BGP and static NAT mapping of hosts via PIX

Unanswered Question
Apr 21st, 2009
User Badges:

We have two sites that have the same RFC1918 ( address space. See picture below. Site A communicates to SITE B server but since SITE A has a network being routed within in it, we had to implement some NATing to allow communications between Site A and the SITE B server

SITE A ( ------> RTR1 -----> WAN1 ----->RTR3 ------> PIX1 ----->RTR5 -----> SITE B ( ----> Server

SITE A ( ------> RTR2 -----> WAN2 ----->RTR4 ------> PIX2 ----->RTR6 -----> SITE B ( ----> Server

Note: SITE A also has a network being routed within it, which conflicts with SITE B. So... here is what we have implemented today:

1. We are running OSPF in SITE A thru to RTR3/RTR4.

2. On RTR3/RTR4 we have a static route for pointing to their respective PIX1/PIX 2 devices and that static route is propagated thru OSPF to SITE A.

3. On PIX1/PIX2 we hide all SITE B addressing from SITE A by static NATing the SITE B server ( to a address on PIX1/PIX2.

4. On RTR5/RTR6 we have a static route for pointing to their respective PIX1/PIX2 devices back to Site A, which the PIXs hide NAT the server address as

We would like to implement EBGP between RTR3-RTR5 and RTR4-RTR6 thru the PIXs so that if we lose WAN1 or WAN2, traffic would be re-routed over the available WAN link versus black-holing today with static routes.

1. The proposal is to EBGP peer between RTR3-RTR5 and RTR4-RTR6, and IBGP between RTR3-RTR4 and RTR5-RTR6

2. We announce SITE A via EBGP from RTR3-RTR5 to RTR4/RTR6 respectively thru the PIX firewalls and we do not announce anything from SITE B into SITE A via EBGP. This will allow SITE B to re-route automatically if WAN1 or WAN2 fails when the SITE B server is communicating with a address at SITE A

3. In order for a address at SITE A to communicate with the server at SITE B, we would continue to route the SITE B server address of as via static routing on RTR3/RTR4 and static NAT via PIXs (mapping to SITE A would re-route if WAN1 or WAN2 failed and the static route for would not be propagated via OSPF to SITE A since a WAN link would be down.

My question: Will this work and is there a better way to do this?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion