top of page

FortiGate BGP Neighbor Idle: get router info bgp summary Before You Touch the Policy

  • 3 days ago
  • 2 min read
FortiGate network security troubleshooting lab
FortiGate · Techclick CLI troubleshooting lab
New MPLS BGP neighbor stays Idle. The circuit is up. Security policy already allows TCP 179.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on FortiGate for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Idle means TCP 179 never established. Check source IP, update-source, and whether the neighbor is on the correct VRF/VDOM.

Why this ticket shows up

FortiGate BGP fails most often on the wrong local AS, a missing update-source, or the session landing in another VDOM.

Symptoms operators actually see

  • State Idle or Active

  • No TCP 179 session

  • Wrong local AS

  • Neighbor IP is in another VDOM

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

get router info bgp summary
get router info bgp neighbors 10.6.6.1
diagnose ip router bgp all enable
diagnose debug enable
execute ping-options source 10.6.6.2
execute ping 10.6.6.1

How to read that output

summary Idle + ping fail is L3. Idle + ping OK is TCP 179 or BGP parameters. neighbors detail shows last error.

Triage order

  1. Ping the neighbor sourced from the BGP local address

  2. Confirm TCP 179 policy and local-in if needed

  3. Match ASN and update-source

  4. Check VDOM

  5. Then look at prefixes

Classic traps

What you see

Real cause

Fix

Open a prefix-list ticket

Session is still Idle

Fix TCP first

Change the ISP ASN

Your update-source is the LAN IP

Use the WAN/loopback you advertised

Disable RPF

Wrong VDOM

Move the config

Proof the ticket is closed

  • summary shows Established

  • Prefix count > 0 if expected

  • Traceroute uses the new path

Say this in an interview

I do not debug BGP prefixes while the neighbor is Idle. Idle is TCP or identity.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments


bottom of page