bgp and policies

[fortinetuser2020]

hi. i've read this article

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example

and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous?

why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?

[Yurisk]

If you set LocalPref without distinction for the routes - yes, it will affect all routes, ISP's as well. 

But if you do route-map on incoming ads, and modify LocalPref just for the remote site subnets, it will leave ISP routes as is.

I mean for incoming advertisements insid ethe same AS, ISP having different AS (eBGP) will ignore LcoalPref settings from your side.

[fortinetuser2020]

Yes. in my case it's only wan advertisement. 

so when you say "If you set LocalPref without distinction for the routes "

what do you mean without distinction? 

[Yurisk]

If it is only WAN deployment, then forget the LocalPref - the only option is to use supernetting/more specific advertisements. Unless both sites are connected to the same ISP, then potentially you could have arrangements with them and more options. 

[fortinetuser2020]

yes, it's the same isp

[fortinetuser2020]

so in such a case where i have the same isp

lets say fgt1 has public ip of 1.1.1.1

and fg2 has public ip of 2.2.2.2

and now i have a routed pool of 3.3.3.3/29

is there a way for me to set a preference that in a normal mode this pool is advertised in fgt1 and in case of a failure it's advertised in fgt2?

[Yurisk]

If you have cooperation of ISP you can ask them to set higher Local Preference for the routed net 3.3.3.3/29  received from fgt1, and leave LocalPref default on routes received by ISP from fgt2. Both FGs will advertise 3.3.3.3/29 but Local Preference will make sure fgt1 is preferred.

If you don't have ISP cooperation, your only choice is prepending few times at fgt2 your AS number before advertising 3.3.3.3/29 to the ISP.  This way, a client on the Internet will see 3.3.3.3/29 advertised from both fgt1 and fgt2, but length of AS path via fgt2 will be longer due to prepends, and HOPEFULLY, the client/ISP on the internet will choose fgt1. 

[fortinetuser2020]

thank you. so my best choice is to get the isp's cooperation and get them to set the preference at their side

[Yurisk]

Yes, indeed, only ISP can make sure it works as you want to.