We stumbled over a situation where the wan environment did not advertise lower mtu values properly or fragments where routed over a different path. To FIX this we set the MTU / MSS values on the route. vi /etc/network/st_routes 10.0.0.0/8 via 10.52.192.81 dev eth0 mtu 1150 advmss 1100 default metric 0 via 10.52.192.81 This is …
BGP – More on Load Balanceing
Some good presetation on BGP Links https://www.sanog.org/resources/sanog33/SANOG33_Tutorials-BGP_Communities_and_Geotags-Muhammad_Moinur_Rahman-DZCRD.pdf https://www.denog.de/media/DENOG10/day2_0900_communities-no-anim.pdf https://nsrc.org/workshops/2014/afnog-are/raw-attachment/wiki/Agenda/09-BGP-Communities.pdf
BGP – Prevent becoming a Transit-AS
AS-Path FilteringNo-export CommunityPrefix-list FilteringDistribute List Filtering AS-Path Filtering ip as-path access-list 1 permit ^$ neighbor x.x.x.x filter-list 1 out No-export Community ip bgp-community new-format route-map NO-EXPORT ​set community no-export neighbor x.x.x.x route-map NO-EXPORT in neighbor x.x.x.x send-community Prefix-list Filtering ip prefix-list NO-TRANSIT permit x.x.x.x/x neighbor x.x.x.x prefix-list NO-TRANSIT out Distribute List Filtering access-list x deny x.x.x.x y.y.y.y …
BGP – MultiHoming
Cisco cisco01config show ip bgp summaryshow ip routeshow ip bgpcisco02config show ip bgp summaryshow ip routeEdgeRouter-Xedge01configshow ip routeedge02configshow ip routeFortiGateconfigget router info routing-table detailsTestsChanging the AS Numbersshow ip routeshow ip bgpOptimizing route mapscisco1show ip bgp neighbors 10.255.80.29 received-routesshow ip bgpshow ip routecisco2show ip bgp neighbors 10.255.80.28 received-routesshow ip routeBGP Prevent becoming an Transit ASNo-Export CommunityLinks …
Fortinet – Named Static Routes
Fortinet Firewalls support the use of address objects in static routes. This includes individual address objects, address groups and FQDN address objects. This feature is particularly useful if you have numerous VPN connections or if you reach the maximum number of configurable static routes on the gateway. For example, lower-end models like the 60E support …
Routing Tables
FreeBSD freebsd:~ $ netstat -rWRouting tablesInternet:Destination Gateway Flags Nhop# Mtu Netif Expiredefault 11.155.93.1 UGS 6 1500 em011.155.93.0/24 link#1 U 3 1500 em011.155.93.77 link#2 UHS 5 16384 lo0localhost link#2 UH 1 16384 lo0Internet6:Destination Gateway Flags Nhop# Mtu Netif Expire::/96 link#2 URS 6 16384 lo0default fe80::1%em0 UGS 7 1500 em0localhost link#2 UHS 1 16384 lo0::ffff:0.0.0.0/96 link#2 URS …
Cisco Nexus – Policy Based Routes
So after a while some basic Cisco stuff. Thanks Craig for being the Guy you are. We had to divert traffic some traffic to an dedicated line for Netscope, to an different Internet Line. configure terminal ip access-list pbr-netscope-over-second-provider permit 10.255.86.0 0.0.1.255 3.123.155.214 0.0.0.0 permit 10.255.86.0 0.0.1.255 3.123.215.247 0.0.0.0 permit 10.255.86.0 0.0.1.255 3.123.221.103 0.0.0.0 permit …
FortiGate – Viewing FIB/RIB routing information in CLI
"Reminder to self regarding routing information: This document is derived from Fortinet KB Articles and covers topics such as accessing FIB/RIB routing data via the CLI, understanding the routing process in FortiGate (route-lookup-process), handling multiple default routes when SD-WAN rules are not the preferred option, and more." Routing in FortiGate (route-lookup-process) How does FortiGate decide …
Continue reading "FortiGate – Viewing FIB/RIB routing information in CLI"
Fortinet – Static routes with Firewall objects
I like the the Idea to configure static routing over firewall objects. This avoids the static route limit on FortiGate Firewall. config firewall address edit "N.203.0.113.0--24" set allow-routing enable set subnet 203.0.113.0 255.255.255.0 next end config firewall addrgrp edit "R.Networks" set allow-routing enable set member "N.203.0.113.0--24" next end config router static edit 0 set gateway …
Continue reading "Fortinet – Static routes with Firewall objects"
Fortigate – get router info routing-table all
get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF …
Continue reading "Fortigate – get router info routing-table all"
NAT Order of Operation
Ein sehr praktisches Dokument: NAT Order of Operation Hier noch ein ergänzung von IOS Hints: NAT translation logging IOS Order of Operation
Patrick Marc's Networks 