topic FTD BGP path selection in Network Security

FTD BGP path selection

Cisco-User500 — Thu, 28 Jan 2021 06:55:08 GMT

Hello,

I have an FTD managed through FDM. I have two S2S VPNs using VTI and would like to do some path selection. I created two route-maps each matching a specific prefix list and each has BGP weight and local preference. I see that there is an option to apply a weight under the neighbor, But I want to be more specific and apply that to certain subnets only. I cannot find the setting that uses route map.

Thanks

Re: FTD BGP path selection

Panos Bouras — Thu, 28 Jan 2021 18:02:34 GMT

Hi @Cisco-User500

BGP route-map is applied to a neighbor under address-family ipv4.

You can do it through GUI in FMC, I never done it via FDM.

Screenshot from FMC

Re: FTD BGP path selection

Cisco-User500 — Fri, 29 Jan 2021 22:13:31 GMT

Hi Panos,

Thanks for sharing the screenshot. Unfortunately, I can only use FDM to manage this device.

Thanks

Re: FTD BGP path selection

Panos Bouras — Sat, 30 Jan 2021 08:34:05 GMT

Hi @Cisco-User500

What gersion are you running?

There's no BGP configuration on GUI?

Re: FTD BGP path selection

Marvin Rhoads — Sat, 30 Jan 2021 12:12:41 GMT

With FDM you should be able to use a route-map smart CLI object and configure BGP as described here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-bgp.html#id_123038

Version 6.5 introduced the route-map as a Smart CLI feature.

Re: FTD BGP path selection

Cisco-User500 — Sat, 30 Jan 2021 16:24:44 GMT

Thanks Marvin.

I have already created two route-maps and set the weight on each one. I am just not sure how to apply these routes maps so the FTD prefers a path over another for certain subnets defined in the route maps.

Re: FTD BGP path selection

Marvin Rhoads — Sun, 31 Jan 2021 04:14:00 GMT

You should be able to use this option in your BGP smart cli setup:

table-map route-map options . (IPv4 only.) Apply a route map that sets metrics, a tag value, or a traffic index for routes that are updated in the BGP routing table, or controls whether routes are downloaded to the RIB. Click route-map and select the Smart CLI object that defines the route map. In the route map, you can use match clauses for IP access list, autonomous system paths, communities, prefix lists, and next hop.