BGP Multihoming ideas

juan-ruiz · ‎05-06-2009

I have two external internet service providers.

I want to introduce internet circuit redundancy on my customer edge internet routers only.

I'm not interested in receiving all routes on my internet edge routers just the default route.

I would like to make one of the Internet circuits as the primary and the other as the secondary.

I host email, web, and some other internet facing applications.

I would like to know what kind of configuration is required to utilize ISP A as the primary and ISP B as the secondary and roll the public IP addresses of ISP A to ISP B so the firewall IP addresses, email, web, and other internet facing applications failover and continue to run on ISP B.

The physical layout is as such

RouterA connected to ISP A

Router B connected to ISP B

Switch A connecting Router A Gigabit Ethernet0/1

Switch A connecting Gigabit Ethernet0/0 for ASA A

Switch B connecting Router B Gigabit Ethernet0/1

Switch B connecting Gigabit Ethernet0/0 for ASA B

The Cisco ASA firewalls configured as HA Primary and Standby

Dual DMZ switches and Dual internal switches that lead into the inside of the network.

I would like some documentation or links that discusses the Dual Internet circuit redundancy. I believe this is called BGP Multihoming but on the document I was reading I did not see the example that the public IP addresses roll over between ISP A and ISP B.

http://www.cisco.com/application/pdf/paws/23675/27.pdf

Thanks a lot

Juan

Collin Clark · ‎05-06-2009

Juan-

Do you have public IP space that is routable between both ISPs? That will have to be your first step. The failover between the two is pretty easy. There are multiple ways to do it. For example with AS-Path prepend.

Using a route amp:

set as-path prepend 65001 65001 65001

juan-ruiz · ‎05-06-2009

Hi yes I do have a routable IP space on both ISP A and ISP B.

I plan to use A since it has 100 Mbps and B only as failover since its 10 Mbps.

Any documents you can share on this type of setup?

The AS-PATH prepend would be the AS on ISP B?

Thanks for the quick reply

Regards,

Juan Ruiz

Collin Clark · ‎05-06-2009

Correct the AS-PATH prepend would be on ISP_B. Here's a config. Assume that my local AS is 65002 and my address space is 75.50.95.0 /24.

router bgp 65002

no synchronization

bgp log-neighbor-changes

network 75.50.95.0 mask 255.255.255.0

neighbor 1.1.1.93 remote-as 65001

neighbor 1.1.1.93 send-community

neighbor 1.1.1.93 route-map ISP_B out

no auto-summary

ip prefix-list 3 seq 5 permit 75.50.95.0/24

route-map ISP_B permit 10

match ip address prefix-list 3

set as-path prepend 65002 65002 65002 65002 65002 65002 65002 65002 65002 65002

I'll see if I can dig up some docs on it.

Collin Clark · ‎05-06-2009

http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/Internet_Edge/InterEdgeOver.html

For great BGP info-

http://blog.ioshints.info/search/label/BGP

dgroscost · ‎05-06-2009

You could also utilize BGP communities assuming your ISPs support them - on the backup link you could send them a community (again, if they offer it) so that advertisements over ISP B is less preferred or not announced to certain peers, etc. I don't think you need to prepend the AS that many times either - wouldn't 3 prepends be enough?

You could also run HSRP/GLBP on the edge routers w/ IBGP so that you have 1 default gateway provided to your ASAs.

juan-ruiz · ‎05-07-2009

This also sounds very interesting.

Could you provide me some examples or docs?

Thanks

Juan

juan-ruiz · ‎05-07-2009

Collin Thanks a lot for the reply

Giuseppe Larosa · ‎05-06-2009

Hello Juan,

>> I do have a routable IP space on both ISP A and ISP B.

if this means you got two public ip addresss blocks one from ISPA and one from ISPB NAT is involved in your solution.

See the following white paper

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a0080091c8a.shtml

the BGP part is like Collin as explained and it is enough if you have your own public ip address block

Hope to help

Giuseppe

visitor68 · ‎05-07-2009

Hi, Giuseppe:

Can you explain your point more?

Why will he need to NAT? Wont he actually need to NAT whether he has his own address space or one assigned by the ISP?

Thanks