BGP single site, two ASR1001 routers and 2 ISPs with HSRP between my routers

I have two ASR 1001 routers. One I will connect to ISP A, the other to ISP B. I would like to advertize the same subnet to each peer and use HSRP to have the VIP for the hand off to my firewalls. Ideas? Caveats?
gi2untIT ManagerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Sounds pretty straightforward to me... Do you have any particular concerns?
Daniel SheppardSenior Network Analyst - Core & PerimeterCommented:
I would say you are losing a major feature of BGP by doing it this way (multiple paths).  You are effectively restricting yourself to whichever path is active at a given time using this setup, assuming it is laid out like this:

ASR 1 - Upstream ISP A
ASR 2 - Upstream ISP B
VIP - Downstream to firewalls

If you do it that way, then unless your ASR actually dies, your peer will never failover.  You will also end up with some funky asynchronous routing which could mess up your Firewalls Flow, if your firewall is a flow based firewall.

If you are looking to traffic engineer to force a route, I would instead use BGP Prepending, it will accomplish the same thing, but if a route completely disappears from one peer, but still available on another it will reroute.  Also, I think you are just adding too much complexity.

What firewalls do you have?
gi2untIT ManagerAuthor Commented:
I have 2 asa 5515x.
Daniel SheppardSenior Network Analyst - Core & PerimeterCommented:
What are you trying to accomplish, the ASA 5515-X are capable of using BGP as well, so you could instead do something like:

ISP A                             ISP B
|                                      |
|BGP                                BGP|
|                                         |
ASA-5515-X #1   ===============  ASA 5515-X #2
|      |                         |            |
|       _________________________|________    |
|      |=========================|        |   |
ASA #1                                    ASA #2

Open in new window

This would give you redundancy (x2 ASA + x2 ASR) and allow your edge firewalls to be on the very edge.  The only way you wouldn't be able to do this is if your ASA's are in Multi-Context mode or Transparent.

The other option would be to put the ASA's in Active-Standby and place them behind the ASR's with the ASR's doing the BGP lifting.  What kind of bandwidth are you pushing out each link and what is each link used for?

It all really depends on what you are doing.

Edit: Holy crap ASCII drawings suck on EE

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Architecture

From novice to tech pro — start learning today.