I was wondering if I could get some help with a BGP config.
In one of our offices, they have a single Internet connection (10Mb), DMZ, and LAN.
They're in the process of setting up some new web servers in the DMZ and a new /2nd Internet connection (4Mb)
This office wants to have the new DMZ web servers go out the new/2nd Internet connection. Everything else (existing DMZ server traffic, user web browsing, site-to-site VPN traffic, etc) should go out the existing 10Mb Internet connection.
Network diagrams are attached here.
I'm much more of a BGP noob than I'd like to be but am thinking that it may be needed to to meet their requirements.
Would I be able to advertise the new DMZ web servers as /32 networks via BGP and have it be preferred to go in and out the 4Mb link and then advertise the rest of their network as a /24 (or whatever the ISP provides) and have that go in and out the 10Mb link?
Would this work? If so, could someone provide some guidelines as to what needs to be configured in BGP to get this working as needed?
Thanks for the help!
The bellow steps should achieve what you are looking for as well as redundancy:
1- create 2 MHSRP groups , the primary virtual group of the new internet link router where the ASA should point, and the virtual secondary where the VPN router should point (rest of the traffic). Incase of a failure on the lan , the ASA will point to the secondary , this also applicable for the VPN router.
2- create Multiple static routes for the DMZ subnet pointing to the ASA on the primary router, All with /32 and one with /24 advertise them both into BGP.
3- create 1 static route for the DMZ subnet pointing to the ASA on the Secondary router and advertise it into BGP.
4- Modify (Local preference) on the primary router for the /32 subnets and set the local prefernce to 500 for example.
5- Modify the (Local preference) on the Secondary router for the whole /24 subnet and set it to 500 for example.
With the above, you wil ensure all DMZ travers the primary router Net Internet link and have the backup router as redundancy, you will also ensure traffic from outside into your network prefers the primary Internet link for /32 subnets, leaving the rest of the traffic traversing the secondary router.