BGP query

[darrencarr]

Hi All, We as an organisation are moving away from running static routing for our outbound Internet and are looking to implement a BGP solution with our service provider. We are looking to run the services out of our redundant data centres to provide clients at the business HQ with a redundant path to the Internet. We connect to the two data centres through a redundant managed WAN service. At each site we advertise the local networks at the site to the managed WAN through RIPv2. These routes are then advertised by the service provider through the WAN to a managed router that in turn talks to a layer 3 device that is doing the advertising for each of the sites. The service provider is able to provide a pair of redundant Internet services. A single service will be hosted out of each site. We have been allocated our own private AS number and have formed the relationship between ourselves and the ISP. We have used a Cisco router to form the relationship. The ISP is advertising the ' full route' and the ' default route' to us. We' ve also been allocated a block of public IP addresses (lets say 119.34.67.16/28) that are configured across the two services (sites). We will advertise this block of addresses to the ISP. One of the issues we are having that I need to find a solution for is a method for advertising ONLY the ' default route' to the Fortigate that is sitting behind the router, which in turn will advertise the ' default route' to the RIPv2 process. Once in here it can then be advertised to the business and the other data centre. The default route will be the 0.0.0.0 0.0.0.0 119.224.56.84/30 What would be the best way to go about doing this? I' ve been reviewing the Advanced Routing guide but was looking for some feedback from people who may have done something similar? Diagram: ISP AS xxxx -------->Fa0/0 Cisco Router AS xxxx Fa0/1 ------>VLAN_INT-Fortigate Interface Config (adjusted for example) ISP Neighbour IP: 119.224.56.84/30 Cisco Router Fa 0/0: 119.224.56.85/30 Cisco Router Fa 0/1: 119.34.67.17/28 Fortigate VLAN: 119.34.67.18/28 Thanks, D

[red_adair]

You can work with Access Lists - to only " learn" specific routes through bgp. There are various ways to perform filtering on " incoming route lists" or filtering " distributed lists" . The example would only put routes into route-table that do match the router-access-list.. In reverse we could set action to drop, so it would accept all routes learned, except the ones defined in the access-list example: config router access-list edit " NET_172.160.1.0" config rule edit 1 set prefix 172.160.1.0 255.255.255.0 set exact-match disable next end next end config router bgp set as 10 config neighbor edit " 1.2.3.4" set remote-as 20 set distribute-list-in " NET_172.160.1.0" next end config redistribute " static" set status enable end set router-id 0.0.0.1 end

[red_adair]

Option-B This would actually only accept the def route, all other routes would be dropped consequently. config router prefix-list edit " default_route" config rule edit 1 set prefix 0.0.0.0 0.0.0.0 next edit 2 set action deny set prefix any next end config router bgp set as 20 config neighbor edit 1.2.3.4 set prefix-list-in " default_route" set remote-as 30

[emnoc]

Your post is kinda confusing , but I think what your trying getting at; is you need a default -rpoute from the cisco into Fortigate ? Have you looked at the default-information originate command? be careful, in that will generate a default even if the next-hop for the internet is not present on the cisco. What you need to do is talk to your ISP and have them inject a default-route only, into the cisco and have that pass thru to the fortigate. This way if the Internet ( ISP ASXXX ) goes down, your default route will self-terminate it' s announcement. e.g from one of my routers and ASN router bgp 57XX no network 0.0.0.0 neighbor defaultonly peer-group neighbor defaultonly default-originate neighbor defaultonly prefix-list myprefixes001 out neighbor 216.7.x.9 peer-group defaultonly ! ! ip prefix-list myprefixes001 description allow only default route leak to neighbors ip prefix-list myprefixes001 seq 5 permit 0.0.0.0/0 ! ! ! and on the cisco router, you would do a bgp-to-ripv2 redistribution ! router rip version 2 ! enable verison 2 RIP network 2.0.0.0 ! define the network to run RIPv2 on and where the FGt sits redistribute bgp 200 metric 8 ! redistribute BGP ASN #### into RIP and optional set the metric for this ! Now I' m curious as why RIP when OSPF would be so much better ?

[darrencarr]

Hey guys, Thank you all for your valuable input. I do apologise if the post was confusing it was late last night when I submitted the query. I' ve included a network diagram of what I am trying to achieve. Each site has a distinct IP addressing scheme allocated to it. The HQ will use 10.1.x.x/24, the Prod DC will use 10.2.x.x/24 and the DR DC will use 10.3.x.x/24. These ' local' networks will be advertised into the IP VPN through the respective 172.16.x.x/28 network address using RIPv2 which is what the ISP will support for internal route advertisement into the VPN. The private ASN will be advertised by our ISP to our two sites with the same address block. The ISP will then advertise the ' full' and ' default' route to the Cisco router at each site. I then need to advertise the ' default' route from each data centre, into the VPN to provide Internet redundancy (both default routes would be visible to the firewalls at each site). Assuming the ISP advertises the default route I can then advertise this route into RIP between the sites? Does this make sense? Thanks, D

[emnoc]

Drawing is much better, but even more confusion ( mainly on the right side and specially with IP VPN & the other set of FGTs ) and after trying to figure out what you’re doing or try to accomplish. Now I have a few question & thoughts for you; are you at least worried about asymmetrical routing and how it plays with your 119.x.x.20/28 announcement ? I assuming the 10net are being NAT' d into this segment from either HA-Pair? if yes, that could become an issues later on down the road Does the ISP provider use BGP-MED to manipulate which is the most preferred link into your AS ? Have you or your provider looked at multihoming the internal BGP peers to provide a simple topology ? btw, What is a IPVPN ( a MPLS cloud ? ) ? and how do you use it ? is it truely a layer2 or 3 service Since you have no control over how or which redundant ISP link this comes over, this ( asymmetrical ) could be a big problem. And more so if a host on network 10.2.2.0/24 is nat' d via FGT with inside .7 and the ISP routes the return down the other path at the opposite location. If your hosting from 2 physically sites, and are looking at redundancy between these sites and within the same subnet ( announcement ), You need to really think this thru & build a topology that simple and straight forward ( K.I.S.S ). Distributing a default thru your IPVPN to the far-right side can be doable, and by the use of metric, you can make it ( other RIPv2 default-route ) less preferred, by manipulating the metric of this route ( see above cisco method ) I' ll draw you up a drawing later on what and how I think it would be KISS and get' s you what you need. The route manipulation would be trivial.

[emnoc]

drwg Something like this would be way much better, it provide your dual uplink, and redistributes the defdault route to the FGT. If ISP001 link goes down or the cisco dies, the other side become active and your best path and only path to the internet, You might need to weight the RIPv2 default-advertisemet. BTW, you can get the same thing with OSPF and with a faster convergence time. RIP is god awful slow to react to network changes.

[darrencarr]

Hey Emnoc In your simple drawing you have captured what it is I am trying to achieve! :) Our ISP has configured BGP to the 10.2.x.x network (left side) is the preferred site. A further piece of information that I need to include is this. At our site we run MS ISA on our client workstation. The PROXY server is enforced through a GPO in AD. The DNS server has two IP addresses for PROXY one on the 10.2.x.x network and one on the 10.3.x.x network. A client will randomly select one of these addresses for outbound Internet traffic. I believe this will work as the default route for each site will be the preferred route (the metric of the other side will be higher than the default route for the site). Just to confirm. I would then redistribute the default route into my RIP process. Appreciate this is slow but this is where we are at today. We will push to change this in the future. Now, I have one last query. Our ISP can advertise the ' full' route and the ' default' route. In your experience do you have both advertised or do you just have them advertise the default route? Thanks for all of your help :)

[emnoc]

Will since your peer' d to the same ISP, and all traffic for your 119.x.x.x network is going to terminate thru ISP " XYZ" , just go with the default-route from the ISP provider. This would reduce the overhead on the BGP-router ( cisco private-ASN ) and nothing is to gain with receiving all 300K+ BGP table enrtries ;) You also don' t want to redistribute the 300K+ plus BGP tables entries into RIP for the obvious reasons