Solved

Inbound and Out Bound Traffic Load Balencing in BGP

Posted on 2009-07-09
29
855 Views
Last Modified: 2012-05-07
Hi,

Two ISPs connected to two different routers.

HSRP is running between these routers

we have our own AS number and implemented BGP at present all outgoing traffic is going through one ISP 1 and Incoming is through  ISP 2 due to this one of the ISP is full and another one is free.

we want to enable load balancing  between these two ISP's and also want to know if i want to route particular IP series through one ISP.

At present we are atking full routes from both ISP's

please find below BGP config

Thanks In Advance Please give me solution for this.
BGP-Config.txt
0
Comment
Question by:amitabhg
  • 13
  • 10
  • +2
29 Comments
 

Author Comment

by:amitabhg
ID: 24813268
Thanks in advance and please give me solution for this
0
 
LVL 8

Assisted Solution

by:bsohn417
bsohn417 earned 100 total points
ID: 24818501
User MultiHoming on bgp

there is cisco link with sample config.

http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009456d.shtml
0
 

Author Comment

by:amitabhg
ID: 24821177
Thanks for your reply but in this document there is only one router terminated both ISP links but in my setup both links terminated in different routers.

appreciate if there any option.

as i mentioned at present everything is working fine with incoming through one ISP and outgoing through another ISP but we want to load balance both incoming and out going traffic.

what should i do if i want to  route some incoming and outgoing traffic (specific IPS) through one of the selected ISP.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24831244
You may want to find out if the provider with the congested link offers communities with the option to AS-path prepend other provider ASNs.
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 20 total points
ID: 24831692
I'm not a BGP person, I see if I can have somebody at my work look at it, but it sounds like you have a setup like ours.  If your BGP is setup correctly it should not be sending all traffic out on one link unless that ISP has the prefered routes all of the time.  We have the following setup:

   ISP#1R             ISP#2R
      /\                      /\
       |                       |
      \/                      \/
  OUR#1R <---->  OUR#2R


We have HSRP setup between OUR#1R and OUR#2R.  We only get routes from our ISP's for subnets that are directly attached to them.  So if we get traffic from a subnet that is directly connected to ISP#1 we send it out via that router, if we get traffic from a subnet that is directly attached to ISP#2, we send out the traffic via that router.  If we do have have a route for then, then it uses our default, which is typically ISP#1.
0
 
LVL 6

Assisted Solution

by:602650528
602650528 earned 100 total points
ID: 24833676
Hi amitabhg,

You need to use a combination of route-map and local-preference. You need to create access-list seperating the routes you originate into two e.g route1 and route2. On Router1 make the local -preference for route1 higher than route2 so that route1 uses Router1 as primary route and Route2 as failover. On Router2 make the local-preference of route2 higher than route1 so that route2 uses Router2 as primary route and Router1 as failover. This way you are able to load balance your outgoing traffic

For incoming; use As-path prepend to prepend your AS numbers to the different routes in route-map and this influences what routes is inbound form what ISP.

This link is a good example of what you want done

http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml#conf5

 let me know if this is understood.

0
 

Author Comment

by:amitabhg
ID: 24842896
Hi,

Thanks for your update at present we are using aspath prepend to get fail over of one link.

i am new to BGP ( and really scary about BGP) if you can help me in command reference as per my config its really help us. my main concern is Inbound traffic. we have /23 network.

|     AS 400     |        AS 300
|                      |                                I
|               R1 ----+----- ISP-A ------ N
|               |      |                                T
|  Host --------+      |                         E
|               |      |                                R
|               R2 ----+----- ISP-B ------ N
|                      |                               E
|                      |     AS 200              T

All incoming is coming through ISP B. All out going through ISP A as this router is active for  HSRP.

we have configured below

route-map out permit 10
 match ip address 10
 set metric 100
 set as-path prepend 400

Please let me know if you need more details




0
 

Author Comment

by:amitabhg
ID: 24847497
when we remove   set as-path prepend 400 incoming traffic is coming through both links but if one link fails other link is not taking care the traffic.
0
 
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 280 total points
ID: 24849559
R1 and R2 need to be running IBGP to exchange what they know about the routes.  That way, if BGP loses state or the interface goes down on either router, the routers will know where to send packets.

You should be able to remove any default routes and other BGP configuration statements that manipulate the preferred path.
0
 

Author Comment

by:amitabhg
ID: 24849720
Yes at present IBGP Is running between these routers

Please find below config and let me know what i should change in my config

at present we have /23 network and we advertised this to both ISP's

Incoming traffic is coming through both routers and outgoing is going through Router 2.

when router 2 is Down Router 1 is not taking care of all traffic.

Could you please tell me what i have to change in this and if i want to route some traffic through Router 1 how can i do that...??




Router :1
 

interface Loopback1

 ip address 40.40.41.253 255.255.255.255

!

interface GigabitEthernet0/0

 description "WAN link to ISP 1"

 ip address 30.30.30.240 255.255.255.252

 load-interval 30

 duplex full

 speed 100

 media-type rj45
 

 interface Vlan1

 ip address 40.40.40.2 255.255.255.0

 ip nat enable

 standby 10 ip 40.40.40.1

 standby 10 priority 90

 standby 10 preempt
 

 router bgp 400

 bgp log-neighbor-changes

 neighbor 30.30.0.253 remote-as 300

 neighbor 30.30.0.253 description ISP 1

 neighbor 30.30.0.253 ebgp-multihop 255

 neighbor 30.30.0.253 update-source Loopback1

 neighbor 40.40.40.3 remote-as 400

 maximum-paths 2

 !

 address-family ipv4

  neighbor 30.30.0.253 activate

  neighbor 30.30.0.253 soft-reconfiguration inbound

  neighbor 30.30.0.253 prefix-list MyPublicPrefixes out

  neighbor 30.30.0.253 route-map out out

  neighbor 40.40.40.3 activate

  neighbor 40.40.40.3 next-hop-self

  neighbor 40.40.40.3 route-map IBGP in

  neighbor 40.40.40.3 route-map IBGP out

  maximum-paths 2

  no auto-summary

  no synchronization

  network 40.40.40.0

  network 40.40.41.0

  aggregate-address 40.40.40.0 255.255.254.0

 exit-address-family
 

ip route 30.30.0.253 255.255.255.255 30.30.30.249

ip route 40.40.41.0 255.255.255.0 40.40.40.4

ip route 40.40.41.254 255.255.255.255 40.40.40.3
 

ip prefix-list MyPublicPrefixes seq 5 permit 40.40.40.0/23

ip prefix-list MyPublicPrefixes seq 10 permit 40.40.40.0/24

ip prefix-list MyPublicPrefixes seq 20 permit 40.40.41.0/24
 

access-list 10 permit 40.40.40.0

access-list 10 permit 40.40.41.0
 

route-map IBGP permit 10

 match ip address 10

!

route-map out permit 10

 match ip address 10

 set metric 100
 
 
 
 

Router 2:
 

interface Loopback1

 ip address 40.40.41.254 255.255.255.255

!

interface GigabitEthernet0/0

 description "WAN link to ISP 2"

 ip address 20.20.20.177 255.255.255.252

 ip access-group blockedlist out

 ip accounting output-packets

 duplex full

 speed 100

 media-type rj45
 
 
 

 interface Vlan1

 ip address 40.40.40.3 255.255.255.0

 ip accounting output-packets

 ip nat enable

 standby 10 ip 40.40.40.1

 standby 10 priority 110

 standby 10 preempt

!

router bgp 400

 bgp log-neighbor-changes

 neighbor 40.40.40.2 remote-as 400

 neighbor 20.29.91.185 remote-as 200

 neighbor 20.29.91.185 description ISP2_1

 neighbor 20.29.91.185 ebgp-multihop 255

 neighbor 20.29.91.185 update-source Loopback1

 neighbor 20.20.45.113 remote-as 200

 neighbor 20.20.45.113 description ISP2_2

 neighbor 20.20.45.113 ebgp-multihop 255

 neighbor 20.20.45.113 update-source Loopback1

 maximum-paths 2

 !

 address-family ipv4

  neighbor 40.40.40.2 activate

  neighbor 40.40.40.2 next-hop-self

  neighbor 40.40.40.2 route-map IBGP in

  neighbor 40.40.40.2 route-map IBGP out

  neighbor 20.29.91.185 activate

  neighbor 20.29.91.185 soft-reconfiguration inbound

  neighbor 20.29.91.185 prefix-list MyPublicPrefixes out

  neighbor 20.29.91.185 route-map out out

  neighbor 20.20.45.113 activate

  neighbor 20.20.45.113 soft-reconfiguration inbound

  neighbor 20.20.45.113 prefix-list MyPublicPrefixes out

  neighbor 20.20.45.113 route-map out out

  maximum-paths 2

  no auto-summary

  no synchronization

  network 40.40.40.0 mask 255.255.254.0

  network 40.40.40.0

  network 40.40.41.0

  aggregate-address 40.40.40.0 255.255.254.0

 exit-address-family
 
 

ip route 40.40.41.0 255.255.255.0 40.40.40.4

ip route 40.40.41.253 255.255.255.255 40.40.40.2

ip route 20.29.91.185 255.255.255.255 20.20.20.178

ip route 20.20.45.113 255.255.255.255 20.20.20.178
 

ip prefix-list MyPublicPrefixes seq 5 permit 40.40.40.0/23

ip prefix-list MyPublicPrefixes seq 10 permit 40.40.40.0/24

ip prefix-list MyPublicPrefixes seq 20 permit 40.40.41.0/24
 

access-list 10 permit 40.40.40.0

access-list 10 permit 40.40.41.0
 

route-map IBGP permit 10

 match ip address 10

!

route-map out permit 10

 match ip address 10

 set metric 200

Open in new window

0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24850089
You have two different metrics specified.  Why?
0
 

Author Comment

by:amitabhg
ID: 24850779
This is actually implemented by other guy who is not available at present. I also observed this and when i checked in the documents its telling it will only work when we have two paths from same service provider.
i am planing to remove this.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24850980
I'm also curious as to R2 having two external neighbors.

The issue you may face is that the world may really prefer one path over the other.    Communities using as-path prepend with limited networks via one provider helps to balance the load.

As far as failover, have you verified paths and routes when one link goes down?  Have you verified with your provider(s) that they do not have static routes for your networks to you?
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:amitabhg
ID: 24851206
tanQ for your update

I'm also curious as to R2 having two external neighbors....This is because our ISP asked to put this.

previously (you can check attached Config when i created this ticket) all outgoing is through Router 1 and all incoming through Router 2. yesterday we removed   set as-path prepend 100 from router 1 now incoming is coming through both the routers.

Previously when one link was down all incoming and out going was coming through another link this is not happening now. There are no static rout at our ISP.

please let me know if you need any further info.


0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24851770
With both routes working, can you run a test during low peak and shut the neighbor(s) down on one router -- wait at least 90 seconds for updates to propagate and see if the alternate path woriks?

neighbor 30.30.0.253 shut
0
 

Author Comment

by:amitabhg
ID: 24852526
we did neighbor 30.30.0.253 shut ....all out and and incoming traffic is coming through other router.

we have to check whether same thing is happening or not once we  shutting down the other router peers.

to do this immediately its not possible tomorrow or day after tomorrow we will check this if its needed.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24886427
modus_in_rebus:

I am waiting on the other link to be shut to determine whether traffic reroutes (as it should).
0
 

Author Comment

by:amitabhg
ID: 24888984
Hi We did the other one also but traffic is not going out.

Finally we did  like this.

1. We removed metric in both the routers. Incoming traffic is coming through both the routers.
2. For fail over  we Created a IP SLA to check the availability

interface Vlan1
 ip address 40.40.40.3 255.255.255.0
 ip accounting output-packets
 ip nat enable
 standby 10 ip 40.40.40.1
 standby 10 priority 120
 standby 10 preempt
 standby 10 track 1 decrement 40 ----> if the track object is down then the priority would be lowered by 40
 
 
Below is the configuration for track object:
track 1 ip sla 1 reachability
 
ip sla 1
 icmp-echo 88.87.56.54 source-interface GigabitEthernet0/0
ip sla schedule 1 life forever start-time now
 

2. Outgoing Traffic we diverted our all other site ips towards other link using Local preferences. After this load is sharing between the links.

0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24889710
So, what you're saying is that when the BGP configuration was shut down for the peer(s) on the other router, the BGP routes did not get updated in the first router and that traffic did not re-route?
0
 

Author Comment

by:amitabhg
ID: 24890410
Thanks for your reply

yes Incoming traffic is coming but out going is not going. may be its because of IBGP route map as we are not advertising routes through IBGP as we are taking full routes from both  ISPs.

Please let me know if  i am doing some thing wrong here or if there is any better alternative for this.
0
 
LVL 28

Accepted Solution

by:
Jan Springer earned 280 total points
ID: 24891076
I would setup a unique ACL and permit all netblocks at the /24 level, apply it to your IBGP neighbor advertisement.
0
 

Author Comment

by:amitabhg
ID: 24892750
You mean our Own netblocks....??

fi its our own netblocks we are  already advertising.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24894492
To summarize:

* both paths inbound are currently being utilized after tweaking configuration
* primary router inbound and outbound work when backup router peer is disabled
* when primary router peer is disabled, traffic comes in via backup router but outgoing traffic is not leaving the network

If the primary router LAN interface is up and is also the default gateway for the LAN; and the primary router peer is down, the local area network traffic is not routing to the backup router?
0
 

Author Comment

by:amitabhg
ID: 24895254
yes you are correct.

to over come this we created Track in vlan to wan interface.when its not reachable it will automatically decrement priority valu to 40 and second router become active then all out going traffic is going our properly to ward other router.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 24895359
With that scenario (primary down) and you traceroute to an IP off net from a LAN PC, the traceroute dies at the primary router?

What do you see with a:

sh ip route <IP>
sh ip bgp <IP>
sh ip bgp sum
0
 

Author Comment

by:amitabhg
ID: 24912087
At present i cant check this immediately because i have to revert back all my changes to check this.

at present its working as we wanted after we made changes as per above  changes comment.(07/19/09 04:31 PM,) and we allowed both EBGP peers in IBGP.

1.All  outgoing default its going to router1.
2.There we diverted traffic to Router 2 using local preferences.
3.Incoming is coming to both Routers.
4.When Router 1 is down (weather its router physically down or BGP peer down) its diverting traffic to other router this is happening because of  IP SLA and Track in VLAn .

Thanks to all for your support.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

This article is a step by step guide on how to create a basic PTP link using Ubiquiti airOS devices. This guide can be used on the following Ubiquiti AirMAX devices. Nanostation, Bullets, AirBridge, Nanobeam, NanoBridge to name a few. Please review …
If you are thinking of adopting cloud services, or just curious as to what ‘the cloud’ can offer then the leader according to Gartner for Infrastructure as a Service (IaaS) is Amazon Web Services (AWS).  When I started using AWS I was completely new…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now