FTD BGP advertise (not connected) IP Block

[Mulin100001]

I have BGP peering set up with one of our upstream providers. The default route is getting advertised but not the other "network" I have configured. We have a /24 of public IP space that we want to advertise via BGP. The FTD (FMC managed) doesn't have an interface with an IP assigned to it within that /24 so it isn't in the routing table. I’ve tried route injection, prefix list, route map, to no avail. I can create a null0 route for that subnet, then it shows up in the table, but that kind of defeats the purpose. Basically I want to use that /24 for NAT and need to find a way to get it advertised. Thanks for your help.

Mike

[MHM Cisco World]

Can you more elaborate.

Some note 

For what I read there is no direct connect so you can use aggregate' aggregate will use any prefix within aggregate prefix.

This way you will no need to add static null0 

Thanks 

[Mulin100001]

I have BGP configured and peering is up between FTD and our ISP. Only the default route is getting advertised. I added another network that I want to get advertised, but it's not showing up. I believe the reason for that is that network is not directly connected to the FTD, so it isn't showing up in the FTD routing table. It is a /24 block that we purchased for use with NAT. So, for example, I want mysite.example.com to resolve to one of the IP's within that /24 and for it to get routed back to my FTD so I can NAT that back into my network. In order for the rest of the world to know that the /24 goes back to my FTD, I need that /24 to be advertised, via BGP, out to my ISP. So how do I get an unconnected subnet to be added to the routing table so it gets advertised out with BGP? Hopefully that helps.

Thanks,

Mike

[MHM Cisco World]

this public network you get from same provider you want to advertise to ?

[Mulin100001]

No, we purchased this block from a broker. It is now registered to us with ARIN. We have another /23 block that we split into two /24's for use at our datacenters. For those, we don't have BGP set up and have the ISP advertise the space for us and route them back to our firewalls. In this instance, we have multiple ISP connection for the site and want to do the advertising of the space ourselves. 

[Mulin100001]

I have tried to add aggregate address but that didn't seem to work either. Perhaps I'm not configuring it correctly. This is the first time I've configured BGP on a FTD.

> show bgp

BGP table version is 7, local router ID is 208.126.235.195
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
r> 0.0.0.0 207.177.5.214 0 5056 i
*> 207.177.5.208/29 0.0.0.0 0 32768 i

> show bgp neighbors 207.177.5.214 advertised-routes

BGP table version is 7, local router ID is 208.126.235.195
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 207.177.5.208/29 0.0.0.0 0 32768 i

Total number of prefixes 1

[Jon Marshall]

Mike

An aggregate address will only work if you have at least one network within the aggregate in the BGP table and it looks like you don't. 

Not used FTD but when you say using a static route to null0 defeats the purpose do you mean routing happens before NAT so the packets are dropped or something else ? 

If you cannot use the the null0 route could you not add a static route with the next hop being the exit interface on your firewall eg. the DMZ or inside interface so it is routed correctly and then NAT happens ? 

You are going to have to add a static somehow unless you can get an internal device to advertise the subnet to the FTD and you inject it into BGP. 

Jon

[Mulin100001]

Hi Jon,

Yes, the concern with using null0 is that the traffic will get dropped.

I didn't think about adding a static route with the exit interface being inside or DMZ. The concern with that is some of the /24 will NAT to the inside and some to the DMZ. So, I'm not sure how that will work. I suppose I could subnet it down and dedicate one half to a route going to inside and the other to the DMZ. I'll give that a shot and reply with the results.

Thanks,

Mike

[MHM Cisco World]

I dont quite sure here this will work

Config static toward ISP and redistrubte static into bgp.

Note:- aggregate as I mention before need prefix in ftd rib to work' here in your case it will not work sure.

[MHM Cisco World]

Normally  we advertise lan into ISP not public IP for NAT. 

That why I confuse and ask many times.

Are ISP accept to advertise this public IP? Need to be sure by ask them 

[Jon Marshall]

Mike 

Your ISP may not accept anything less than a /24 advertisement but you could still make it work by having a /24 static route pointing out of one of the interfaces and then as you say use more specific routes to direct to the other interface.

You just need the /24 to advertise the BGP prefix. 

Jon

[Mulin100001 · Accepted solution]

Turns out that deploying the null0 route did allow it to be advertised out BGP and it doesn't drop traffic like I thought it would. Problem solved. Thanks for all your input on solutions.