To establish an eBGP session using loopback interfaces, two specific configurations are required. First, the update-source command must be used to change the source IP address of the BGP packets from the physical egress interface to the loopback interface's IP address.

Second, by default, eBGP peers are expected to be directly connected (TTL=1), a rule enforced by ebgp-enforce-multihop. Since loopback interfaces are not physically connected, this enforcement must be disabled (set ebgp-enforce-multihop disable) to allow the BGP session to establish between these non-adjacent IP addresses.

ibgp-enforce-multihop: This command applies to internal BGP (iBGP) sessions within the same autonomous system, not to an external (eBGP) session with an ISP.

recursive-next-hop: This setting relates to the resolution of the next-hop attribute in BGP route advertisements, not the establishment of the BGP peering session itself.

1. FortiOS 7.6.0 CLI Reference

config router bgp section

page 1789.

update-source : "Enable/disable use of the interface as the source IP address of BGP connections." This confirms the need to specify the loopback interface.

ebgp-enforce-multihop {enable | disable}: "Enable/disable enforcement of single-hop for EBGP neighbors." The default is enable. This confirms the need to disable this setting for loopback peering.

2. Fortinet Cookbook

"eBGP configuration using loopback interfaces" recipe.

This guide explicitly details the configuration steps for establishing an eBGP session using loopback interfaces

stating: "On both routers

it is necessary to configure set update-source to use the loopback interface as the source of the BGP traffic

and set ebgp-multihop enable [or set ebgp-enforce-multihop disable in modern FortiOS] because the peer is not directly connected."