FortinetConfig512 downloads

Fortinet FortiGate BGP Configuration

BGP routing configuration for FortiGate: eBGP and iBGP peers, route-maps, prefix lists, redistribution, and community settings via FortiOS CLI.

↓ example.txt

What is it?

FortiGate BGP runs within the 'config router bgp' block and supports eBGP and iBGP peering, route redistribution, and import/export route maps. FortiGate is commonly deployed as a dual-ISP edge firewall using eBGP to receive default routes (or full tables) from two ISPs, with SD-WAN health checks selecting the active path. FortiOS BGP supports MD5 authentication, graceful restart, and BFD for fast failure detection. Route policies use FortiGate route-maps and prefix-lists for filtering.

When to use

·Dual-ISP deployments where ISP peering with BGP provides failover and traffic engineering
·Data center deployments where FortiGate peers with spine switches for routing
·SD-WAN underlay where BGP dynamically advertises WAN prefixes
·Receiving a default route from ISP via BGP instead of static (enables ISP-side failover)

When NOT to use

·Single-ISP environments — a static default route is simpler and more stable
·Internal routing only — use OSPF inside your network; BGP for ISP/external peering

How it compares

vs Palo Alto BGPBoth run BGP inside a virtual router. FortiGate integrates BGP more tightly with SD-WAN health checks for automatic path selection. Palo Alto's BGP has more granular filtering via route-map equivalents.

vs Cisco IOS BGPSame BGP protocol, different syntax. IOS uses 'router bgp <as>' with 'neighbor' commands. FortiOS uses structured 'config neighbor' blocks. IOS has more mature BGP features (RPKI, route reflectors).

Prerequisites

→WAN interface IP must be reachable by the ISP peer (TCP 179)
→AS number obtained from ISP for eBGP peering, or private AS (64512-65534) for iBGP
→Route-maps and prefix-lists created before referencing them in neighbor config
→Ensure firewall policy allows TCP 179 between the BGP peering IPs

Config Generator

Hostname *

Local AS *

Router ID *

Graceful restart?

BGP Neighbors

Networks to Advertise

Redistribute connected?

Redistribute static?

Verification commands

get router info bgp summary

Show BGP peer status and prefix counts

ExpectedPeers show 'Established' state with non-zero MsgRcvd/MsgSent. 'Active' or 'Connect' means peering is not up.

get router info routing-table bgp

Show BGP routes installed in the routing table

ExpectedLists BGP routes with 'B' prefix, next-hop, and metric. Missing routes indicate filtering.

get router info bgp neighbors <peer-ip> received-routes

Show all routes received from a specific BGP peer

ExpectedLists all prefixes the peer is advertising. If empty, peer is not sending any routes.

Debug commands

diagnose ip router bgp level info

Enable BGP debug logging

WarningUse with caution. Disable after: 'diagnose ip router bgp level none'

Common mistakes & fixes

SymptomBGP peer stuck in 'Active' or 'Connect'

CauseTCP 179 blocked by firewall policy, wrong peer IP, or interface IP mismatch

FixVerify firewall policy allows TCP 179 between peer IPs. Check 'get router info bgp neighbors' for error details.

SymptomBGP established but default route not installed

CauseISP advertising default route but local prefix-list filtering it out

FixCheck 'get router info bgp neighbors <ip> received-routes'. If default is there but not in routing table, an import route-map is filtering it.

SymptomAsymmetric routing — traffic takes different path than expected

CauseBoth ISP BGP sessions up with equal preference, OS doing ECMP or per-flow hashing

FixUse local-preference to prefer one ISP for outbound, MED or AS-path prepending to influence inbound. Or use SD-WAN with health checks for automatic failover.

Further learning

Recommended books to go deeper on this topic.

BGP Design and Implementation

Randy Zhang & Micah Bartell · Cisco Press · The practical BGP bible — iBGP, eBGP, policies, communities, design patterns

Kindle ↗Hardcover ↗Paperback ↗

Internet Routing Architectures

Sam Halabi · Cisco Press · BGP for ISPs and large enterprise — AS path, route reflectors, confederation

Hardcover ↗