Solved: Internet redundancy (2 2821, 2 ISPs, BGP, GLBP?, 1 ASA)

dgroscost · ‎10-19-2008

I would like to get some feedback to this design:

2821 - ISP1 (MLPPP NxT1)

2821 - ISP2 (T1)

1 ASA FW

BGP announcing ISP1's /24 block over both ISPs.

Thinking of running GLBP on 2821 routers thus giving the ASA a single default (redundant) route to Internet.

I am not necessarily interested in load balancing/sharing as the MLPPP provides plenty of BW.

Is this a typical design?

If I were to advertise a default route from BGP into OSPF/EIGRP to the ASA (ver 8.x), or even use two default routes (same ASA interface), will that accomplish the same level of redundancy without the additional GLBP design?

Also - assuming this design works, and load balancing is not an issue, is it worth it to receive full internet routes in BGP vs. default routes from ISPs? Both 2821s would run w/ 1GB of RAM.

thanks

Calin C. · ‎10-20-2008

Hi!

Yes, on your routers GLBP/HSRP will use public IP addresses. If you want NAT/PAT on your ASA, then ASA will have a public IP address on the outside interface (from /24 block) with the gw on the "virtual IP". You will do NAT/PAT on ASA through this public IP address from the outside interface.

Good luck!

Cheers,

Calin

View solution in original post

Calin C. · ‎10-19-2008

Hello!

1. If you don't want to use load-balancing features of GLBP, why use GLBP. HSRP is much easier to configure (personal opinion!).

2. You need some redundancy protocol between 2821 routers even if you announce one default route. Think of the following issue. Your 2821's are announcing a default route to your ASA. ASA forward the packets in our case to 1st 2821 (ISP1), but for some reason your connection to ISP1 is broken. Then what? The packet will be dropped. Your 2821's will still announce the default route to your LAN, no matter if their uplink is UP or not. With redundancy protococolo (HSRP, GLBP..) between the two 2821, the packet is switched/routed (in case of uplink to ISP1 for example) from the 1st 2821 to the 2nd 2821 and from there to your ISP2.

3. If you have BGP session with provider and enough memory to support big routing table, let them advertise full internet routes. If they advertise only default gw and they have an error with that particular IP which is your gw, then all your traffic is lost. Let BGP do it's job and dynamically reroute packets.

Hope this is clear for you. If not, please ask and I'll try to answer!

Cheers,

Calin

dgroscost · ‎10-20-2008

Thanks for the input.

Regarding GLBP/HSRP - I would like to retain the NAT/PAT at the ASA level. Am I correct by assuming the GLBP/HSRP configuration on the routers will use public IP addresses from my ISP assigned /24 block? And the "virtual IP" from either config will also be from the public IP block so that the ASA will still be in control NAT/PAT and operate on the edge level as well?

Calin C. · ‎10-20-2008

Hi!

Yes, on your routers GLBP/HSRP will use public IP addresses. If you want NAT/PAT on your ASA, then ASA will have a public IP address on the outside interface (from /24 block) with the gw on the "virtual IP". You will do NAT/PAT on ASA through this public IP address from the outside interface.

Good luck!

Cheers,

Calin