Hi guys,
thanks for your replies.
I am aware of BFD and I am using BFD where required, mainly on routed links between devices, and if required I use IPv4 BFD multihop.
However I am trying to solve the following below, where as I am trying to have BGP end to end through my perimiter firewalls.
This to ensure that the Border routers do not cause a black hole outbound, while ensuring the core only uses the path towards the Border router which is still available end to end.
I would like to have the "control plane" end to end rather than relying on static routes / IP SLA constructs, as the peer may respond to ICMPs but its routing engine is down and or its neigbor is down.
Another thing I would like to cover is that I can ensure the firewall is only routing traffic while its ACL firewall engine and NAT address translation service is still operational.
This is probably the biggest problem currently as I am not aware of any firewall vendor, which injects its ACL engine / NAT engines operational status somehow into the routing process.
Meaning the firewall may still route traffic while its no longer firewalling, hence I could still attract and drop traffic.
If someone has a solution to that, please share!
However coming back to BGP advertise-map / exist-map / non-exist-maps.
It seems hard coded within IOS, and unless some TAC guy shares some Ninja command, this will not change from a 60 second delay, no matter if you configure BGP advertisement-interval 0 or not. It did not work for me, as I had DEBUG IP BGP UPDATES running, and could see the update being advertise up to the border routers, but the border routes would wait until the CONDITION would be met, after approx 60 seconds, then widthdraw the /24 outbound to ISP A/B.
However that is not fast enough for most customers today, with more and more services going to the cloud.
---> Below solution will not converge faster than 60 seconds !!
(Please prove me wrong)
----------------------------
Which brings me to this, once again end to end BGP through firewalls.
However in this instance the CORE devices inside generate the outside /24 prefix via "x.x.x.x/24 Null 0" routes.
Those /24's are then picked up by the BGP and advertised outbound to the ISPs, ensuring there is not black hole in front or at the back of the firewalls.
Also the received default routes are being learned from the ISPs and pushed down to the cores, end to end.
This is probably my new solution, however this still needs to be labbed up and tested.
--------------------------------------------------
A few guys may have noticed the MPLS component, and go, WHY the heck?
Basically we operate two independant firewalls and one decided to partially die, now the idea is to not bind any services to the physical interfaces of the firewalls. Meaning we inject /32's into the MPLS "transit vrf".
This results that we can utilize both border routers for failover having two independant Firewalls. And if a Firewall fails we can easily shutdown the injected loopbacks on the partially failing Firewall, and enable the same configured /32 on the opposite still working firewall, while the default route and advertisements for the /24s outbound still operate.
We use MPLS/L3 VPNs to conserve public IP address space in regards to transit networks required between DC's, as we can span multiple DCs without loosing valuable IP addressing.
Thats some of the background info in order to understand my end to end designs.
Thanks for your replies, comments, and feedbacks!
THX
Colin
