Tag Archives: default route

Fortigate – filtering inbound BGP routes from neighbors, including Default

The other night I had need to stop receiving a default route advertised from my BGP peer. I  also thought it would be helpful for anyone that is needing to do this – and to help myself, since I forget often, to write it up.

First thing we need to do is create a Prefix list to either allow or deny the routes we want. In this case I want to filter out the default route that is being propagated to me.

config router prefix-list

prefix.

The things to note, rule 10 – I match that route exact (default). then in rule 100 I allow any other prefix – hence the “le 32”. that means anything that starts from 0.0.0.0/0-32 and since the 0/0 is blocked already in policy 10- everything else is allowed.

The we need to create our Route map to allow these routes on our in bound direction

config router route-map

Route-map

Then lets apply the route-map to our peer.

config router bgp

bgp

After applying the route-map to the inbound direction we need to clear BGP either soft, or full to make our routing changes take effect.

Run this command to check the BGP advertisements for changes, and synchronize after that.

exe router clear bgp all in soft, or clear both directions (softly) with exe router clear bgp all soft

That should do it, and you will see the default route disappear from the routes learned from your peer. You can also do this to filter routes to any destination network.

 

 

 

Fortigate – How to create a default route with a dynamic connection.

Recently I needed to make sure select traffic would flow over a certain ISP link. Unfortunately that link had a dynamic address, which meant the address and gateway of that route could change anytime. Also I wanted to have my primary ISP failover to this link if needed.

To accomplish these things I needed to have both default routes in my routing table at the same time. This means that they both have the same distance, but different priorities. One way to accomplish this is to configure a static default route, and just change the priority of the link , but how can you do this when you do not know the gateway?

You can create a dynamic-gateway static route in the Fortigate.

dynamic-route

Through CLI you can create a dynamic gateway route using the above syntax.  Remember, the higher the priority the less preferable the route.

You can also create basically the same thing under the interface of the WAN link by using the distance, and priority interface commands listed below:

cin-interface

So now if we check our route monitor:

cin-routes

We have both default routes, and can successfully use a policy based route to push the needed traffic out.

Linux network interface perference

Sometimes you have multiple nics on a Linux host and need to have one be a backup for anything other than its own subnet. Lets say both these nics have default routes and we need to go out of eth0 by default. There are multiple ways to do this.

One was is to modify the interface config and add a Metric. A lower metric is more preferable.

The command would be:

vi /etc/networking/interfaces

or

vi /etc/networking/eth0

then add

METRIC 1 (0 is highest, 1 would make it very prefreable)

save the file, then restart networking:

/etc/init.d/network restart

Another way is to use the command ifmetric command to set the metric of the route.

ifmetric INTERFACE [METRIC]

Using the ifmetric I do belive does not set it permenatly.