SDWAN neighbor roles

[Unai_SecFnet]

Hi team,

I have recently found the neighbor roles feature in the sdwan configuration. I don't really understand the implication of primary and secondary configuration. 

Until now, I used parameters such as local preference to control BGP route announcements and receipts. Can I control 2 BGP sessions with both parameters? I explain myself, if one neighbor has the role secondary the BGP session is in "passive" mode until the primary BGP session fails. 

Thanks for teh help!

[AlexC-FTNT]

This feature is explained here:

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/638759/bgp-route-map-and-selective-r...

Traffic flows to the primary SD-WAN gateway, unless the link is outside of the SLA, or completely down. When that happens, traffic routes to the secondary gateway. So, in my understanding, the primary link is used until it fails. When this happens, the one configured as secondary comes up and negotiates the BGP neighborship.

[Unai_SecFnet]

Yes, I saw that document, but I don't understand at all which is the difference between configuring the role parameter or just not do it and declare both neighbors in the sdwan configuration piece and in the BGP configuration configuring the route-map-out-preferable.

[Toshi_Esumi]

I don't understand it either. The exmaple 1 says "The SD-WAN neighbor is configured to let BGP advertise different communities when the SLA status changes."

But the BGP neighbor config is for two different neighbors; 10.100.1.1 and 10.100.1.5. To accomplish what the problem statement says, "comm1" and "comm2" need to be configure on the SAME neighbor.

I think it's very poorly written, at least.

Toshi

[Unai_SecFnet]

Yes, I think so. Some features of Fortinet are hard to understand due to the lack of useful examples or explainations.

Does somebody control this feature?

Thanks for support_!

[awhit]

Not using it but I believe the idea behind this feature is to assist with controlling routes when you have two completely different devices (gateways) that are both up at any given time and are both possible entry points into the network. What if you want to forward to the second device only when the primary is completely down? Rather than path selection it is more of a device selection. Fortinet is working on features that allow SD-WAN to scale without a proliferation of specific steering rules you have to update every time you add a site, etc...and also without having unique health checks on both hub and spoke per site, so this I think is an attempt to provide a solution to the 2 separate entry points issue without adding rules.

Imagine your spoke connects up to two different gateways to your network. Both gateway firewalls have iBGP running on the back-side between them and depending on what community the remote spoke sends it you are updating local-preference for spoke routes inside your network. That allows you to draw your outbound traffic at the head end towards the edge device that has the best current path to the remote spoke.