Configuring the FortiGate unit
1. Configuring the FortiGate unit — networks and firewalls
2. Configuring the FortiGate unit – BGP
3. Configuring the FortiGate unit – OSPF
4. Configuring other networking devices
5. Configuring ECMP support for BGP
Configuring the FortiGate unit — networks and firewalls
The FortiGate unit has three interfaces connected to networks — two external and one dmz. Security policies must be in place to allow traffic to flow between these networks.
Firewall services will change depending on which routing protocol is being used on that network — either BGP or OSPF. Beyond that, all services that are allowed will be allowed in both directions due to the internal servers. The services allowed are web-server services (DNS, HTTP, HTTPS, SSH, NTP, FTP*, SYSLOG, and MYSQL), email services (POP3, IMAP, and SMTP), and general troubleshooting services (PING, TRACEROUTE). Those last two can be removed once the network is up and working properly to increase security. Other services can be added later as needed.
To configure the interfaces – GUI
1. Go to System > Network > Interfaces.
2. Edit port1 (dmz) interface.
3. Set the following information, and select OK.
Alias dmz
IP/Network Mask 10.11.201.110/255.255.255.0
Administrative Access HTTPS SSH PING
Description OSPF internal networks
Administrative Status Up
4. Edit port2 (external1) interface.
5. Set the following information, and select OK.
Alias external1
IP/Network Mask 172.21.111.4/255.255.255.0
Administrative Access HTTPS SSH
Description BGP external Peer 1
Administrative Status Up
6. Edit port3 (external2) interface.
7. Set the following information, and select OK.
Alias external2
IP/Network Mask 172.22.222.4/255.255.255.0
Administrative Access HTTPS SSH
Description BGP external2 Peer2
Administrative Status Up
To configure the FortiGate interfaces (CLI)
config system interface edit port1
set alias dmz
set ip 10.11.201.110 255.255.255.0 set allowaccess https ssh ping
set description “OSPF internal networks” set status up
next
edit port2
set alias external1
set ip 172.21.111.5 255.255.255.0 set allowaccess https ssh
set description “external1 Peer 1” set status up
next
edit port3
set alias external2
set ip 172.22.222.5 255.255.255.0 set allowaccess https ssh
set description “external2 Peer 2” set status up
next end
To configure the firewall addresses – GUI
1. Go to Policy & Objects > Objects > Addresses.
2. Select Create New, and set the following information.
Category Address
Name BGP_services
Type Subnet / IP Range
Subnet / IP Range 10.11.201.0 255.255.255.0
Interface port1
3. Select OK.
Hi Mike,
if i configure the following on fortigate1:
config router bgp
set as 65000
set router-id 10.2.2.254
config neighbor
edit “10.2.2.253”
set next-hop-self enable
set remote-as 65000
set send-community6 disable
next
config redistribute “static”
set status enable
end
fortigate2 should get the default route 0.0.0.0 0.0.0.0 from fortigate1 as it is static ?
how can i redistribute the default route(fortigate1) to fortigate2 ?
thanks
regards
There is a really good KB article that explains how to do this. You can find it here
If you want to redistribute static routes you would enable the following
config router bgp
config redistribute static
set status enable
end
end
An example of the config would be like this
config router prefix-list
edit “only_dflt”
config rule
edit 1
set prefix 0.0.0.0 0.0.0.0
unset ge
unset le
next
end
next
end
config router route-map
edit “only_default_route”
config rule
edit 1
set match-ip-address “only_dflt”
next
end
next
end
config router bgp
set as 2
config neighbor
edit 10.142.0.110
set remote-as 1
set route-map-in “only_default_route”
next
end
set router-id 10.142.0.205
end
Let me know if this helped answer your question!
Thanks!
Hi,
thanks for the link and example, got it working!
Regards
Awesome to hear Piccolo!
config router bgp
set as 65041
set router-id 162.53.156.138
config neighbor
edit “10.104.55.1”
set ebgp-enforce-multihop enable
set soft-reconfiguration enable
set remote-as 64699
set send-community6 disable
next
edit “10.104.55.2”
set ebgp-enforce-multihop enable
set soft-reconfiguration enable
set remote-as 64699
set send-community6 disable
next
i am trying to accomplish above but i can see only one neighbour is establish and other is in ACTIVE state…
So you see both neighbors but only one is active?