hi. i've read this article
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example
and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous?
why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Just tell we have our own ASN and subnets to advertise and want to get just a default route from them.
If you set LocalPref without distinction for the routes - yes, it will affect all routes, ISP's as well.
But if you do route-map on incoming ads, and modify LocalPref just for the remote site subnets, it will leave ISP routes as is.
I mean for incoming advertisements insid ethe same AS, ISP having different AS (eBGP) will ignore LcoalPref settings from your side.
Yes. in my case it's only wan advertisement.
so when you say "If you set LocalPref without distinction for the routes "
what do you mean without distinction?
If it is only WAN deployment, then forget the LocalPref - the only option is to use supernetting/more specific advertisements. Unless both sites are connected to the same ISP, then potentially you could have arrangements with them and more options.
yes, it's the same isp
so in such a case where i have the same isp
lets say fgt1 has public ip of 1.1.1.1
and fg2 has public ip of 2.2.2.2
and now i have a routed pool of 3.3.3.3/29
is there a way for me to set a preference that in a normal mode this pool is advertised in fgt1 and in case of a failure it's advertised in fgt2?
If you have cooperation of ISP you can ask them to set higher Local Preference for the routed net 3.3.3.3/29 received from fgt1, and leave LocalPref default on routes received by ISP from fgt2. Both FGs will advertise 3.3.3.3/29 but Local Preference will make sure fgt1 is preferred.
If you don't have ISP cooperation, your only choice is prepending few times at fgt2 your AS number before advertising 3.3.3.3/29 to the ISP. This way, a client on the Internet will see 3.3.3.3/29 advertised from both fgt1 and fgt2, but length of AS path via fgt2 will be longer due to prepends, and HOPEFULLY, the client/ISP on the internet will choose fgt1.
thank you. so my best choice is to get the isp's cooperation and get them to set the preference at their side
Yes, indeed, only ISP can make sure it works as you want to.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.