The Packets, Life and everything
Avocent ACS – Forcing MTU and MSS per Route The Situation A WAN link did not offer the full Ethernet MTU of 1500 bytes (tunnel/overlay overhead). Two effects came together: The WAN environment did not advertise the lower MTU properly – ICMP "Fragmentation Needed" (type 3, code 4) never made it back to the sender, …
Continue reading "Avocent – MTU"
Some good presetation on BGP Links https://www.sanog.org/resources/sanog33/SANOG33_Tutorials-BGP_Communities_and_Geotags-Muhammad_Moinur_Rahman-DZCRD.pdf https://www.denog.de/media/DENOG10/day2_0900_communities-no-anim.pdf https://nsrc.org/workshops/2014/afnog-are/raw-attachment/wiki/Agenda/09-BGP-Communities.pdf
Adding Check Point to the BGP setup. clish configshow bgp summaryshow bgp peer 10.255.2.5 detailedshow bgp peer 10.255.2.5 receivedshow route bgpRestarting BGP Peers in Gaia Clish clish config set as 65532 set bgp external remote-as 65001 on set bgp external remote-as 65001 peer 10.255.2.5 on set bgp external remote-as 65001 peer 10.255.2.5 route-refresh on set inbound-route-filter …
Remove routes from Advertisement on a Forigate firewall Not to myself: 10.255.32.0/20 was wired on C1, local pref was missing. so it might make sens to add this to all incoming routes 'set local-preference 100', incoming there is no issue. show router route-map show router route-map config router route-map edit "EBGP-OUT-R2" config rule edit 1 …
AS-Path FilteringNo-export CommunityPrefix-list FilteringDistribute List Filtering AS-Path Filtering ip as-path access-list 1 permit ^$ neighbor x.x.x.x filter-list 1 out No-export Community ip bgp-community new-format route-map NO-EXPORT set community no-export neighbor x.x.x.x route-map NO-EXPORT in neighbor x.x.x.x send-community Prefix-list Filtering ip prefix-list NO-TRANSIT permit x.x.x.x/x neighbor x.x.x.x prefix-list NO-TRANSIT out Distribute List Filtering access-list x deny x.x.x.x y.y.y.y …
Revisiting an old post. This lab started with a simple customer question: “We have two equal paths through our MPLS network. Why aren't we using both?” BGP and redundancy were already there. Load balancing wasn't. The operator's answer was essentially that this was not part of their supported operational model. Fair enough. But that left …
Fortinet Firewalls support the use of address objects in static routes. This includes individual address objects, address groups and FQDN address objects. This feature is particularly useful if you have numerous VPN connections or if you reach the maximum number of configurable static routes on the gateway. For example, lower-end models like the 60E support …
FreeBSD freebsd:~ $ netstat -rWRouting tablesInternet:Destination Gateway Flags Nhop# Mtu Netif Expiredefault 11.155.93.1 UGS 6 1500 em011.155.93.0/24 link#1 U 3 1500 em011.155.93.77 link#2 UHS 5 16384 lo0localhost link#2 UH 1 16384 lo0Internet6:Destination Gateway Flags Nhop# Mtu Netif Expire::/96 link#2 URS 6 16384 lo0default fe80::1%em0 UGS 7 1500 em0localhost link#2 UHS 1 16384 lo0::ffff:0.0.0.0/96 link#2 URS …
So after a while some basic Cisco stuff. Thanks Craig for being the Guy you are. We had to divert traffic some traffic to an dedicated line for Netscope, to an different Internet Line. configure terminal ip access-list pbr-netscope-over-second-provider permit 10.255.86.0 0.0.1.255 3.123.155.214 0.0.0.0 permit 10.255.86.0 0.0.1.255 3.123.215.247 0.0.0.0 permit 10.255.86.0 0.0.1.255 3.123.221.103 0.0.0.0 permit …
"Reminder to self regarding routing information: This document is derived from Fortinet KB Articles and covers topics such as accessing FIB/RIB routing data via the CLI, understanding the routing process in FortiGate (route-lookup-process), handling multiple default routes when SD-WAN rules are not the preferred option, and more." Routing in FortiGate (route-lookup-process) How does FortiGate decide …
Continue reading "FortiGate – Viewing FIB/RIB routing information in CLI"
I like the the Idea to configure static routing over firewall objects. This avoids the static route limit on FortiGate Firewall. config firewall address edit "N.203.0.113.0--24" set allow-routing enable set subnet 203.0.113.0 255.255.255.0 next end config firewall addrgrp edit "R.Networks" set allow-routing enable set member "N.203.0.113.0--24" next end config router static edit 0 set gateway …
Continue reading "Fortinet – Static routes with Firewall objects"