Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • SD-WAN / SD-Branch Architecture for MSSPs

    Home FortiGate / FortiOS 7.4.0 SD-WAN / SD-Branch Architecture for MSSPs
    7.4.0
    7.4.0
    7.2.0
    7.0.0
    6.4.0

    BGP on loopback

    BGP on loopback

    As we have already mentioned, our overlay routing design is called BGP on Loopback.

    • Every Spoke establishes a single IBGP session towards each of the Hubs serving its region.

    • This IBGP session is terminated on the loopback interface, which uniquely identifies each SD-WAN node (Hub and Spoke).

    • The Spoke advertises its LAN prefix(es) over this single IBGP session per Hub.

    The following diagram illustrates a LAN prefix 10.0.2.0/24, which is advertised by a Spoke “site1-2” to its Hub “site1-H1”:

    • As can be seen, a single BGP route is generated for each prefix (in our example: 10.0.2.0/24).

    • BGP next-hop (NH) is the loopback IP of the originating Spoke (in our example: 10.200.1.2).

    • In a Dual-Hub region, a copy of this route is advertised to each Hub.

    To fully understand how this route is resolved, we must elaborate on a proprietary extension that has been implemented to support this design. See IKE extension: exchange-ip-addrv4.

    Previous
    Next

    BGP on loopback

    BGP on loopback

    As we have already mentioned, our overlay routing design is called BGP on Loopback.

    • Every Spoke establishes a single IBGP session towards each of the Hubs serving its region.

    • This IBGP session is terminated on the loopback interface, which uniquely identifies each SD-WAN node (Hub and Spoke).

    • The Spoke advertises its LAN prefix(es) over this single IBGP session per Hub.

    The following diagram illustrates a LAN prefix 10.0.2.0/24, which is advertised by a Spoke “site1-2” to its Hub “site1-H1”:

    • As can be seen, a single BGP route is generated for each prefix (in our example: 10.0.2.0/24).

    • BGP next-hop (NH) is the loopback IP of the originating Spoke (in our example: 10.200.1.2).

    • In a Dual-Hub region, a copy of this route is advertised to each Hub.

    To fully understand how this route is resolved, we must elaborate on a proprietary extension that has been implemented to support this design. See IKE extension: exchange-ip-addrv4.

    Previous
    Next