Solved

bgp inbound traffic multi-homed failover

Posted on 2012-04-10
19
982 Views
Last Modified: 2012-06-22
I have a multi-homed failover scenario. I advertise my public subnet to ISP1 with normal AS path and prepend the AS path going to ISP2 so that ISP2 will act as the backup. I would expect that for the inbound traffic, everything will go to ISP1. But after inspecting the traffic through the firewall/router, I see inbound traffic going through ISP2 as well. How do I fix that? I only want inbound traffic via ISP2 if ISP1 would go down. Is this something that ISP2 has to do on their end? Thx
0
Comment
Question by:biggynet
  • 7
  • 5
  • 4
  • +1
19 Comments
 
LVL 28

Accepted Solution

by:
Jan Springer earned 251 total points
Comment Utility
ISP2 is not going to prefer exiting its network if it knows about your prefixes and traffic originates from its network.
0
 

Author Comment

by:biggynet
Comment Utility
"ISP2 is not going to prefer exiting its network if it knows about your prefixes and traffic originates from its network."

Not sure I understand what you meant.
0
 
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 251 total points
Comment Utility
If you have two different service providers to which you are announcing your own prefixes and you go to an IP address that is within ISP2, ISP2 is not going to route the traffic off-net to get back to you.  It will prefer its customer (you) routes over external routes.
0
 

Author Comment

by:biggynet
Comment Utility
The block of public IP addresses is from ISP1. So I advertise it to ISP1 and ISP2 (with AS pre-pending). ISP2 will advertise my block with AS pre-pending to the Internet. So the route will be propagated to other BGP peers which will prefer the route of ISP1 over ISP2 for my inbound traffic. It should not see the route through ISP2 as the prefer route. Correct?
0
 
LVL 28

Expert Comment

by:Jan Springer
Comment Utility
If your traffic is destined to ISP2's network, ISP2 is going to send the data back through the directly connected path.  In other words, they most likely have configured their routers to change the preference of the routes of the destination if it is directly connected.

You get to decide how you want to route your packets but, when they hit another provider's network, that provider may decide to do something different.
0
 

Author Comment

by:biggynet
Comment Utility
In a normal situation, my outbound traffic will only go to ISP1 because I setup the weight to have ISP1 as the prefer path. But for the outbound traffic, it should see ISP1 as the only prefer route because the traffic from my network coming out of ISP2 has the AS_path prepending. So all traffic should go only to ISP1 and not ISP2. I don't think ISP2 will change anything in the routes coming from my network.
0
 
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 251 total points
Comment Utility
Your AS path prepending affects routing decisions for traffic coming into your network -- not leaving.  And, as it stands, other networks may make different decisions once your traffic hits their networks..

How are you preferring your outbound path?
0
 

Author Comment

by:biggynet
Comment Utility
router  bgp my_AS_#
network ISP1_block_of_IP_address mask 255.255.255.0

neighbor ISP2_ip address remote_as ISP2_AS
neighbor ISP2_ip address prefix-list OUTBOUND out
neighbor ISP2_ip address route-map MY-OUT out
neighbor ISP2_ip address prefix-list DEFAULT in
!
ip prefix-list OUTBOUND permit ISP1_block_of_IP_address/24
ip prefix-list DEFAULT permit 0.0.0.0/0
!
route-map MY-OUT permit 10
set as-path prepend my_AS_# my_AS_# my_AS_#
0
 
LVL 28

Expert Comment

by:Jan Springer
Comment Utility
Your route-map does not affect your traffic leaving the router.  It tells other routers the path that you prefer for traffic coming into your network.
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 

Author Comment

by:biggynet
Comment Utility
Correct. Traffic coming into my network is inbound traffic. That's what I was trying to explain. I use the weight which is not shown here for my outbound traffic. So in a normal situation, all traffic will go to ISP1 and I SHOULD NOT SEE ANY OUTBOUND TRAFFIC COMING THROUGH MY ISP2 because I have prepending my advertisement through my ISP2.
0
 
LVL 17

Assisted Solution

by:pergr
pergr earned 166 total points
Comment Utility
It is likely that ISP2 (as practically all ISPs) is using not only AS-path but also 'local preference' (LP) in their iBGP.

Typically, ISPs will set the highest LP on routes received from customers.
They will set a medium LP on routes exchanged on free peering, like at internet exchanges.
They will set the lowest LP on routes received from their paid uplinks (typically from Tier 1 ISPs).

This means that when ISP2 has a packet for you, they will send that directly to you.
Obviously, it also means that when any customer of ISP2, who send a packet destined for you to ISP2, then ISP2 will deliver it directly to you.

As ISP2 advertise your route to threir uplinks and peers, it is also possible that various ISPs work with LP and prepends and end up having your route via ISP2 as preferred - and then they will only advertise their preferred route to their uplinks.

You can try adding even more prepends, but in principle you will not be able to completely "zero" the traffic - and honestly I do not understand why you need to.
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
Are the IP addresses you are seeing coming inbound via ISP2's link in blocks that are owned by ISP2?

pergr is 100% correct.  Typically ISP's will route traffic from addresses they own using directly over links that they provide.  

Using the diagram (hopefully it comes through) below the flow would be:

1) Any traffic coming from "Other ISP's and their customers" will get to you over ISP1's link until that link failed.
2) Any traffic coming from "Other ISP1 Customers" will get to you over ISP1's link until that link failed.
3) Any traffic coming from "Other ISP2 Customers" will get to you over ISP2's link until that link failed.

              Other ISP2 Customers
                         /\
                         |
                        \/
              /----> ISP2 <---\
YOU <--|                      |--> "Internet" <-- Other ISPs and their customers
              \----> ISP1 <---/

                        /\
                         |
                        \/
              Other ISP1 Customers
0
 
LVL 17

Expert Comment

by:pergr
Comment Utility
For the record, since biggynet mention they have their own AS number (and so are not using a private AS or the AS of one of the ISPs), it does not really matter from where they got their IP addresses.

I even suspect that since they have their own AS number, they probably have their own IP range. Possibly one of the ISPs just helped out with the application and process.
0
 

Author Comment

by:biggynet
Comment Utility
One thing I don't understand is when I advertise my prepending AS_path routes to ISP2. ISP2 will add its AS_path and send it to the peers. Therefore, my routes advertised by ISP2 should not be the preferred one over ISP1. Thus, all traffic destined for my AS, should go through ISP1 and not ISP2.
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
Well, what we don't know which you are implying is that the IP addresses that are coming in via ISP2 are not from ISP2, but from their peers.

Is that what you are saying?
0
 

Author Comment

by:biggynet
Comment Utility
yes. The peers learned my block of IP addresses from ISP2 advertisement which has my route as prepending. What I am saying is my route advertised by ISP2 to the Internet is not the prefer one. My route advertised by ISP1 is the prefer one. Therefore, all the traffic destined for my network will all go through ISP1. Correct?
0
 
LVL 17

Assisted Solution

by:pergr
pergr earned 166 total points
Comment Utility
Keep in mind that Local Preference is used first at route selection. That means that if any router receives via BGP your routes from both ISP1 and ISP2, and then sets a higher Local Preference on the route via ISP2, then that path will be used even if it is longer.
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 83 total points
Comment Utility
Yes, BGP is not designed to allow you to advertise across two different paths and say "never take path2, always take path1".  It is designed to say, "I would like you to take path1."

The only way to prevent any traffic from coming across ISP2's link is not to advertise over that path until the link to ISP1 goes down.
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
Oh, just to make sure, I am NOT recommending that you stop advertising across ISP2 until ISP1 goes down.

I would continue to advertise over ISP2 and just live with the fact that you can't fully control which path the traffic comes in on.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

Security is one of the biggest concerns when moving and migrating your data from your on-premise location to the Public Cloud.  Where is your data? Who can access it? Will it be safe from accidental deletion?  All of these questions and more are imp…
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now