGP to OSPF.

[arie_arie]

Hi,

Thanks for the answer. Really helpful!

So, if I don't want to include iBGP routes into redistribution to OSPF, the option is to create route-map and deny the iBGP routes so that it wouldn't being redistributed to OSPF, am I correct?

Thank you

[Toshi_Esumi]

yea, something like "set match-origin" in a route-map if you don't want to match individual prefixes. Probably this part is the same with Cisco.
FortiGate-60E (1) # set match-origin ?
none          None.
egp            Remote EGP.
igp             Local IGP.
incomplete Unknown heritage.

Toshi