BGP Route Reflector postion

Yangjp715 · ‎10-17-2017

Hi All,

We are planning to put a Palo Alto firewall in datacenter between the edge router ASR and two Nexus 9Ks. the existing BGP route reflector is 2911. i was wondering do i need to configure Firewall as RR or i can use the existing RR 2911?

Thanks in advance!

Eric

Julio E. Moisa · ‎10-17-2017

Hi,

You could keep the 2911 as RR but if the ASR will use BGP as well you need to allow the TCP port 179 on the firewall in order to allow the BGP communication between routers. Do you have just a RR as router? it could be a point of failure, you could connect the 2911 with the next Router (right) to be RR as well with different cluster-id.

>> Marcar como útil o contestado, si la respuesta resolvió la duda, esto ayuda a futuras consultas de otros miembros de la comunidad. <<

Yangjp715 · ‎10-18-2017

Hi Julio,

Thanks for the quick reply.

I have the following questions:

1. Where is the best position to put RR. Is it must be the second node in IBGP? eBGP <-> eBGP/iBGP <-> iBGP/RR <-> Clients? If so, in our network. The ASR is the first node. N9k must be the RR? Is that correct?

2. Right now the FW is connected to two N9Ks. ASR is connected two N9Ks as well. We are planning to let all traffic pass through the FW for security reason. Can i keep the current design to get this requirement?

We have two datacenter in the AS 200. Another 2911 is RR as well in the second datacenter.

Thanks,

Eric

Yangjp715 · ‎10-18-2017

Hi all,

Is there anyone who can answer my above questions? Can i configure the FW as RR client?

Thanks in advance,

Eric

Julio E. Moisa · ‎10-18-2017

Hi

Im not really sure if the FW can be executed as RR and it could overload the device, if it is a perimeter FW, it could be installed between the ASR and the routers over the AS100.

>> Marcar como útil o contestado, si la respuesta resolvió la duda, esto ayuda a futuras consultas de otros miembros de la comunidad. <<

Yangjp715 · ‎10-18-2017

Hi Julio,

We have two FWs in each datacenter for redundancy. Now we are planning to get all traffic pass through the FW. ASR is the edge router connected to several SP and other sites. Yes, the FW is perimeter FW. Compare to the FW between the ASR and two N9Ks, what is different if the FW is between the ASR and AS 100?

Additionally, where is the best position to put RR, is it the second node in IBGP?

Thanks a lot.
Eric

Yangjp715 · ‎10-25-2017

Hi All,

Is there anyone who knows the scenario for how to get all traffic pass through the FW based on the above diagram?

Thanks in advance!

Eric