Thanks Giuseppe

One associated query, with respect to your last statement where you advise : "The suggestion to make easy to use also other routing protocols is to use two different Vlans/ip subnets between the two L3 switches and each ISP router."

Pls explain this part a bit more as I tried my best to conceptualise it but am not sure if I am able to really understand this. How should I use two different VLANs and what net advantage would I get?

Hello Fahim,

>> "The suggestion to make easy to use also other routing protocols is to use two different Vlans/ip subnets between the two L3 switches and each ISP router."

simply to use two different vlans in connecting to your L3 switches

vlan 10

isp1 router

l3 switch1 -- l3 switch2

vlan 20

isp2 router

l3 switch1 --- l3 switch2

to perform effettive L3 load balancing and fault tolerance whatever service they use (L3 VPN or L2 VPN) both providers have to present you a router with an interface.

I think BGP is a good choice because other protocols may reflect in some aspects the underlying service type.

Of course you need to setup BGP with both not only the new one.

Hope to help

Giuseppe

Giuseppe, the provider who gives me Layer 2 VPN at the edge, would he be able to take part in the BGP AS? Pls advise!!

Hello Fahim,

if one provider gives you a L3 service and the other one a L2 only service this is a problem for the load-balancing objective.

In fact, you may face the need to compare an eBGP path with an iBGP path and this can lead to a situation where it is easy to achieve redundancy but not to achieve load-balancing.

on the l2 path there is no service provider router to have an eBGP session with but it is like a direct link from your point of view.

so BGP would prefer eBGP path so L3 VPN provider would be preferred.

If using OSPF instead the L2 VPN path would be preferred (because it can provide internal routes while the L3 VPN PE can provide external paths).

if the provider implements correctly OSPF as PE-CE protocol the L2 VPN path can be seen as a backdoor path and the provider needs to add complexity using OSPF sham-links.

With some tuning the two paths can be used with OSPF to provide both redundancy and load balancing but requires stric cooperation with L3 VPN provider to adjust parameters.

see

http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_ospf_com_backbone_ps6350_TSD_Products_Configuration_Guide_Chapter.html

Hope to help

Giuseppe

"For instance, you asked about GLBP, but your diagram shows 3750s, which I don't believe support GLBP."

Yup, you're right. The 3750s do not support GLBP. I had to research that a few months ago.

Thanks for the reply Joseph.

To answer your points and seek further inputs;

Currently, we don't run any dynamic protocol with our original VPN provider. The new one maintains that they are willing to provide connectivity at Site 1 as Layer2. Do you feel I should ask for the end node to be Layer 3 instead?

The new guys are also willing to give us an option of either static routing or eBGP at all three locations.

I do agree with your point though that static routes on both providers will leave me blind to path problems.

If I get both ISP's to allow me do eBGP on both providers, would it take care of both load balancing and and auto redundacy?

Say, I upgrade my two core switches from 3750s to 4500 series of cisco, would I be in a better to design around GLBP and reduce dependency on providers? Pls advise!!

Finally, I am in a position to get the VPN provider (one of them) do things for me but the turnaround time is something which I am really disappointed but given that I have a clear idea of the best way forward, I am willing to take it up.

And yes, I am in a position to implement additional equipment? which you would feel will fit the bill. We have already decided and started to purchase riverbed's for WAN optimisation. If there has to be one more, so be it?

It's unclear, to me, what your complete physical and logical topology is today. You note you don't do any dynamic routing, but do you do any static routing? You note original provider is willing to provide L2, but what do they provide now, L2 or L3? In other words, do all sites look like the site 1 in your diagram, i.e. you have local device (L2 or L3?) and it connects to provider's router? Does each site have its own subnet or subnets, or does you whole environment share one subnet? If each site has it own subnet or subnets, do you "see" other sites' subnets, or do you only see a transit subnet or subnets? (E.g. each site just has a default route to the WAN?)

It's not really so much a question of whether you can do eBGP with the providers or not, but whether you have a L3 topology and whether you can exchange information (dynamic routing) about that topology with the providers. Having that will allow redundancy with both providers. If they support similar dynamic routing, it often makes it easier to also load share.

For equipment, I wouldn't see a 4500 much of a benefit vs. a 3750. Although the 3750 doesn't support GLBP, I suspect Cisco didn't see the need for it to do so since you can stack them. The 3750 also supports various routing protocols with the advance feature IOSs.

What I had in mind for other equipment, might be full fledged routers (e.g. ISRs). Also unclear whether you would need them, but they offer features not available in both the 3750 or 4500 series.

Since you've noted the original provider is slow to implement change, depending on what they do now, it might be possible to use them as is. You would then "work around" them by some combination of how you have provider 2 build out and what you do with equipment under your control. Another reason I asked about your willingness to buy equipment, you might be able to lessen your dependency on provider 2, too. That might be done by "working around" provider 2 also, or by taking over some of the features that provider 2 supports. For example, instead of the provider managing the WAN router, you do.

One important thing to keep in mind, if you don't have the expertise for doing all this yourself, you might want to retain local consultation. Doing this correctly is too complex for suggestions from this forum unless you have the necessary expertise. If you do, they can provide great ideas that you may not have thought of, if you don't, these forums might be used for a 2nd opinion.

Hi Joseph, having given due thoughts to your statement that said " Doing this correctly is too complex for suggestions from this forum unless you have the necessary expertise", I would still want to know from you as to what are my options to by additional equipment and do a 'workaround' both the ISPs?

I have come across various WAN link load balancers by F5 and Barracuda's but they don't seem to fit the bill.

Do you have something specific in your mind?

Pls advise!!

"Do you have something specific in your mind? "

No, because I also wrote "It's unclear, to me, what your complete physical and logical topology is today.", which was followed by some questions highlighting some unknown items. However, load balancing via dynamic routing might be part of a solution.

It might be possible something can be done to "workaround" both ISPs, but what that something, or somethings, might be is constrained by your environment. It's hopeful, though, that you can obtain additional equipement, if necessary, since this often makes possible options.

As for " Doing this correctly is too complex for suggestions from this forum unless you have the necessary expertise . . .", that was in context "doing all this yourself".

I think these forums are great for answering specific technical questions and/or addressing concepts, but if you do need a "complex" design and/or implementation, especially to work around your service providers, might be difficult to accomplish based just on forum suggestions.

Thanks for the advise Mohamed.

When you say I need to connect botht he routersm do I need to connect them using an inbuilt interface, one to one? The two routers are 2800 series so I might need to add an interface HWIC and use Virtual VLAN addressing mechanism to assign a Layer 3 IP.

To asnwer your query, I currently have no connectivity betweem ISP1 and ISP2 except that they both reside in my data center.

My inability to get anything out of ISP1 apart from the core services configured at the starting, is puching me to try out ISP2.

ISP2 is willing to give me administrative access over their router which ISP1 doesn't but I can always pressure them if I am clear of my needs to make the two links work in the most optimal way.

Pls advise!!