Friday, November 1, 2019

BGP peering to multiple ISP's, FROM two physically separate FW cores (Internet Services & VPN)

Alright guys, got a though provoker for you. Right now I have two static data centers. Half of my sites come in on one, and half come in on the other. As a result of this being a long time coming, and a 10 hour outage on the main data center last week with lots of angry executives due to no dynamic routing/failover, I have been given the go ahead by management finally to merge the two together and set up BGP peering to each ISP. Here's the catch: One firewall (PA850) runs our public internet services that folks connect to from the internet (i.e. traveler iphone email). This is done by NATing the backend private IP's of the servers to public addressing, setting up DNS and configuring rules, as I'm sure you all have as well. The other core (ASA2110) is the hub for all of our branch site to site VPN's to terminate on. Both firewalls will connect to our 6509 core switch on the inside, and to both ISP's on the outside via eBGP, with a transit switch in between ISP's and my FW's. Here is a drawing I've done to represent this:

https://imgur.com/a/114Br93

The primary requirement of doing this is to ensure that 12.3.250.0/24 is always reachable at all times, even if the primary ISP is down (assumption is BGP will reroute to 2nd ISP due to the advertisement of 12.3.250.0/24 I've configured to said 2nd ISP, and the end result is the internet services, as well as the site to site VPN's would never go down unless I lost both ISP's or hardware.

With that said, here are my concerns:

  1. To achieve this, since I have two physically separate cores (one Internet Services, one VPN), I need to BGP peer both of my firewalls to both of the ISP's, and I need to advertise 12.3.250.0/24 FROM both of my firewalls TO both of the ISP's. In my mind, the way I've always understood routing is you can't tell a router peer that a particular subnet lives in two spots, because then routing won't know where to send it. Now I know that assumes equal weight, AD, costing, etc, and that BGP will not weigh the route the same way since it's all on a common network thanks to the transit switch, so I am thinking the logic in BGP will take care of that if I'm advertising the same subnet from multiple physical points, but I can help but worry about potential routing loops here. Will this work as intended, or am I risking problems here trying to design it this way?
  2. The subnet I need to advertise happens to be the subnet that is in use for comms between my firewalls and the primary ISP's ISR router (because we don't own our own public /24, so we are leasing the ISP's), so the router knows about it already because it's directly connected (see diagram). If that is the case, do I need to advertise it manually in BGP to that peer?


No comments:

Post a Comment