Helpful ReplyHot!bgp and policies

Author
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
2020/07/10 09:30:55 (permalink)
0

bgp and policies

hi. i've read this article
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example
 
and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous?
 
why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?
#1
Toshi Esumi
Expert Member
  • Total Posts : 2241
  • Scores: 215
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: online
Re: bgp and policies 2020/07/10 14:42:54 (permalink)
0
I don't think this network example is realistic. It seems to be assuming the "internal" network is reachable/routable from the internet, but since NAT is configure on both directions it's not really routing through the FGT. If the internal network is a public subnet, you of course need policies for both-ways but without NAT.
I would blame the tech writer at FTNT.
#2
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/07/11 03:46:47 (permalink)
0
thank you. so 2 questions about that :
 
1. do i even need incoming policies for bgp? isn't that a core service not requiring any specific policies?
2. the article also states to setup default static routes. am i not supposed to get those routes via bgp? or the static route is needed to let the fortigate know "where to start from" to get other routes?
#3
Toshi Esumi
Expert Member
  • Total Posts : 2241
  • Scores: 215
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: online
Re: bgp and policies 2020/07/11 08:46:04 (permalink)
0
If it's the FGT terminating BGP, not passing it to internal routers, and if it's a single VDOM environment, no needs for a policy. But if it's passing BGP through like root vdom to another internal vdom handling BGP or other devices a set of policies need to allow it from ingress interface to egress interface.
 
If you get full internet routes or partial routes from your neighboring ISP, there is no default route in the routes you receive. The ISP might advertise only default route without other routers. That's depending on the BGP service you get from the ISPs. If you don't get default routes, you might need it internally like static default routes.
#4
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/07/11 23:14:14 (permalink)
0
ok. so in a classic non vdom scenario, i should ask the ISP what routes they'll give me to know if i need static route or not?
#5
Toshi Esumi
Expert Member
  • Total Posts : 2241
  • Scores: 215
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: online
Re: bgp and policies 2020/07/12 09:18:34 (permalink) ☄ Helpfulby fortinetuser2020 2020/08/05 02:05:58
0
Just tell we have our own ASN and subnets to advertise and want to get just a default route from them.
#6
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/08/05 02:06:01 (permalink)
0
thank you :)
#7
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/08/17 02:23:37 (permalink)
0
another question please
let's say i have 2 remote sites using bgp
under each site i have multiple ip pools
how can i state that site 1 is now utilizing pool 1, and site 2 is utilizing pool 2? while of course each site should be the 2nd priority for the other in case of it's down.
#8
Yurisk
Silver Member
  • Total Posts : 100
  • Scores: 22
  • Reward points: 0
  • Joined: 2011/12/04 03:30:01
  • Status: offline
Re: bgp and policies 2020/08/17 02:35:07 (permalink)
0
IF we talk BGP-only then: 
- You can use Local Preference per received route, this way the same pool will be accepted from both sites, but only the one with higher LocalPref will be installed in RIB
- You can supernet and then divide the pools ןכ they are continuous, say pool1 10.10.10.0/25 and pool2 10.10.10.129/25 then you can advertise from both sites their respective /25 pools BUT also from each site supernet 10.10.10.0/24
 
#9
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/08/17 02:45:56 (permalink)
0
ok
but local preference will affect the isp's route?
if i have fgt1 on site1 and fgt2 on site2, both of them are unrelated to eachother
and i set a local preference of that route, will it "reflect" on the isp side? 
#10
Yurisk
Silver Member
  • Total Posts : 100
  • Scores: 22
  • Reward points: 0
  • Joined: 2011/12/04 03:30:01
  • Status: offline
Re: bgp and policies 2020/08/17 02:56:08 (permalink)
0
If you set LocalPref without distinction for the routes - yes, it will affect all routes, ISP's as well. 
But if you do route-map on incoming ads, and modify LocalPref just for the remote site subnets, it will leave ISP routes as is.
I mean for incoming advertisements insid ethe same AS, ISP having different AS (eBGP) will ignore LcoalPref settings from your side.
 
 
#11
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/08/17 03:02:07 (permalink)
0
Yes. in my case it's only wan advertisement. 
 
so when you say "If you set LocalPref without distinction for the routes "
what do you mean without distinction? 
#12
Yurisk
Silver Member
  • Total Posts : 100
  • Scores: 22
  • Reward points: 0
  • Joined: 2011/12/04 03:30:01
  • Status: offline
Re: bgp and policies 2020/08/17 03:23:49 (permalink)
0
If it is only WAN deployment, then forget the LocalPref - the only option is to use supernetting/more specific advertisements. Unless both sites are connected to the same ISP, then potentially you could have arrangements with them and more options. 
#13
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/08/17 03:43:19 (permalink)
0
yes, it's the same isp
#14
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/08/17 05:52:14 (permalink)
0
so in such a case where i have the same isp
lets say fgt1 has public ip of 1.1.1.1
and fg2 has public ip of 2.2.2.2
 
and now i have a routed pool of 3.3.3.3/29
is there a way for me to set a preference that in a normal mode this pool is advertised in fgt1 and in case of a failure it's advertised in fgt2?
#15
Yurisk
Silver Member
  • Total Posts : 100
  • Scores: 22
  • Reward points: 0
  • Joined: 2011/12/04 03:30:01
  • Status: offline
Re: bgp and policies 2020/08/17 11:01:34 (permalink)
0
If you have cooperation of ISP you can ask them to set higher Local Preference for the routed net 3.3.3.3/29  received from fgt1, and leave LocalPref default on routes received by ISP from fgt2. Both FGs will advertise 3.3.3.3/29 but Local Preference will make sure fgt1 is preferred.
 
If you don't have ISP cooperation, your only choice is prepending few times at fgt2 your AS number before advertising 3.3.3.3/29 to the ISP.  This way, a client on the Internet will see 3.3.3.3/29 advertised from both fgt1 and fgt2, but length of AS path via fgt2 will be longer due to prepends, and HOPEFULLY, the client/ISP on the internet will choose fgt1. 
#16
fortinetuser2020
Bronze Member
  • Total Posts : 46
  • Scores: -1
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: bgp and policies 2020/08/17 23:35:55 (permalink)
0
thank you. so my best choice is to get the isp's cooperation and get them to set the preference at their side
#17
Yurisk
Silver Member
  • Total Posts : 100
  • Scores: 22
  • Reward points: 0
  • Joined: 2011/12/04 03:30:01
  • Status: offline
Re: bgp and policies 2020/08/18 08:20:49 (permalink)
0
Yes, indeed, only ISP can make sure it works as you want to.
 
#18
Jump to:
© 2020 APG vNext Commercial Version 5.5