What would you do? Multiple ISP routing.

Question

Here is my layout in it's basic form; just acquired 100Mb/s Internet connectivity from a local vendor.It has much less redundancy than our existing infrastructure which hastwo T1's running hundreds of miles in different directions todifferent POPs from the RBOC and a fiber ring between us and our RBOC& another peer.I have a large number of web servers in my DMZ.  I obviously can'tjust re-route this setup to default gateway through the 100Mb/s side.All replies to inbound traffic would then route incorrectly.Because it was easy & I knew how to do it, I setup a transparent proxyin the DMZ and did a re-write rule on the firewall so all outboundport 80 traffic from the LAN gets send to this proxy.  This proxy'sdefault gateway is out through another firewall on the 100Mb/s side.There is a peer which it can talk to which defaults out the slowerpipes.   I can also just disable the re-write rule if there areproblems.I can't transparently do SSL or other traffic.  I could just setupanother firewall, configure my DMZ networks to route specific throughthe old firewall, and have my PC's default gateway through this newfirewall, hooked up to the 100Mb/s connection.  We have a veryrestrictive firewall, so I don't desire recreating that on anotherfirewall.  Nor do I desire two sets of logs.Routers are not my specialty - we have another guy configure those.But it is mostly basic stuff.   I'm learning about policy basedrouting.Could I setup the clients I want to go out over the 100Mb/s connectionto NAT from a specific address on the main firewall, connect the twoCisco routers connected to the Internet together (along with all thepublic routing that entails) and then configure policy based routingso that if the source IP is that NAT address, it defaults to route outto the router on the 100Mb/s Internet and then a higher metric throughmy BGP peers?Does that make sense?  Any pitfalls with this approach?

amigan · Accepted Answer

I don't understand the "It has much less redundancy than our existing infrastructure". Why can't you just have BGP peering with all three Internet access points and use localpref to prefer the 100Mbps out? Seems to me adding another route out of your network should simply increase your redundancy. Use the old T1s as backup. Those routes will only kick in when peering with the ISP for the 100Mbps circuit goes out.

Michael Medwid

edavid3001 · Answer

Multiple ISP BGP peering is a different beast than single ISP BGPpeering.  I'm not sure this old router has enough guts to handle therouting table needed.  As I understand it, multiple BGP peeringrequires my router to cache a much larger routing table.   Also, Idon't have my own space from ARIN...

Merv · Answer

All you need to accept is that number of routes required to make "good" routing decisions.

If you want to route all traffic to new ISP and in case of failure fall back to current iSP, then all you need to do is accept default from both ISPs and local pref the default from the new ISP.

Or you could accept partial routes for each ISP ( their AS + their customers) using AS path filters

Or you could accept full routes if you rerouter has the CPU and memory to handle.

What would you do? Multiple ISP routing.

Join the Discussion

Didn't find your answer?