Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fortinetuser2020
New Contributor

bgp and policies

hi. i've read this article

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example

 

and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous?

 

why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?

1 Solution
Toshi_Esumi

Just tell we have our own ASN and subnets to advertise and want to get just a default route from them.

View solution in original post

17 REPLIES 17
Yurisk

If you set LocalPref without distinction for the routes - yes, it will affect all routes, ISP's as well. 

But if you do route-map on incoming ads, and modify LocalPref just for the remote site subnets, it will leave ISP routes as is.

I mean for incoming advertisements insid ethe same AS, ISP having different AS (eBGP) will ignore LcoalPref settings from your side.

 

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
fortinetuser2020

Yes. in my case it's only wan advertisement. 

 

so when you say "If you set LocalPref without distinction for the routes "

what do you mean without distinction? 

Yurisk

If it is only WAN deployment, then forget the LocalPref - the only option is to use supernetting/more specific advertisements. Unless both sites are connected to the same ISP, then potentially you could have arrangements with them and more options. 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
fortinetuser2020

yes, it's the same isp

fortinetuser2020

so in such a case where i have the same isp

lets say fgt1 has public ip of 1.1.1.1

and fg2 has public ip of 2.2.2.2

 

and now i have a routed pool of 3.3.3.3/29

is there a way for me to set a preference that in a normal mode this pool is advertised in fgt1 and in case of a failure it's advertised in fgt2?

Yurisk

If you have cooperation of ISP you can ask them to set higher Local Preference for the routed net 3.3.3.3/29  received from fgt1, and leave LocalPref default on routes received by ISP from fgt2. Both FGs will advertise 3.3.3.3/29 but Local Preference will make sure fgt1 is preferred.

 

If you don't have ISP cooperation, your only choice is prepending few times at fgt2 your AS number before advertising 3.3.3.3/29 to the ISP.  This way, a client on the Internet will see 3.3.3.3/29 advertised from both fgt1 and fgt2, but length of AS path via fgt2 will be longer due to prepends, and HOPEFULLY, the client/ISP on the internet will choose fgt1. 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
fortinetuser2020

thank you. so my best choice is to get the isp's cooperation and get them to set the preference at their side

Yurisk

Yes, indeed, only ISP can make sure it works as you want to.

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors