I'll try to explain the diagram (attached below) and then relate my question . The question appears a bit long because I tried to simplify it as much as possible for you guys to understand so don't be scared by the length of it . ;)
So, until recently, we had single MPLS VPN provider, connecting all over our offices and life was simple with static routes and no IGP or EGP configured (except maybe within the provider MPLS cloud).
Then we decided to reduce our dependence on a single service provider and brought in a second MPLS Service provider. Now we need to architect around the new scenario of connecting offices on separate MPLS clouds with most optimal utilisation to the investment.
Hence, soon we'll have two MPLS circuit providers, termed in the diagram as ISP1 and ISP2. The two routers attached to ISP1 & ISP2 cloud are not under our administration but would reside in our premises; at all our Sites 1, 2 & 3.
An expanded Site 1 shows that both the MPLS circuits terminate in our datacenter of Site 1. On the ISP1 MPLS cloud and ISP2 MPLS cloud are different sets of offices and some of the times, the need of an office connected to ISP1 is to directly talk to another office on ISP2 without having to do anything with our Site 1 office or enter our internal LAN. Internal LAN has a pair of Cisco Core switches configured in HSRP mode with one of them being active and forwarding traffic. The MPLS links bandwidth varies between 4-8Mbps.
So what we decided is, first to optimise traffic by placing a WAN optimiser (could be Riverbed, Cisco, Bluecoat etc.. not yet decided). Wan optimisers do not yet have the capability to route the traffic neither are meant to.
Design needs:
1. Automatic failover of links with some sort of active load balancing;
Solution 1: Bring ISP1 and ISP2 to participate in our side of BGP and configure BGP on Cisco switches ( emulating CE) with PE routers ( ISP1 Router1 and ISP2 Router1) , lying in our premises.
Concern 1: Would this mechanism bring about auto redundancy in case connectivity to one of the ISPs goes down?
Concern 2: Would there be some sort of arrangement required amongst ISP1 and ISP2 to get this BGP thing working? The two are competitors and might not collaborate with each other but if BGP implementation is independent of these two interacting directly with each other, then it's fine.
Concern 3: Anything else that you can think of??
2. Load balancing across two links
Solution 2: Configure static routing to Sites 2 and 3 that share both links. Assign equal costs to those routes and emulate ECMP concept. For those that do not have both the links yet (Sites 4 and 5), will be having only single route with no ECMP.
Concern 1: Related to concern 1 of solution1 above. When ISP1 Router 1 fails or the whole ISP1 link fails, would the traffic destined to that path be lost and throw the whole network in a tizzy?
3. Security from Malwares
The links provided by the two ISPs are pure pipes and traffic passing through the two MPLS VPN links, though trusted (non internet) but is still coming from disparate geographically spread locations with various degrees of security mechanism implemented internally. The need is to only check the traffic for malwares (Antivirus, Trojans, etc).
Solution 3: Request both ISPs to run some sort of Cisco IPS services on their side of the routers, maybe Ciscos IOS IPS or IPS AIM module insertion.
Or ..have my own inline device in the form of Fortinet/Sonicwall UTM to take care of this aspect.
Concern: Costs??!!! UTM might as well take care of link load balancing and autofailover and I might do away with the configuration of both BGP and ECMP. But most UTM manufacturers talk about Internet links load balancing rather than MPLS VPN associated links.
Now the question is, am I missing something here? Would these concepts work in practise? Has anyone been there done this before?
Pls advise!
Previous related discussions appear here:
http://www.experts-exchang
AND
http://www.experts-exchang
MPLS redundancy
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
pwindell, thanks for reading it through.
I am afraid there is NO public IPs involved in this scenario. It's all private IPs thourgh and through as we never touch the Internet. Conceptually, it's Layer 3 MPLS VPN and I am not sure if there are Public IPs involved even in the ISPs cloud, but from our perspective, we only maintain different Private Ip ranges (10.200.*.*) across all the sites ( 1,2 & 3).
Regards
It doesn't matter if they are public or private. The bahavor of TCP/IP, and the Devices involved does not change. What I said (and shown) is still true.
However the advantage of it being a private closed system is that you may be able to rig up the two L3 switches you have to work together with Dynamic Routing Protocols to handle the loss of a "route". But you may have to also involve the two Provider Routers as well (4 routers would be involved), but I doubt you'd get the two competing ISPs to work together in that manner willingly (there is nothing in it for them),...hence why this should be done with two Lines from the same provider.
That is really all I know to suggest.
Bit of an update to this....
It absolutely matters if it is public of private address space as the designs are vastly different in that if it is public address space you need to design your edge routing to be globally significant - ie the correct exit point from carrier to your network needs to be selected. If it is private address space then your exit points only need to be reflected in the carrier's routing domain and thus you can use local preference (which is likely).
The designs also dramatically change if you, as a business, want to have links to alternate providers for the purposes of redundancy and business continuity. And yes, this is possible. The only catch is you need public address space from the routing registrar for your region, as well as a public AS number.
It absolutely matters if it is public of private address space
It doesn't matter, when kept in the context I meant it,...I was talking about the Physical Layer,... Two lines from the same provider as opposed to doing it "home-user" style with a single line from two providers stuck into a Linksys box from Bestbuy.
I trust that a provider that this would be done through would know how to handle the protocols and the routing,...it is mostly them that is going to "make it happen" then the customer. In each situation I've been in the provider controlled the routers at both ends of the WAN Links,...often the customer doesn't even have to credentials to log into the device. All the customer had to do was make sure their LAN's local routing scheme threw the right traffic at the right router for the right reason.
I could not understand, from where the talk of Internet & Public IP's has come ?? The solution asked was " what design methedology required" in case there are 2 MPLS Service Providers for Primary & Backup MPLS links. I was looking for a solution on this very aspect !!!
Is there anybody to reply on this intelligently !!
1. You are yelling at a thread that is almost exactly a year old and abandoned
2. It isn't your thread, it isn't up to you to judge whether it was answered intelligently or to your liking.
3. Start your own thread and describe your situation to be dealt with.
I could not understand, from where the talk of Internet & Public IP's has come ??
It doesn't matter, and doesn't change anything.
The solution asked was " what design methedology required" in case there are 2 MPLS Service Providers for Primary & Backup MPLS links. I was looking for a solution on this very aspect !!!
Those involved know what was asked,...they were there. A solution was given, whether you accept or approve of the solution does not matter to me.
Rehashing the solution.....
The solution was to not get two connections from two providers. Redundancy within the MPLS System has to come from the provider, not the end user. You can't get the equipment from the two MPLS connections to work together and produce any kind of redundancy if they don't come from the same provider.
If the end user attempts to provide their own solution they could place a Loadbalancer behind the ISP Routers, but that would only cover a failure of one of those routers and would not cover any failures "further out".
That's why there are SLAs and that's why Providers compete/brag about how dependable their services are and how they "never go down". The solution is for providers to be dependable,...the solution is not for the end user to purchase two services from two "crappy" providers and then "dance back and forth" between them hoping they don't both go down at the same time.
Business Accounts
Answer for Membership
by: pwindellPosted on 2009-06-12 at 12:53:49ID: 24615529
The problem is going to be that the Public IP number will change when it changes lines in the failover and may break any sessions that are currently running. It will also incapacitate any incomming traffic because the IP# that is "sought out" by the incomming connection will be tied to only one line from one ISP and will not be available.
The correct approach is to get both lines from the same ISP,...run them into the same Router,...ISP does the same on their end. The routers now use Dynamic Routing Protocols between themselves to handle the load balancing/failover. This kind of service is provieded by any ISP that is worth staying in business. They make it work,..they monitor it,...they maintain it.
Redundant WAN Links