Route Distance

[snakething]

Hi,

Probably a dumb question but here goes.

I have a vdom which receives a 0/0 from bgp:

B    *> 0.0.0.0/0 [20/0] via 10.238.2.201, xxxxx, 1d00h23m

I also have an IPSec tunnel which i want to send internet traffic to from certain subnets, so im going to configure policy routing.

But without having the 0/0 route active in the routing table towards the tunnel interface the policy route wont work.

When trying to add a static 0/0 route towards the tunnel interface with the same distance as BGP i get this:

get router info routing-table database

S    *> 0.0.0.0/0 [20/0] is directly connected, tunnel1 B       0.0.0.0/0 [20/0] via 10.238.2.201, lan, 1d00h22m

The static always is active though they have the same distance. I was able to go round this by configuring ip addresses on the tunnel interfaces and in the policy route adding the ip of the remote end as gateway, but is there a way to have both routes (BGP,Static) active in the routing table?

Thanks

[ede_pfau]

there's nothing like a [strike]free lunch[/strike] dumb question.

If I see this correctly you do have both routes in the routing table at the same time. That's because both have the same distance. If you want to have one preferred over the other, change it's priority. In FortiOS, "priority" == "cost", so a route with higher priority will be used less.

[snakething]

Actually i want both routes active in the routing table.

When i create the static with the same distance as the BGP one, the static is active.

And was wondering if there is a way to have the BGP and static route active in the routing table.

[ede_pfau]

Both should be active actually, if both distances are identical. The keyword is ECMP here. In your case you would want all traffic follow the BGP route, and to have the static route in the table so that policy routing works for those source networks.

Thus, the priorities should differ, the lesser one on the BGP route.

[gradius85]

I thought BGP only influences return traffic from the ISP, and you still use a static route with different metrics to select the best route at the time.

[Toshi_Esumi]

Based on the fact you showed in the "database", setting distance doesn't seem to be enough to show both in the routing table. Probably FGT is picking up the static route over the BGP route with the same distance.

I think you have to set two static routes to both tunnel0 and lan (with the GW for this side) with the same distance.

But policy routes should work, as you're experiencing, as long as both are in the database. I'm not 100% sure though because I haven't tested it myself. But appear to be right based on what you described.

[snakething]

Yes this is exactly what is happening , the FGT is picking up the static over the bgp route though they have the same distance.

Unfortunately i have to use the BGP route for the rest of the traffic due to diversity of the network and not go with static.

Any ideas why this might be happening cause in the docs its pretty straight forward that ay route sharing the same distance should be present in the table.

Thanks

[Toshi_Esumi]

I think because of the design of BGP routing decision even before RIB route decision. I don't think this part is defined in RFCs so differ between vendors/implementations. One thing I can suggest, which worked for our similar case, is composing a route map to match default route only. Then filter it out when the static route is redistributed into BGP (under "config redistribute static"). BGP doesn't even consider its own BGP route (our/your case is 0/0) relevant if the same "static" route comes in via redistribution. Then it wouldn't send its BGP route as a candidate for RIB routing table decision. Omitting importing the static route into BGP might fix it.

It's a little counter intuitive but it worked for out case we wanted a BGP route to win over a static one.

[Toshi_Esumi]

Actually my theory wouldn't apply to your case. Because in your case the BGP route is in the RIB database already. I think you need to open a ticket with TAC.

[snakething]

Hi,

I think this is what is happening:

ECMP is supported for OSPF and static routing. ECMP only works for routes that are sourced by the same routing protocol (i.e. Static routes or OSPF).

http://kb.fortinet.com/kb/viewAttachment.do?attachID=ECMP%20and%20Asymmetric%20Return%20Path%20Case%...