Route Branch FGT to BGP via Site to Site VPN

[ferryblu3]

Hi all, I have some question regarding the routing in FortiGate here. I have attached the topology here for better understanding. I only have a control of ID FortiGate and cannot see the configuration on Azure WAN and other Head Office. Current condition is in the green box, all Head Office FortiGate has IPSec tunnel to Azure WAN, and I think the Azure WAN is responsible for the BGP routing to all other Head Office. From ID Head Office, I can connect to TH Head Office and JP Head Office. Everything is working well.

So, I have a new Branch office in ID. I can create the site-to-site VPN between ID Head Office and ID Branch, but the problem here is to connect the ID Branch to TH Head Office or JP Head Office via ID Head Office. Does anyone ever have this kind of configuration and can give me suggestions about how to configure it?

Thank you.

[Toshi_Esumi]

You need to understand the BGP topology with AS number on each FGT. It's under "config router bgp" in CLI. Especially inside of "config neighbor". It would look like below:

config router bgp
  set as 65070
  set router-id 192.168.199.253
  config neighbor
    edit "10.x.x.253"
      set shutdown enable
      set soft-reconfiguration enable
      set remote-as 65528
      set route-map-out "Announce-Primary"
      set send-community standard
    next
    edit "10.x.x.121"
      set soft-reconfiguration enable
      set remote-as 65528
      set route-map-out "Announce-Office"
      set send-community standard
    next
  end
  config redistribute "connected"
    set status enable
  end
  <snip>

Share us this part of config after masking some sensible info.
Above is my home 40F's BGP config. It has two neighbors configured but one of them is "shutdown" so only the second neighbor is active. The neibor is connected over an IPsec and 10.x.x.121 is configured on the neighbor FGT's IPsec interface. And it's getting routes from AS=65528 over eBGP (because its own AS is 65070).

Toshi

[Toshi_Esumi]

And if you know TH Head Office subnet, say x.x.x.0/24, you can try "get router info bgp network x.x.x.0/24", just like below:

fg40f-utm (root) # get router info bgp network 10.0.94.0/24
VRF 0 BGP routing table entry for 10.0.94.0/24
Paths: (1 available, best #1, table Default-IP-Routing-Table)
  Not advertised to any peer
  Original VRF 0
  65528 yyyyy
    10.x.x.121 from 10.x.x.121 (z.z.z.z)
      Origin incomplete metric 0, localpref 100, valid, external, best
      Last update: Fri Sep 20 22:37:13 2024

The important info in above output is the AS list. It's showing the 10.0.94.0/24 was originally advertised from AS=yyyy. Then AS=yyyy readvertised it to AS=65528. Then my 40F got it from the neighbor 65528.

Toshi