Thanks for both of you Jon & Victor

I am thinking on one more scenario, if I can get guidance on it as well, if we change our scenario as shown in the picture below

1. in this case if we configure Router-B in some passive state, so that if Router-A get down, Router B takes over all the traffic, is their any active/active or active/standby we can configure ?

2. is there any risk involved in placing Ethernet from ISPs on L2 switch rather than router ?

3. ofcourse in this case we will not need OSPF, as Router-A & B will look their default primary secondary routes through BGP ?

Hi, Faisal:

"1. in this case if we configure Router-B in some passive state, so that if Router-A get down, Router B takes over all the traffic, is their any active/active or active/standby we can configure ?"

The HSRP solution is Active/standby in the outbound direction. One router forwards traffic while the other is in standby mode. It is active/active in the inbound direction for traffic returning from the Internet.

The OSPF solution can be either active/standby or active/active in the outbound direction, depending on what the PIX sees as the lowest cost OSPF route to the Internet edge. It will also be act/act in the inbound direction for traffic returning from the Internet.

"2. is there any risk involved in placing Ethernet from ISPs on L2 switch rather than router ?"

I'm not sure what function this L2 switch on the Internet edge is supposed to serve. Routers A and B already have L2 adjacency to support HSRP from the southbound switch. If you want to create a L3 path between routers so that if, say, router A's ISP connection fails it can use router B's -- and vise versa -- the original L2 switch is sufficient. EDIT-- Or you can just run a dirct conection between both routers, of course.--EDIT You can create an iBGP connection between the two routers, so now each router will receive a default route from the eBGP ISP connection as well as the other router's ISP connection by using iBGP.

"3. ofcourse in this case we will not need OSPF, as Router-A & B will look their default primary secondary routes through BGP ?"

Jon's suggestion to use OSPF was not for the benefit of the routers, but for the PIX. It will receive OSPF default route advertisements from bouth Internet edge routers and make a routing decision accordingly.

By the way, you forgot to rate our posts to you before.

HTH

Victor

Victor,

I think I couldn't convey my point 1 correctly, let me explain it to you further.

We are connected to ISP-1 physically through Optical Fiber link and with ISP-2 through DSL.

Both ISPs have assigned /30 address for our router interface

Purpose of using L2 switch in the outer side of our router is to split the single optical fiber and single DSL (Ethernet) link into two physical links(please see the last diagram) so that each splitted branch can be connected with seperate router i.e. one with Router-A & the other with Router-B

the question that I want to ask is, is their any way that I can assign the same IP address on a Router A interface connected with branch-1 of Optical Fiber and Router B interface connected with branch-2 of Optical Fiber by keeping the Router-B in standby state, so that if router-A gets down Router-B takes over with the same IP and our ISPs do not need to change address space and neighbor entries in BGP configuraton. or can we configure HSRP on our routers outside interfaces, will bgp work with virtual router (HSRP) ?, is it possible that virtual IP address space can be different from physical IP address space ?

or the only way is that my both ISPs assigned us a /29 address and configure two neighbors in BGP configuration.

English is not our native language, hope that I get my point conveyed to you people.

BR,

Faisal Shahid

lamav wrote:
Jon, I don't like your solution! OK!? 
In fact, I'm not too crazy about you either, **** it.

Victor

Fair enough

Only issue with your solution is if the connections to the ISP are ethernet. If they are and the ISP end goes down the router won't know because it's interface will stay up so the HSRP track will not work. That's why i suggested using OSPF because it will only advertise a default-route internally if it sees a default-route in the routing table and if the BGP neigborship fails because of a link loss OSPF will stop advertising the route.

You could use HSRP and IP SLA as another possible alternative if you wanted.

Edit - actually if memory serves me right you can track a route on the pix itself with v7.2(1) software or later, so if you didn't want to use a dynamic routing protocol between your pix and the routers you could do this instead.

There is always more than one way to get a solution

Jon

Yup...You are quite correct. I was actually thinking SLA but typed tracking. Something got lost between my brain and my hands...could be the brain itself. lol

lamav wrote:
Yup...You are quite correct. I was actually thinking SLA but typed tracking. Something got lost between my brain and my hands...could be the brain itself. lol

Kind of guessed that was what you meant, just thought i'd be a bit difficult

Like you say there is always more than one way to do it and some people don't like running a dynamic routing protocol on the outside of their firewalls even with md5 authentication.

Either of them would work i just thought of the OSPF one because the OP was talking about it.

Jon

I totally agree that there is usually more than one viable solution. That is precisely why I said in my first post that what I was offering was "one possible solution." I thought of the dynamic routing solution -- in fact, I just finished implementing the exact same scenario described here at my last client. I used OSPF and the default information originate command to generate a default route...yadda...yadda...yadda...etc etc. Its just that the static route solution is what came to mind first.

I will say that I sometimes like a static solution if there is nothing gained from using a dynamic one. I like the inherently deterministic nature of static routes...

By the way, rated your post...

Victor

I like the inherently deterministic nature of static routes...

will you please stop using words i have to look up in a dictionary....

just so i don't feel left out i rated yours as well