using a /22 over internet

Unanswered Question
Feb 21st, 2008
User Badges:

Hi,


we are doing BGP multi-homing and have to have a /22 APNIC IP pool. The requirement is for site to site VPN, outside firewall machines etc.


I would like to know what are the best practices for advertising the /22 on the internet and the possible IP scheme between my router and firewall. I have thought of using ISP1 as the primary for a /23 and ISP2 for teh remaining /23.


-Sai.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
royalblues Thu, 02/21/2008 - 05:00
User Badges:
  • Green, 3000 points or more

Sai,


My suggestion would be to advertise one block via ISP1 and another via ISP2. You can use AS-Prepend to make one block look less attractive via a certain ISP


Between the router and the firewall, you can use a /23 which should satisfy all your VPN needs and say primarily routed via ISP1. The other pool can then be used for NAT and routed primarily via ISP2


Narayan


saimbt Thu, 02/21/2008 - 05:32
User Badges:

Narayan,


By one block, do you mean a /23 or it is advisable for me to advertise 4*/24 networks?


-Sai.

royalblues Thu, 02/21/2008 - 06:06
User Badges:
  • Green, 3000 points or more

Sai,


I would suggest 2 x /24 block ... It will leave you with 2 more blocks which can be used at another site at a later stage rather than agian going through the APNIC/IRR update process :-)


Edit: I agree with Dandy that whatever you plan needs to updated to the ISPs and should be reflected in a similar way in the internet routing databases (Radb etc)


Narayan

gaurav_thapar79 Thu, 02/21/2008 - 05:32
User Badges:

Hi Sai,

You can advertise 1st prefix via ISP-1 and 2nd prefix via ISP-2. You can use PBR and use AS-PREPEND vis-a-vis in each OUT-PREFIX-ADVERTISE respective Policy.


This will advertise from each peerings and provide fall back option on per prefix as well.

Danilo Dy Thu, 02/21/2008 - 06:02
User Badges:
  • Blue, 1500 points or more

Hi,


Don't forget to tell both ISP to permit /22 because if you tell them that you are advertising only /23, they will put an ACL in the interface of their router connected to your router or a prefix-list for incoming prefix originating from your router just for /23. In the future, you may change your configuration advertising the whole /22 or you swap the advertisement between two ISP, then you will have a problem that you may not immediately see the root cause.


Regards,

Dandy

Actions

This Discussion