Defining a preferred source IP for local-out egress interfaces on BGP routes

The preferred source IP can be configured on BGP routes so that local-out traffic is sourced from that IP. In the following example, a route map is configured to set the preferred source IP so that the BGP route can support the preferred source.

To configure preferred source IPs for BGP routing:

1. Configure the route maps:

   config router route-map
       edit "map1"
           config rule
               edit 1
                   set set-ip-prefsrc 1.1.1.1
               next
           end
       next
       edit "map2"
           config rule
               edit 1
                   set set-ip-prefsrc 1.1.1.2
               next
           end
       next
   end

2. Configure the BGP settings:

   config router bgp
       set as 65412
       set router-id 1.1.1.1
       set ibgp-multipath enable
       set cluster-id 1.1.1.1
       set graceful-restart enable
       config aggregate-address
           edit 1
               set prefix 172.28.0.0 255.255.0.0
               set as-set enable
               set summary-only enable
           next
       end
       config neighbor
           edit "3.3.3.3"
               set capability-graceful-restart enable
               set soft-reconfiguration enable
               set prefix-list-out "local-out"
               set remote-as 65412
               set route-map-in "map2"
               set route-map-out "as-prepend"
               set keep-alive-timer 30
               set holdtime-timer 90
               set update-source "loopback1"
               set route-reflector-client enable
           next
           edit "2.2.2.2"
               set advertisement-interval 5
               set activate6 disable
               set capability-graceful-restart enable
               set soft-reconfiguration enable
               set distribute-list-out "local-out-FGTB-deny"
               set remote-as 65412
               set route-map-in "map1"
               set route-map-out "as-rewrite"
               set keep-alive-timer 30
               set holdtime-timer 90
               set update-source "loopback1"
           next
       end
   end

To verify the configuration:

1. Verify the BGP routing table for 172.25.1.0/24:

   # get router info bgp network 172.25.1.0/24
   VRF 0 BGP routing table entry for 172.25.1.0/24
   Paths: (1 available, best #1, table Default-IP-Routing-Table)
     Not advertised to any peer
     Original VRF 0
     Local
       2.2.2.2 (metric 10050) from 2.2.2.2 (2.2.2.2)
         Origin IGP metric 0, localpref 100, valid, internal, best, prefsrc 1.1.1.1
         Last update: Wed Jan 25 15:15:48 2023

2. Verify the BGP routing table for 172.28.5.0/24:

   # get router info bgp network 172.28.5.0/24
   VRF 0 BGP routing table entry for 172.28.5.0/24
   Paths: (1 available, best #1, table Default-IP-Routing-Table, Advertisements suppressed by an aggregate.)
     Not advertised to any peer
     Original VRF 0
     65050, (Received from a RR-client)
       3.3.3.3 (metric 11000) from 3.3.3.3 (3.3.3.3)
         Origin IGP metric 0, localpref 100, valid, internal, best, prefsrc 1.1.1.2
         Last update: Wed Jan 25 15:15:48 2023

3. Verify the kernel routing table for 172.28.5.0/24:

   # get router info kernel | grep -B 2 172.28.5.0/24
   tab=254 vf=0 scope=0 type=1 proto=11 prio=1 0.0.0.0/0.0.0.0/0->172.28.1.0/24 pref=1.1.1.2 gwy=172.16.200.4 dev=9(port1)
   tab=254 vf=0 scope=0 type=1 proto=11 prio=1 0.0.0.0/0.0.0.0/0->172.28.2.0/24 pref=1.1.1.2 gwy=172.16.200.4 dev=9(port1)
   tab=254 vf=0 scope=0 type=1 proto=11 prio=1 0.0.0.0/0.0.0.0/0->172.28.5.0/24 pref=1.1.1.2 gwy=172.16.200.4 dev=9(port1)

4. Verify the kernel routing table for 172.25.1.0/24:

   # get router info kernel | grep -A 2 172.25.1.0/24
   tab=254 vf=0 scope=0 type=1 proto=11 prio=1 0.0.0.0/0.0.0.0/0->172.25.1.0/24 pref=1.1.1.1 gwy=172.16.203.2 dev=33(agg1)
   tab=254 vf=0 scope=0 type=1 proto=11 prio=1 0.0.0.0/0.0.0.0/0->172.26.1.0/24 pref=1.1.1.1 gwy=172.16.203.2 dev=33(agg1)
   tab=254 vf=0 scope=0 type=1 proto=11 prio=1 0.0.0.0/0.0.0.0/0->172.26.2.0/24 pref=1.1.1.1 gwy=172.16.203.2 dev=33(agg1)

   The FortiGate learns routes from router 3.3.3.3 and prefers the source IP of 1.1.1.2. It learns routes from router 2.2.2.2 and prefers source IP of 1.1.1.1.

5. Run a sniffer trace after some traffic passes.

   1. When trying to reach a destination in the 172.25.1.0/0 subnet through router 2.2.2.2:

      # diagnose sniffer packet any "icmp" 4
      interfaces=[any]
      filters=[icmp]
      9.244334 agg1 out 1.1.1.1 -> 172.25.1.2: icmp: echo request
      9.244337 port12 out 1.1.1.1 -> 172.25.1.2: icmp: echo request
      10.244355 agg1 out 1.1.1.1 -> 172.25.1.2: icmp: echo request
      10.244357 port12 out 1.1.1.1 -> 172.25.1.2: icmp: echo request

   2. When trying to reach a destination in the 172.28.5.0/24 subnet through router 3.3.3.3:

      # diagnose sniffer packet any "icmp" 4
      interfaces=[any]
      filters=[icmp]
      2.434035 port1 out 1.1.1.2 -> 172.28.5.2: icmp: echo request
      3.434059 port1 out 1.1.1.2 -> 172.28.5.2: icmp: echo request
      

   Traffic destined for the 172.25.1.0/24 subnet uses 1.1.1.1 as source. Traffic destined for the 172.28.5.0/24 subnet uses 1.1.1.2 as source.