Thursday, December 24, 2020

fortios bgp route-maps do not work 100% as configured for BGP

I've been studying a issue in a BGP update message that's sent from fortios 6.2.x to a juniper SRX./ What I 've noticed are the following;

1: one the configure map metric value  is being ignored 


2:  A new update message is sent at 1+min and it some how decreases the metric with no reason or logic why. Here's a snippet of an BGP_UPDATE message 5 min after the above screenshot was taken ;


3: So the configure route-map value are not being honored in the fortiOS configuration. At 1st I thought it had to be related to the origin-type but that is not the case , since EGP , IGP &  INC all behaves the same.

4: The value received in the UPDATE does not make any sense or follow a set pattern from my monitoring. And yes, I've been studying this behavior for 2+ years and across multiple fortiOS versions.






So it looks like I might have to re-engage fortinet support on why metric received are not matching the configured value and also why the metric are counting down or why they are sporadic in value from what is configured.



As the metric are being UPDATE the route-age is reset back to zero just a tip


With one of the peer shutdown, I 've still the same behavior where the fortios configured metric is not be honored.







The pcap where also done to show the decrement of the metric vrs the configured router-map.





More to come and  I hope FTNT support can identify this behavior and give a solid answer.









Ken Felix 

NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com
     ^      ^
=(  @  @ )=
         o

        /  \







No comments:

Post a Comment