Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fortinetuser2020
New Contributor

bgp and policies

hi. i've read this article

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example

 

and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous?

 

why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?

1 Solution
Toshi_Esumi
Esteemed Contributor III

Just tell we have our own ASN and subnets to advertise and want to get just a default route from them.

View solution in original post

17 REPLIES 17
Toshi_Esumi
Esteemed Contributor III

I don't think this network example is realistic. It seems to be assuming the "internal" network is reachable/routable from the internet, but since NAT is configure on both directions it's not really routing through the FGT. If the internal network is a public subnet, you of course need policies for both-ways but without NAT.

I would blame the tech writer at FTNT.

fortinetuser2020

thank you. so 2 questions about that :

 

1. do i even need incoming policies for bgp? isn't that a core service not requiring any specific policies?

2. the article also states to setup default static routes. am i not supposed to get those routes via bgp? or the static route is needed to let the fortigate know "where to start from" to get other routes?

Toshi_Esumi
Esteemed Contributor III

If it's the FGT terminating BGP, not passing it to internal routers, and if it's a single VDOM environment, no needs for a policy. But if it's passing BGP through like root vdom to another internal vdom handling BGP or other devices a set of policies need to allow it from ingress interface to egress interface.

 

If you get full internet routes or partial routes from your neighboring ISP, there is no default route in the routes you receive. The ISP might advertise only default route without other routers. That's depending on the BGP service you get from the ISPs. If you don't get default routes, you might need it internally like static default routes.

fortinetuser2020

ok. so in a classic non vdom scenario, i should ask the ISP what routes they'll give me to know if i need static route or not?

Toshi_Esumi
Esteemed Contributor III

Just tell we have our own ASN and subnets to advertise and want to get just a default route from them.

fortinetuser2020

thank you :)

fortinetuser2020

another question please

let's say i have 2 remote sites using bgp

under each site i have multiple ip pools

how can i state that site 1 is now utilizing pool 1, and site 2 is utilizing pool 2? while of course each site should be the 2nd priority for the other in case of it's down.

Yurisk

IF we talk BGP-only then: 

- You can use Local Preference per received route, this way the same pool will be accepted from both sites, but only the one with higher LocalPref will be installed in RIB

- You can supernet and then divide the pools ןכ they are continuous, say pool1 10.10.10.0/25 and pool2 10.10.10.129/25 then you can advertise from both sites their respective /25 pools BUT also from each site supernet 10.10.10.0/24

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
fortinetuser2020

ok

but local preference will affect the isp's route?

if i have fgt1 on site1 and fgt2 on site2, both of them are unrelated to eachother

and i set a local preference of that route, will it "reflect" on the isp side? 

Labels
Top Kudoed Authors