Graceful BGP shutdown NEW
In this enhancement, FortiGate adds support for graceful BGP shutdown (RFC 8326) to allow controlled and orderly shutdown of BGP sessions. This ensures peers have time to adjust to the change and lower the local preferences of the routes associated with the graceful shutdown community and prefix.
CLI syntax
The following commands can be used to configure graceful BGP shutdown for the initiator and receiver. These settings will persist after a reboot.
config router bgp
config neighbor
edit <IP address>
set shutdown {enable | disable | graceful | graceful-soft}
set graceful-shutdown-community <community>
set graceful-shutdown-local-preference <local preference>
set graceful-shutdown-delay <delay>
next
end
end
|
Command |
Description |
|---|---|
|
shutdown {enable | disable | graceful | graceful-soft} |
This setting should only be applied to the initiator. |
|
graceful-shutdown-community <community> |
As the initiator, specify the community in which to advertise the graceful shutdown. As the receiver, apply the This setting is required for both the initiator and receiver. |
|
graceful-shutdown-local-preference <local preference> |
The receiver lowers the local preference of routes tagged by the |
|
graceful-shutdown-delay <delay> |
After the <delay> period in seconds, initiator performs the actions for either If set to |
If administrators want to apply a one-time graceful BGP shutdown that does not persist through a reboot, use the following commands:
|
Command |
Description |
|---|---|
|
execute router clear bgp all gshut [soft | cancel] [delay <60-36000>] |
On the initiator, initiate graceful shutdown on all routes.
|
|
execute router clear bgp ip <IP/IPv6 address> gshut [soft | cancel] [delay <60-36000>] |
On the initiator, initiate graceful shutdown on specific routes based on the IP <IP/IPv6 address>. |
|
execute router clear bgp as <AS number> gshut [soft | cancel] [delay <60-36000>] |
On the initiator, initiate graceful shutdown on specific routes based on the AS <AS number>. |
|
execute router clear bgp group <group name> gshut [soft | cancel] [delay <60-36000>] |
On the initiator, initiate graceful shutdown on specific routes based on the group <group name>. |
In addition, the default community gshut is added to:
-
router.community-list.rule.match
-
router.route-map.rule.set-community
Examples
In the following examples, two FortiGates have established BGP adjacencies.
FGTA needs to be shut down for maintenance. To pre-emptively inform its peer (FGTB), FGTA uses graceful BGP shutdown to announce the shutdown and apply the gshut community to its routes. This allows FGTB to set all routes learned from FGTA to community gshut and lower the local-preference for those routes.
Example 1: Apply graceful BGP shutdown using persistent configs
On FGTB, the graceful BGP shutdown receiver, apply the following BGP configuration:
config router bgp
set as 65412
set router-id 2.2.2.2
set network-import-check disable
config neighbor
edit "1.1.1.1"
set advertisement-interval 5
set activate6 disable
set capability-graceful-restart enable
set ebgp-enforce-multihop enable
set next-hop-self enable
set soft-reconfiguration enable
set remote-as 65412
set keep-alive-timer 30
set holdtime-timer 90
set update-source "loopback1"
set graceful-shutdown-community "gshut"
set graceful-shutdown-local-preference 27
next
end
end
On FGTA, the graceful BGP shutdown initiator, apply the following BGP configuration:
config router bgp
set as 65412
set router-id 1.1.1.1
set graceful-restart enable
config neighbor
edit "2.2.2.2"
set advertisement-interval 5
set activate6 disable
set capability-graceful-restart enable
set ebgp-enforce-multihop enable
set next-hop-self enable
set shutdown graceful
set soft-reconfiguration enable
set remote-as 65412
set keep-alive-timer 30
set holdtime-timer 90
set update-source "loopback1"
set graceful-shutdown-community "gshut"
set graceful-shutdown-local-preference 221
set graceful-shutdown-delay 60
next
end
end
Once graceful shutdown mode is enabled on FGTA, it will notify FGTB of the shutdown by advertising the gshut community.
On FGTA:
# get router info bgp summary VRF 0 BGP router identifier 1.1.1.1, local AS number 65412 BGP table version is 5 1 BGP AS-PATH entries 1 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 2.2.2.2 4 65412 444 464 5 0 0 00:00:54 3 (In gshut) Total number of neighbors 1
FGTB’s learned routes will change community and apply the configured local-preference of 27:
# get router info bgp network 172.16.207.2/32
VRF 0 BGP routing table entry for 172.16.207.2/32
Paths: (1 available, best #1, table Default-IP-Routing-Table, graceful shutdown)
Not advertised to any peer
Original VRF 0
Local
1.1.1.1 from 1.1.1.1 (1.1.1.1)
Origin incomplete distance 200 metric 0, localpref 27, valid, internal, best
Community: gshut
Advertised Path ID: 1
Last update: Fri Sep 26 15:20:23 2025
After the configured graceful-shutdown-delay expires, FGTA will close the BGP session with FGTB.
On FGTA:
# get router info bgp summary VRF 0 BGP router identifier 1.1.1.1, local AS number 65412 BGP table version is 6 1 BGP AS-PATH entries 1 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 2.2.2.2 4 65412 445 467 0 0 0 never Idle(In gshut)
As FGTB in this example does not have any other paths, all learned routes to 172.16.207.2/32 from FGTA have disappeared.
On FGTB:
# get router info bgp network 172.16.207.2/32 % Network not in table
Example 2: Apply one-time graceful BGP shutdown using execute commands
On FGTA, use similar BGP settings as in Example 1:
config router bgp
set as 65412
set router-id 1.1.1.1
set graceful-restart enable
config neighbor
edit "2.2.2.2"
set graceful-shutdown-community "gshut"
set graceful-shutdown-local-preference 221
set graceful-shutdown-delay 0
next
end
end
graceful-shutdown-delay does not need to be configured.
On FGTB, use the same BGP settings as in Example 1:
config router bgp
set as 65412
set router-id 2.2.2.2
set network-import-check disable
config neighbor
edit "1.1.1.1"
set graceful-shutdown-community "gshut"
set graceful-shutdown-local-preference 27
next
end
end
Initiate the one-time graceful shutdown from FGTA with a delay of 60 seconds:
# execute router clear bgp ip 2.2.2.2 gshut delay 60
Once graceful shutdown mode is enabled on FGTA, it will notify FGTB of the shutdown by advertising the gshut community.
On FGTA:
# get router info bgp summary VRF 0 BGP router identifier 1.1.1.1, local AS number 65412 BGP table version is 5 1 BGP AS-PATH entries 1 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 2.2.2.2 4 65412 444 464 5 0 0 00:00:52 3 (In gshut) Total number of neighbors 1
FGTB’s learned routes will change community and apply the configured local-preference of 27 as in Example 1. After 60 seconds, BGP session will be terminated and routes from FGTA will be removed from FGTB.
Example 3: Apply graceful-soft BGP shutdown using persistent configs
Instead of completely shutting down BGP on the initiator, apply graceful-soft so that after the delay timeout, BGP reverts to normal behavior. BGP graceful shutdown receiver reverts the local-preferences of its routes.
On FGTB, the graceful BGP shutdown receiver, apply the same BGP configurations as Example 1.
On FGTA, the graceful-soft BGP shutdown initiator, apply the following BGP configurations:
config router bgp
set as 65412
set router-id 1.1.1.1
set bestpath-cmp-routerid enable
set ibgp-multipath enable
set cluster-id 1.1.1.1
set graceful-restart enable
config neighbor
edit "2.2.2.2"
set advertisement-interval 5
set activate6 disable
set capability-graceful-restart enable
set ebgp-enforce-multihop enable
set next-hop-self enable
set shutdown graceful-soft
set soft-reconfiguration enable
set remote-as 65412
set keep-alive-timer 30
set holdtime-timer 90
set update-source "loopback1"
set graceful-shutdown-community "gshut"
set graceful-shutdown-local-preference 221
set graceful-shutdown-delay 300
next
end
end
Once graceful shutdown mode is enabled on FGTA, it will notify FGTB of the shutdown by advertising the gshut community:
# get router info bgp summary VRF 0 BGP router identifier 1.1.1.1, local AS number 65412 BGP table version is 12 1 BGP AS-PATH entries 1 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 2.2.2.2 4 65412 599 643 12 0 0 00:00:58 3 (In gshut) Total number of neighbors 1
# get router info bgp neighbors | grep shut In graceful shut down , will go back to normal in 221 seconds
FGTB’s learned routes will change community and apply the configured local-preference of 27:
# get router info bgp network 172.16.207.2/32
VRF 0 BGP routing table entry for 172.16.207.2/32
Paths: (1 available, best #1, table Default-IP-Routing-Table, graceful shutdown)
Not advertised to any peer
Original VRF 0
Local
1.1.1.1 from 1.1.1.1 (1.1.1.1)
Origin incomplete distance 200 metric 0, localpref 27, valid, internal, best
Community: gshut
Advertised Path ID: 1
Last update: Fri Sep 27 08:15:23 2025
After the delay time, both FortiGates will go back to normal mode:
On FGTA:
# get router info bgp summary VRF 0 BGP router identifier 1.1.1.1, local AS number 65412 BGP table version is 12 1 BGP AS-PATH entries 1 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 2.2.2.2 4 65412 612 657 12 0 0 00:06:24 3 Total number of neighbors 1
# get router info bgp neighbors | grep shut
On FGTB:
# get router info bgp network 172.16.207.2/32
VRF 0 BGP routing table entry for 172.16.207.2/32
Paths: (1 available, best #1, table Default-IP-Routing-Table)
Not advertised to any peer
Original VRF 0
Local
1.1.1.1 from 1.1.1.1 (1.1.1.1)
Origin incomplete distance 200 metric 0, localpref 100, valid, internal, best
Advertised Path ID: 1
Last update: Sat Sep 27 08:17:37 2025
Example 4: Apply one-time graceful-soft BGP shutdown using execute command
Instead of using persistent configs like in Example 3, use the following execute command to perform a one-tine graceful-soft BGP shutdown:
# execute router clear bgp ip 2.2.2.2 gshut soft delay 100
After run this command on FGTA, FGTA will go into graceful shutdown mode, and FGTB will set community and local_pref value for all routes learned from FGTA.
After the delay time of 100 seconds, FGTA will go back to normal mode, and peer will restore the community and local_pref value for all routes learned from FGTA.
Example 5: Apply graceful BGP shutdown with indefinite delay using persistent configs on IPv6 routes
In this example, we apply graceful BGP shutdown mode indefinitely. IPv6 routes on the graceful BGP shutdown receiver will keep routes in the graceful-shutdown-local-preference indefinitely while in this mode.
On FGTB, apply the following configuration:
config router bgp
set as 65412
set router-id 2.2.2.2
set network-import-check disable
config neighbor
edit "2000::1:1:1:1"
set activate disable
set soft-reconfiguration6 enable
set remote-as 65412
set keep-alive-timer 30
set holdtime-timer 90
set update-source "loopback1"
set graceful-shutdown-community "gshut"
set graceful-shutdown-local-preference 276
next
end
end
On FGTA, apply the following BGP configurations:
config router bgp
set as 65412
set router-id 1.1.1.1
set bestpath-cmp-routerid enable
set ibgp-multipath enable
set cluster-id 1.1.1.1
set graceful-restart enable
config neighbor
edit "2000::2:2:2:2"
set advertisement-interval 5
set activate disable
set capability-graceful-restart6 enable
set shutdown graceful
set soft-reconfiguration6 enable
set remote-as 65412
set keep-alive-timer 30
set holdtime-timer 90
set update-source "loopback1"
set graceful-shutdown-community "gshut"
set graceful-shutdown-local-preference 2216
set graceful-shutdown-delay 0
next
end
end
When set shutdown graceful is configured, FGTA is in graceful shutdown mode indefinitely:
On FGTA:
# get router info6 bgp summary VRF 0 BGP router identifier 1.1.1.1, local AS number 65412 BGP table version is 10 1 BGP AS-PATH entries 1 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 2000::2:2:2:2 4 65412 3235 3243 10 0 0 17:00:28 1 (In gshut) Total number of neighbors 1
On FGTB:
# get router info6 bgp network 2000:172:16:211::/64
VRF 0 BGP routing table entry for 2000:172:16:211::/64
Paths: (1 available, best #1, table Default-IP-Routing-Table, graceful shutdown)
Not advertised to any peer
Original VRF 0
Local
2000::1:1:1:1 (metric 1000) from 2000::1:1:1:1 (1.1.1.1)
Origin incomplete distance 200 metric 0, localpref 276, valid, internal, best
Community: gshut
Advertised Path ID: 1
Last update: Fri Sep 26 15:41:04 2025