Configuring the FortiGate unit - BGP
The only change from the standard BGP configuration for this example is configuring the blocking Peer 1’s routes from being advertised to Peer 2. From the network topology you can guess that both of these peers likely share many routes in common and it makes no sense to advertise unneeded routes.
Blocking Peer 1’s routes to Peer 2 is done with distribute-list-out keyword. They allow you to select which routes you will advertise to a neighbor using an access list. In this case we will block all incoming routes from Peer 1 when we send updates to Peer 2. Otherwise Peer 1 and Peer 2 are regular neighbors.
The FortiGate unit will redistribute routes learned from OSPF into BGP.
This is advanced configuration and the commands are only available in the CLI.
To create access list to block Peer 1 - CLI
config access-list
edit “block_peer1”
config rule
edit 1
set prefix 172.21.111.0 255.255.255.0
set action deny
set exact-match enable
end
end
end
To configure BGP on the FortiGate unit - CLI
config router bgp
set as 65001
set router-id 10.11.201.110
config redistribute ospf
set status enable
end
config neighbor
edit 172.22.222.5
set remote-as 65001
set distribute-list-out “block_peer1”
next
edit 172.21.111.5
set remote-as 65001
end
end