Cisco Support Community
Community Member

Dual BGP router questions


We recently migrated our edge routers to 2 seperate BGP connections to 2 seperate ISP's. Our routers are running firewall feature set.

While we were going throught the issues with the ISP's we had an IP Inspect ftp statement on the inside interface. Once we finally got the second ISP working we noticed our ftp sessions were failing. I move the inspect statement to the new ISP router because it was our preferred path and the ftp started working again. I really need to have the inspect statements on each inside interface but when I add it the original ISP all ftp stops working.

I can provide more detail regarding our routers if need be.

Thanks to any/all that may add input.


Cisco Employee

Re: Dual BGP router questions


It looks to me as if the issue is due to asymmetric routing, which is something you want to avoid at all price when using FWs in the path.


Harold Ritter
Sr. Technical Leader
CCIE 4168 (R&S, SP)
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
Community Member

Re: Dual BGP router questions

Thanks for the reply but from what I was told having 2 ISP's on 2 different routers will have asymmetric routing and that shouldn't be an issue.

These routers are not acting as firewalls except for the ip inspect.

Hall of Fame Super Silver

Re: Dual BGP router questions

Hello Rick,

ip inspect is a smart feature and it works like a firewall: it creates temporary opens if it sees both directions of the flow : the permissions are created if the session setup is seen with asymmetric routing the risk is that the return traffic arrives on the router that hasn't seen the packets in the other directions and that has not opened the temporary permissions traffic is dropped.

You need to try to influence the return path from internet to your AS:

you can use AS path prepending by prepending your own AS number in updates sent to the second ISP (you need to make a choice here if you want to keep using inspect for security or you want to use both ISPs in load balancing without ip inspect)

Hope to help


CreatePlease to create content