How to Configure BGP on Fortinet Firewalls — Complete Step-by-Step Guide
Fortinet FortiGate | BGP Configuration Guide 2025
How to Configure BGP on Fortinet Firewalls — Complete Step-by-Step Guide
Master Border Gateway Protocol (BGP) configuration on FortiGate firewalls with CLI commands, best practices, and troubleshooting tips.
Expert Level ✦ www.thenetworkdna.com✍️ Network Engineering Team | 📅 Published: 2025 | 🕒 18-Min Read | 🔖 Fortinet · BGP · Routing · Firewall · FortiOS
📊 Article Snapshot
📋 Table of Contents
- What Is BGP and Why Use It on FortiGate?
- BGP Key Concepts & Terminology
- Network Topology & Lab Setup
- Enabling BGP on FortiGate — Basic Configuration
- Configuring BGP Neighbors (eBGP & iBGP)
- Advertising Networks via BGP
- BGP Route Filtering with Prefix Lists & Route Maps
- BGP Attributes & Path Manipulation
- BGP Authentication & Security Hardening
- Verifying & Troubleshooting BGP on FortiGate
- BGP Best Practices for Fortinet Firewalls
- BGP Troubleshooting Tips
- Frequently Asked Questions
- Final Summary
1. What Is BGP and Why Use It on FortiGate?
Border Gateway Protocol (BGP) is the routing protocol that powers the internet. It is a path-vector protocol used to exchange routing information between different autonomous systems (AS). BGP is the only Exterior Gateway Protocol (EGP) in use today and is also commonly deployed inside large enterprise networks as an Interior Gateway Protocol (iBGP).
Fortinet's FortiGate firewall platform provides robust, full-featured BGP support through FortiOS — enabling enterprise networks to connect to ISPs, build redundant WAN links, implement SD-WAN overlays, and participate in complex multi-site routing architectures.
🎯 Common Use Cases for BGP on FortiGate:
- Connecting to one or multiple ISPs (dual-homed or multi-homed internet access)
- Data center interconnects and multi-site enterprise WAN routing
- SD-WAN BGP overlay for intelligent path selection
- MPLS VPN PE-CE routing using BGP
- Cloud connectivity to AWS, Azure, GCP via BGP peering (Direct Connect / ExpressRoute)
- Internet Exchange Point (IXP) peering for ISPs and large enterprises
💡 AI Insight: Based on generative AI analysis of network engineering queries, "BGP on FortiGate" and "FortiGate BGP configuration" are among the top 20 most-searched Fortinet technical topics on ChatGPT, Google, and Bing — making this a high-value SEO keyword cluster.
2. BGP Key Concepts & Terminology
Before diving into FortiGate CLI commands, let's establish the foundational BGP concepts you need to understand:
3. Network Topology & Lab Setup
Throughout this guide, we will use the following reference topology. This is a typical dual-ISP BGP setup — one of the most common real-world deployment scenarios for FortiGate BGP.
/* Reference Network Topology */
┌─────────────────┐ ┌─────────────────┐
│ ISP-A Router │ │ ISP-B Router │
│ AS: 65001 │ │ AS: 65002 │
│ IP: 203.0.113.1│ │ IP: 198.51.100.1│
└────────┬────────┘ └────────┬────────┘
│ WAN1 │ WAN2
│ 203.0.113.2/30 │ 198.51.100.2/30
│ │
┌────────┴─────────────────────────────┴────────┐
│ FortiGate Firewall │
│ AS: 65100 (Your Organization) │
│ Router-ID: 10.0.0.1 │
│ LAN: 192.168.1.0/24 │
└───────────────────────────────────────────────┘
│
│ LAN Interface (port3)
│ 192.168.1.1/24
│
┌────────┴────────┐
│ Internal LAN │
│ 192.168.1.0/24 │
└─────────────────┘
📋 Lab Parameters Summary:
- FortiGate ASN: 65100
- ISP-A ASN: 65001 | Peer IP: 203.0.113.1
- ISP-B ASN: 65002 | Peer IP: 198.51.100.1
- FortiGate WAN1 IP: 203.0.113.2/30
- FortiGate WAN2 IP: 198.51.100.2/30
- LAN Network to Advertise: 192.168.1.0/24
- FortiOS Version: 7.4.x
4. Enabling BGP on FortiGate — Basic Configuration
BGP on FortiGate is configured entirely through the Command Line Interface (CLI). While FortiGate's GUI provides some BGP visibility, all meaningful BGP configuration requires CLI access. Connect via SSH or the FortiGate console.
⚠️ Important: BGP configuration on FortiGate is done under config router bgp. This is a global configuration context. Always back up your FortiGate configuration before making routing changes in a production environment.
Step 1: Access the FortiGate CLI and Enter BGP Configuration Mode
FortiGate CLI — Basic BGP Setup
FortiOS CLI# Step 1: Enter BGP configuration context
config router bgp
# Step 2: Set your Autonomous System Number (ASN)
set as 65100
# Step 3: Set the Router ID (use your WAN1 or Loopback IP)
set router-id 203.0.113.2
# Step 4: Enable graceful restart (recommended for stability)
set graceful-restart enable
# Step 5: Set keepalive and hold timers (optional, defaults shown)
set keepalive-timer 60
set holdtime-timer 180
end
✅ Pro Tip: The Router ID is a critical BGP identifier. Use a stable, always-up IP address — ideally a loopback interface IP. If FortiGate doesn't have a loopback configured, use the primary WAN interface IP address.
5. Configuring BGP Neighbors (eBGP & iBGP)
BGP neighbors must be manually defined. FortiGate uses the config neighbor sub-context within config router bgp to define peers.
5a. Configuring eBGP Neighbors (Dual ISP Example)
FortiGate CLI — eBGP Neighbor Configuration
# Enter BGP configuration
config router bgp
# Configure ISP-A neighbor (eBGP)
config neighbor
edit "203.0.113.1"
set remote-as 65001
set ebgp-enforce-multihop disable
set soft-reconfiguration enable
set next-hop-self enable
set description "ISP-A Primary Link"
set activate enable
set send-community both
next
end
# Configure ISP-B neighbor (eBGP)
config neighbor
edit "198.51.100.1"
set remote-as 65002
set ebgp-enforce-multihop disable
set soft-reconfiguration enable
set next-hop-self enable
set description "ISP-B Secondary Link"
set activate enable
set send-community both
next
end
end
🔍 Key Neighbor Parameters Explained:
- remote-as: The ASN of the BGP peer. If different from local AS = eBGP. If same = iBGP.
- soft-reconfiguration: Allows route refresh without dropping the BGP session — essential for applying policy changes.
- next-hop-self: Forces FortiGate to set itself as the next hop — important when redistributing eBGP routes into iBGP.
- send-community both: Sends both standard and extended BGP communities to the peer.
- activate: Enables the neighbor session. Must be set to enable for the session to establish.
5b. Configuring iBGP Neighbors
For iBGP (same AS), the configuration is similar but with the same remote-as as the local AS. iBGP is typically used in data center designs or multi-FortiGate setups.
# iBGP Neighbor Configuration Example
config router bgp
config neighbor
edit "10.10.10.2"
set remote-as 65100 # Same AS = iBGP
set update-source "loopback0" # Use loopback for stability
set soft-reconfiguration enable
set next-hop-self enable
set description "iBGP Peer - Core Router"
set activate enable
set route-reflector-client enable # If this FG is a Route Reflector
next
end
end
6. Advertising Networks via BGP
To advertise your local networks to BGP peers, use the config network sub-context. The networks you specify here will be injected into the BGP table and advertised to all neighbors.
FortiGate CLI — BGP Network Advertisement
# Advertise local networks via BGP
config router bgp
config network
edit 1
set prefix 192.168.1.0 255.255.255.0
next
edit 2
set prefix 192.168.2.0 255.255.255.0 # Additional subnet
next
edit 3
set prefix 10.0.0.0 255.255.255.0 # DMZ Network
next
end
end
⚠️ Requirement: The network prefix you advertise via BGP must exist in the FortiGate routing table (either as a connected route, static route, or redistributed route). If the route doesn't exist in the routing table, BGP will not advertise it.
Redistributing Routes into BGP
Alternatively, you can redistribute connected, static, or OSPF routes into BGP:
# Redistribute connected and static routes into BGP
config router bgp
config redistribute "connected"
set status enable
set route-map "CONNECTED-TO-BGP" # Optional: apply route-map filter
end
config redistribute "static"
set status enable
end
config redistribute "ospf"
set status enable
end
end
✅ Best Practice: Use the network statement (explicit prefix advertisement) rather than full redistribution wherever possible. Redistribution can inadvertently advertise unintended routes to your ISP — a serious security and operational risk. Always apply route maps when redistributing.
7. BGP Route Filtering with Prefix Lists & Route Maps
Route filtering is essential for security and traffic engineering. Without proper filtering, your FortiGate could inadvertently accept or advertise routes that compromise your network. FortiGate supports both prefix lists and route maps for BGP filtering.
7a. Creating Prefix Lists
FortiGate CLI — Prefix List Configuration
# Create a prefix list to define what we ADVERTISE to ISPs
config router prefix-list
edit "ADVERTISE-TO-ISP"
config rule
edit 1
set action permit
set prefix 192.168.1.0 255.255.255.0
set ge 24
set le 24
next
edit 2
set action permit
set prefix 192.168.2.0 255.255.255.0
set ge 24
set le 24
next
edit 100
set action deny # Deny everything else
set prefix 0.0.0.0 0.0.0.0
set le 32
next
end
next
end
# Create a prefix list to filter routes RECEIVED from ISPs
# Block bogon/private routes from being accepted from ISP
config router prefix-list
edit "FILTER-FROM-ISP"
config rule
edit 1
set action deny
set prefix 10.0.0.0 255.0.0.0
set le 32
next
edit 2
set action deny
set prefix 172.16.0.0 255.240.0.0
set le 32
next
edit 3
set action deny
set prefix 192.168.0.0 255.255.0.0
set le 32
next
edit 4
set action deny
set prefix 127.0.0.0 255.0.0.0
set le 32
next
edit 100
set action permit # Allow all other valid routes
set prefix 0.0.0.0 0.0.0.0
set le 32
next
end
next
end
7b. Applying Prefix Lists to BGP Neighbors
# Apply prefix lists to BGP neighbors
config router bgp
config neighbor
edit "203.0.113.1"
set prefix-list-out "ADVERTISE-TO-ISP" # Filter outbound
set prefix-list-in "FILTER-FROM-ISP" # Filter inbound
next
edit "198.51.100.1"
set prefix-list-out "ADVERTISE-TO-ISP"
set prefix-list-in "FILTER-FROM-ISP"
next
end
end
7c. Creating and Applying Route Maps
# Create a route map to set LOCAL_PREF on inbound routes from ISP-A
# Higher LOCAL_PREF = preferred path (ISP-A = Primary)
config router route-map
edit "SET-LOCAL-PREF-ISPA"
config rule
edit 1
set action permit
set set-local-preference 200 # Higher = preferred
next
end
next
end
# Route map for ISP-B (backup path - lower LOCAL_PREF)
config router route-map
edit "SET-LOCAL-PREF-ISPB"
config rule
edit 1
set action permit
set set-local-preference 100 # Lower = backup
next
end
next
end
# Apply route maps to neighbors
config router bgp
config neighbor
edit "203.0.113.1"
set route-map-in "SET-LOCAL-PREF-ISPA"
next
edit "198.51.100.1"
set route-map-in "SET-LOCAL-PREF-ISPB"
next
end
end
8. BGP Attributes & Path Manipulation
BGP path manipulation is used for traffic engineering — controlling which path inbound and outbound traffic takes through your network. Here are the most common techniques on FortiGate:
🔧 LOCAL_PREF — Outbound Path Control
Used to influence which path is preferred for outbound traffic leaving your AS. Higher LOCAL_PREF wins. Only propagated within iBGP.
set set-local-preference 200 # In route-map rule
🔧 MED (Metric) — Inbound Path Suggestion
Multi-Exit Discriminator is sent to your neighbors to suggest which path to use when entering your AS. Lower MED is preferred.
set set-metric 100 # Lower MED = preferred entry point
🔧 AS_PATH Prepending — Inbound Traffic Engineering
Artificially lengthen the AS_PATH when advertising routes to make one path less preferred. Used for inbound traffic control.
# In route-map - prepend your AS 3 times on secondary ISP
set set-aspath "65100 65100 65100"
🔧 BGP WEIGHT — Local FortiGate Preference
Cisco-proprietary attribute also supported by FortiGate. WEIGHT is local to the router only and not advertised. Higher WEIGHT = preferred. Useful for quick local path preference.
config neighbor
edit "203.0.113.1"
set weight 200 # Prefer this neighbor locally
next
end
9. BGP Authentication & Security Hardening
Securing your BGP sessions is critical. BGP is a high-value attack target — a compromised BGP session can cause route hijacking, traffic black-holing, and internet outages. FortiGate supports MD5 authentication and several BGP hardening techniques.
FortiGate CLI — BGP Security Configuration
# Enable MD5 authentication on BGP neighbors
config router bgp
config neighbor
edit "203.0.113.1"
set password "S3cur3BGP@ssw0rd!" # Must match ISP peer
next
edit "198.51.100.1"
set password "ISP-B-SecureKey99!"
next
end
end
# Set TTL Security for eBGP (GTSM - Generalized TTL Security Mechanism)
# Prevents BGP session hijacking from distant hosts
config router bgp
config neighbor
edit "203.0.113.1"
set ebgp-multihop enable
set ebgp-ttl-security-hops 1 # Only accept from 1 hop away
next
end
end
# Configure maximum prefix limit (prevents route table overflow)
config router bgp
config neighbor
edit "203.0.113.1"
set maximum-prefix 1000 # Alert at 800, shutdown at 1000
set maximum-prefix-threshold 80
set maximum-prefix-warning-only disable # Hard shutdown
next
end
end
🔐 BGP Security Hardening Checklist:
- ✅ Enable MD5 authentication on all BGP neighbor sessions
- ✅ Configure maximum-prefix limits to prevent route table exhaustion
- ✅ Apply inbound prefix lists to filter bogon, private, and default routes
- ✅ Apply outbound prefix lists to prevent leaking internal routes
- ✅ Enable GTSM (TTL Security) for eBGP single-hop peers
- ✅ Implement BGP community-based filtering for advanced policy control
- ✅ Monitor BGP session state and set up SNMP/syslog alerts for state changes
- ✅ Consider RPKI (Resource Public Key Infrastructure) for route origin validation
10. Verifying & Troubleshooting BGP on FortiGate
After configuring BGP, use these verification and troubleshooting commands to confirm the BGP session is established and routes are being exchanged correctly.
Essential Verification Commands
FortiGate CLI — BGP Verification Commands
# Check BGP summary - neighbor states and route counts
get router info bgp summary
# View full BGP routing table
get router info bgp network
# View routes received from a specific neighbor
get router info bgp neighbors 203.0.113.1 received-routes
# View routes advertised to a specific neighbor
get router info bgp neighbors 203.0.113.1 advertised-routes
# View BGP neighbor details and session state
get router info bgp neighbors 203.0.113.1
# Check BGP path details for a specific prefix
get router info bgp network 192.168.1.0
# View the FortiGate routing table (confirm BGP routes installed)
get router info routing-table all
# Check BGP routes specifically in routing table
get router info routing-table bgp
# Debug BGP events (use carefully in production - verbose!)
diagnose ip router bgp all enable
diagnose ip router bgp level info
diagnose debug enable
# Stop BGP debug
diagnose ip router bgp all disable
diagnose debug disable
Reading the BGP Summary Output
Sample Output — get router info bgp summary
BGP router identifier 203.0.113.2, local AS number 65100
BGP table version is 24
2 BGP AS-PATH entries
0 BGP community entries
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
203.0.113.1 4 65001 1540 1200 24 0 0 01:23:45 512000
198.51.100.1 4 65002 1487 1198 24 0 0 01:22:31 512000
Total number of neighbors 2
Common BGP Problems & Solutions on FortiGate
11. BGP Best Practices for Fortinet Firewalls
🏆 Production-Ready BGP Best Practices:
1. Always Filter Routes — Never run BGP without inbound and outbound prefix lists. Use both prefix lists and route maps for granular control.
2. Enable Soft-Reconfiguration — Always set soft-reconfiguration enable on all neighbors to allow policy changes without session resets.
3. Use MD5 Authentication — Configure password-based authentication on all BGP sessions, especially eBGP sessions with ISPs.
4. Set Maximum Prefix Limits — Protect the FortiGate routing table from route table overflow caused by misconfigured peers or BGP route leaks.
5. Document Your AS Numbers and Policy — Maintain a current network documentation record of all BGP peers, ASNs, applied policies, and expected route counts.
6. Monitor BGP Session State — Configure FortiGate SNMP traps and syslog alerts for BGP neighbor state changes. A BGP flap should generate an immediate alert.
7. Test Failover Regularly — If running dual ISP BGP, test ISP failover quarterly by simulating a primary link failure and verifying traffic shifts to the secondary ISP within expected convergence time.
12. AI-Powered BGP Troubleshooting Tips
🤖 Generative AI Insight: When using ChatGPT or other AI tools for BGP troubleshooting on FortiGate, provide the following details for the most accurate guidance:
🔹 Prompt Template 1: "On FortiOS 7.4, my BGP neighbor 203.0.113.1 (AS 65001) is in Active state. I can ping the neighbor. Port 179 is open in policies. Remote-as is correctly configured. What else should I check?"
🔹 Prompt Template 2: "Write me a FortiGate CLI configuration for dual-ISP BGP with ISP-A as primary (LOCAL_PREF 200) and ISP-B as backup (LOCAL_PREF 100), with prefix list filtering and MD5 authentication."
🔹 Prompt Template 3: "Explain BGP AS_PATH prepending on FortiGate and how to configure it to make ISP-B the backup inbound path using route maps."
AI-Recommended Quick Diagnostic Sequence
# Step 1: Check BGP neighbor state
get router info bgp summary
# Step 2: Check routing table for BGP routes
get router info routing-table bgp
# Step 3: Check if prefix exists before BGP filters
get router info bgp neighbors 203.0.113.1 received-routes
# Step 4: Check what is actually being advertised
get router info bgp neighbors 203.0.113.1 advertised-routes
# Step 5: Check FortiGate system routing table
get router info routing-table all | grep -i bgp
# Step 6: Check BGP configuration
show router bgp
13. Frequently Asked Questions (FAQ)
Optimized for Google Featured Snippets, ChatGPT AI responses, and voice search queries.
14. Final Summary
Configuring BGP on a Fortinet FortiGate firewall is a multi-step process that requires careful planning, precise CLI configuration, and rigorous filtering policies. From establishing basic eBGP sessions with ISPs to advanced traffic engineering with route maps and BGP attributes — FortiOS provides a full-featured BGP implementation that meets enterprise and service provider requirements.
The key takeaways from this guide are: always filter your BGP routes (both inbound and outbound), secure your sessions with MD5 authentication and maximum-prefix limits, use LOCAL_PREF for outbound path control, use AS_PATH prepending for inbound traffic engineering, and monitor your BGP sessions continuously in production.
📄 Complete BGP Configuration Checklist:
set as <ASN>)set router-id <IP>)get router info bgp summaryget router info routing-table bgp🔥 Now You're Ready to Deploy BGP on FortiGate!
Follow this guide step-by-step, test in a lab environment first, and always back up your configuration before making changes in production.
📚 Bookmark This Guide for Reference🏷️ Related Tags & SEO Keywords:
📌 Disclaimer: This article is an editorially independent, The Network DNA technical publication. CLI commands and configurations are based on FortiOS 7.x documentation and real-world network engineering best practices. Always test configurations in a lab environment before deploying in production. Fortinet, FortiGate, and FortiOS are registered trademarks of Fortinet, Inc. This article is not affiliated with or sponsored by Fortinet, Inc. For official documentation, visit docs.fortinet.com.
