
FortiGate BGP Neighbor Idle: get router info bgp summary Before You Touch the Policy
- 3 days ago
- 2 min read

New MPLS BGP neighbor stays Idle. The circuit is up. Security policy already allows TCP 179.
This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.
What you will be able to do
Name the first CLI command to run on FortiGate for this ticket
Separate the layer that is actually broken from the layer people blame
Apply one scoped fix instead of a global disable
Prove the ticket closed with a session, log, or counter
Quick answer
Idle means TCP 179 never established. Check source IP, update-source, and whether the neighbor is on the correct VRF/VDOM.
Why this ticket shows up
FortiGate BGP fails most often on the wrong local AS, a missing update-source, or the session landing in another VDOM.
Symptoms operators actually see
State Idle or Active
No TCP 179 session
Wrong local AS
Neighbor IP is in another VDOM
CLI first — copy this block
Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.
get router info bgp summary
get router info bgp neighbors 10.6.6.1
diagnose ip router bgp all enable
diagnose debug enable
execute ping-options source 10.6.6.2
execute ping 10.6.6.1How to read that output
summary Idle + ping fail is L3. Idle + ping OK is TCP 179 or BGP parameters. neighbors detail shows last error.
Triage order
Ping the neighbor sourced from the BGP local address
Confirm TCP 179 policy and local-in if needed
Match ASN and update-source
Check VDOM
Then look at prefixes
Classic traps
What you see | Real cause | Fix |
Open a prefix-list ticket | Session is still Idle | Fix TCP first |
Change the ISP ASN | Your update-source is the LAN IP | Use the WAN/loopback you advertised |
Disable RPF | Wrong VDOM | Move the config |
Proof the ticket is closed
summary shows Established
Prefix count > 0 if expected
Traceroute uses the new path
Say this in an interview
I do not debug BGP prefixes while the neighbor is Idle. Idle is TCP or identity.
Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/



Comments