Static vs iBGP distance

[Poseidonn]

Hello,

In a situation with sd-wan with a static route for a zone and via iBGP I receive the same prefix for another zone, even changing the administrative distance of the static route to the same as iBGP, the static prevails.

Anything other than administrative distance to consider?

Thanks

[Poseidonn]

I know the topic is administrative distance, I put the routing table database in another post.

Thanks

[dingjerry_FTNT]

Hi @Poseidonn ,

Can you run the following?

get router info routing-table details x.x.x.x

x.x.x.x is the routing entry for the network in this issue.

[Poseidonn]

My database

Routing table for VRF=0
S *> 0.0.0.0/0 [200/0] via x.x.x.x, wan2, [1/0]
    *> [200/0] via x.x.x.x, wan1, [1/0]
B 0.0.0.0/0 [200/0] via x.x.x.x (recursive via HUB1VPN1 tunnel x.x.x.x), 00:02:19
                                               (recursive via HUB1VPN2 tunnel x.x.x.x), 00:02:19, [1/0]
                  [200/0] via x.x.x.x (recursive via HUB2VPN1 tunnel x.x.x.x), 00:02:19
                                              (recursive via HUB2VPN2 tunnel x.x.x.x), 00:02:19, [1/0]

Thanks

[Toshi_Esumi]

I tested it with 7.4.6. And looks like a newer route seems to be preferred.

When eBGP route for 10.0.9.0/29 preexists, I put in the same static route with AD 20. Then got below, overriden by the static route:

FortiGate-60F # get router info routing-t detail 10.0.9.0

Routing table for VRF=0
Routing entry for 10.0.9.0/29
  Known via "static", distance 20, metric 0, best
  * vrf 0 x.x.x.x, via wan1

Routing entry for 10.0.9.0/29
  Known via "bgp", distance 20, metric 0
  Last update 07:06:01 ago
    vrf 0 10.245.254.225 priority 1 (recursive via ny-corp tunnel x.x.x.x)

However, when I dropped the eBGP once then reintroduced it again, I got below, overriden by the eBGP route:

FortiGate-60F # get router info routing-t detail 10.0.9.0

Routing table for VRF=0
Routing entry for 10.0.9.0/29
  Known via "bgp", distance 20, metric 0, best
  Last update 00:03:24 ago
  * vrf 0 10.245.254.225 priority 1 (recursive via ny-corp tunnel x.x.x.x)

Routing entry for 10.0.9.0/29
  Known via "static", distance 20, metric 0
    vrf 0 x.x.x.x, via wan1

So, if you want the FGT to prefer iBGP route, try setting AD for the static route higher than 200, like 201.

Toshi

[Poseidonn]

Yes, if I change it to a smaller distance, it works.

I would like to have static iBGP prefixes with the same distance, then in the SD-WAN rules I validate which VLAN makes a local breakout (static route) and which ones don't (iBGP route).

Thanks

[dingjerry_FTNT]

Hi @Toshi_Esumi ,

Can you show the outputs of "get router info routing-table all"?  

You may just show the lines with the 10.0.9.0/29 network entry.

@Poseidonn ,

You may show the same thing.

[Poseidonn]

Hi,

I will only see static.

S* 0.0.0.0/0 [200/0] via x.x.x.x, wan2, [1/0]
                    [200/0] via x.x.x.x, wan1, [1/0]

Regards,

[Toshi_Esumi]

No. I can't reveal all our company routes to public and it's not realistic since there are easily more than 100 routes. Besides, you can easily recreate that with just two FGTs.

But OP's situation is just for default routes. I would suggest just use three static default routes to those. I don't see any reason to use iBGP default routes for SD-WAN's base default routes since all routes can be manupulated by SD-WAN anyway.

Toshi

[Toshi_Esumi]

Ok, this is for 10.0.9/29 part for both situations:
[when the static route was best]
S 10.0.9.0/29 [20/0] via x.x.x.x, wan1, [1/0]
[when eBGP route was best]
B 10.0.9.0/29 [20/0] via 10.245.254.225 (recursive via ny-corp tunnel x.x.x.x), 01:03:30, [1/0]

Toshi