bgp and policies

[fortinetuser2020]

hi. i've read this article

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example

and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous?

why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?

[Toshi_Esumi]

I don't think this network example is realistic. It seems to be assuming the "internal" network is reachable/routable from the internet, but since NAT is configure on both directions it's not really routing through the FGT. If the internal network is a public subnet, you of course need policies for both-ways but without NAT.

I would blame the tech writer at FTNT.

[fortinetuser2020]

thank you. so 2 questions about that :

1. do i even need incoming policies for bgp? isn't that a core service not requiring any specific policies?

2. the article also states to setup default static routes. am i not supposed to get those routes via bgp? or the static route is needed to let the fortigate know "where to start from" to get other routes?

[Toshi_Esumi]

If it's the FGT terminating BGP, not passing it to internal routers, and if it's a single VDOM environment, no needs for a policy. But if it's passing BGP through like root vdom to another internal vdom handling BGP or other devices a set of policies need to allow it from ingress interface to egress interface.

If you get full internet routes or partial routes from your neighboring ISP, there is no default route in the routes you receive. The ISP might advertise only default route without other routers. That's depending on the BGP service you get from the ISPs. If you don't get default routes, you might need it internally like static default routes.

[fortinetuser2020]

ok. so in a classic non vdom scenario, i should ask the ISP what routes they'll give me to know if i need static route or not?

[Toshi_Esumi · Accepted solution]

Just tell we have our own ASN and subnets to advertise and want to get just a default route from them.

[fortinetuser2020]

thank you :)

[fortinetuser2020]

another question please

let's say i have 2 remote sites using bgp

under each site i have multiple ip pools

how can i state that site 1 is now utilizing pool 1, and site 2 is utilizing pool 2? while of course each site should be the 2nd priority for the other in case of it's down.

[Yurisk]

IF we talk BGP-only then: 

- You can use Local Preference per received route, this way the same pool will be accepted from both sites, but only the one with higher LocalPref will be installed in RIB

- You can supernet and then divide the pools ןכ they are continuous, say pool1 10.10.10.0/25 and pool2 10.10.10.129/25 then you can advertise from both sites their respective /25 pools BUT also from each site supernet 10.10.10.0/24

[fortinetuser2020]

ok

but local preference will affect the isp's route?

if i have fgt1 on site1 and fgt2 on site2, both of them are unrelated to eachother

and i set a local preference of that route, will it "reflect" on the isp side?