Solved

bgp inbound traffic multi-homed failover

Posted on 2012-04-10
19
1,003 Views
Last Modified: 2012-06-22
I have a multi-homed failover scenario. I advertise my public subnet to ISP1 with normal AS path and prepend the AS path going to ISP2 so that ISP2 will act as the backup. I would expect that for the inbound traffic, everything will go to ISP1. But after inspecting the traffic through the firewall/router, I see inbound traffic going through ISP2 as well. How do I fix that? I only want inbound traffic via ISP2 if ISP1 would go down. Is this something that ISP2 has to do on their end? Thx
0
Comment
Question by:biggynet
  • 7
  • 5
  • 4
  • +1
19 Comments
 
LVL 28

Accepted Solution

by:
Jan Springer earned 251 total points
ID: 37828770
ISP2 is not going to prefer exiting its network if it knows about your prefixes and traffic originates from its network.
0
 

Author Comment

by:biggynet
ID: 37829001
"ISP2 is not going to prefer exiting its network if it knows about your prefixes and traffic originates from its network."

Not sure I understand what you meant.
0
 
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 251 total points
ID: 37829026
If you have two different service providers to which you are announcing your own prefixes and you go to an IP address that is within ISP2, ISP2 is not going to route the traffic off-net to get back to you.  It will prefer its customer (you) routes over external routes.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:biggynet
ID: 37829094
The block of public IP addresses is from ISP1. So I advertise it to ISP1 and ISP2 (with AS pre-pending). ISP2 will advertise my block with AS pre-pending to the Internet. So the route will be propagated to other BGP peers which will prefer the route of ISP1 over ISP2 for my inbound traffic. It should not see the route through ISP2 as the prefer route. Correct?
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 37829149
If your traffic is destined to ISP2's network, ISP2 is going to send the data back through the directly connected path.  In other words, they most likely have configured their routers to change the preference of the routes of the destination if it is directly connected.

You get to decide how you want to route your packets but, when they hit another provider's network, that provider may decide to do something different.
0
 

Author Comment

by:biggynet
ID: 37829340
In a normal situation, my outbound traffic will only go to ISP1 because I setup the weight to have ISP1 as the prefer path. But for the outbound traffic, it should see ISP1 as the only prefer route because the traffic from my network coming out of ISP2 has the AS_path prepending. So all traffic should go only to ISP1 and not ISP2. I don't think ISP2 will change anything in the routes coming from my network.
0
 
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 251 total points
ID: 37829508
Your AS path prepending affects routing decisions for traffic coming into your network -- not leaving.  And, as it stands, other networks may make different decisions once your traffic hits their networks..

How are you preferring your outbound path?
0
 

Author Comment

by:biggynet
ID: 37829733
router  bgp my_AS_#
network ISP1_block_of_IP_address mask 255.255.255.0

neighbor ISP2_ip address remote_as ISP2_AS
neighbor ISP2_ip address prefix-list OUTBOUND out
neighbor ISP2_ip address route-map MY-OUT out
neighbor ISP2_ip address prefix-list DEFAULT in
!
ip prefix-list OUTBOUND permit ISP1_block_of_IP_address/24
ip prefix-list DEFAULT permit 0.0.0.0/0
!
route-map MY-OUT permit 10
set as-path prepend my_AS_# my_AS_# my_AS_#
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 37830199
Your route-map does not affect your traffic leaving the router.  It tells other routers the path that you prefer for traffic coming into your network.
0
 

Author Comment

by:biggynet
ID: 37830631
Correct. Traffic coming into my network is inbound traffic. That's what I was trying to explain. I use the weight which is not shown here for my outbound traffic. So in a normal situation, all traffic will go to ISP1 and I SHOULD NOT SEE ANY OUTBOUND TRAFFIC COMING THROUGH MY ISP2 because I have prepending my advertisement through my ISP2.
0
 
LVL 17

Assisted Solution

by:pergr
pergr earned 166 total points
ID: 37831456
It is likely that ISP2 (as practically all ISPs) is using not only AS-path but also 'local preference' (LP) in their iBGP.

Typically, ISPs will set the highest LP on routes received from customers.
They will set a medium LP on routes exchanged on free peering, like at internet exchanges.
They will set the lowest LP on routes received from their paid uplinks (typically from Tier 1 ISPs).

This means that when ISP2 has a packet for you, they will send that directly to you.
Obviously, it also means that when any customer of ISP2, who send a packet destined for you to ISP2, then ISP2 will deliver it directly to you.

As ISP2 advertise your route to threir uplinks and peers, it is also possible that various ISPs work with LP and prepends and end up having your route via ISP2 as preferred - and then they will only advertise their preferred route to their uplinks.

You can try adding even more prepends, but in principle you will not be able to completely "zero" the traffic - and honestly I do not understand why you need to.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37832351
Are the IP addresses you are seeing coming inbound via ISP2's link in blocks that are owned by ISP2?

pergr is 100% correct.  Typically ISP's will route traffic from addresses they own using directly over links that they provide.  

Using the diagram (hopefully it comes through) below the flow would be:

1) Any traffic coming from "Other ISP's and their customers" will get to you over ISP1's link until that link failed.
2) Any traffic coming from "Other ISP1 Customers" will get to you over ISP1's link until that link failed.
3) Any traffic coming from "Other ISP2 Customers" will get to you over ISP2's link until that link failed.

              Other ISP2 Customers
                         /\
                         |
                        \/
              /----> ISP2 <---\
YOU <--|                      |--> "Internet" <-- Other ISPs and their customers
              \----> ISP1 <---/

                        /\
                         |
                        \/
              Other ISP1 Customers
0
 
LVL 17

Expert Comment

by:pergr
ID: 37832457
For the record, since biggynet mention they have their own AS number (and so are not using a private AS or the AS of one of the ISPs), it does not really matter from where they got their IP addresses.

I even suspect that since they have their own AS number, they probably have their own IP range. Possibly one of the ISPs just helped out with the application and process.
0
 

Author Comment

by:biggynet
ID: 37835547
One thing I don't understand is when I advertise my prepending AS_path routes to ISP2. ISP2 will add its AS_path and send it to the peers. Therefore, my routes advertised by ISP2 should not be the preferred one over ISP1. Thus, all traffic destined for my AS, should go through ISP1 and not ISP2.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37835645
Well, what we don't know which you are implying is that the IP addresses that are coming in via ISP2 are not from ISP2, but from their peers.

Is that what you are saying?
0
 

Author Comment

by:biggynet
ID: 37835689
yes. The peers learned my block of IP addresses from ISP2 advertisement which has my route as prepending. What I am saying is my route advertised by ISP2 to the Internet is not the prefer one. My route advertised by ISP1 is the prefer one. Therefore, all the traffic destined for my network will all go through ISP1. Correct?
0
 
LVL 17

Assisted Solution

by:pergr
pergr earned 166 total points
ID: 37835975
Keep in mind that Local Preference is used first at route selection. That means that if any router receives via BGP your routes from both ISP1 and ISP2, and then sets a higher Local Preference on the route via ISP2, then that path will be used even if it is longer.
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 83 total points
ID: 37837284
Yes, BGP is not designed to allow you to advertise across two different paths and say "never take path2, always take path1".  It is designed to say, "I would like you to take path1."

The only way to prevent any traffic from coming across ISP2's link is not to advertise over that path until the link to ISP1 goes down.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37837373
Oh, just to make sure, I am NOT recommending that you stop advertising across ISP2 until ISP1 goes down.

I would continue to advertise over ISP2 and just live with the fact that you can't fully control which path the traffic comes in on.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question