BGP peering with two ISPs

[Richard Dumag]

We have a dual homed internet connections with Zayo and Comcast.  Zayo is the primary internet access using /24 IP address range they had assigned.  

We would like to setup BGP peering with Zayo and Comcast and have Comcast route the /24 IP address range should Zayo have an outage.

Zayo and Comcast will be enabling BGP on the circuits.

Besides setting up BGP with our ARIN assigned ASN on our router and advertising the /24 IP address range, what additional configuration do we need to do on the router enable for this to be successful.

Any information or comment you can provide will be greatly appreciated.  Thank you!

Richard

[MHM Cisco World]

You receive default from both SP?

Do you use NAT?

MHM

[Richard Dumag]

Currently the default is Zayo.  The Comcast circuit was just installed and hasn't been setup yet.  Yes, we use NAT.

[MHM Cisco World]

For bgp

Neighbor <ISP1> route-map ISP1 in 

!

Route-map ISP1 permit 10

Set weight 5000 <- the highest weight prefix will prefer 

MHM

[MHM Cisco World]

For NAT dynamic 

Route-map ISP1-NAT permit 10

Match interface <ISP1>

!

Route-map ISP2-NAT permit 10

Match interface <ISP2>

!

Ip nat inside source route-map ISP1-NAT interface <ISP1> 

Ip nat inside source route-map ISP2-NaT interface <ISP2>

MHM

[MHM Cisco World]

For NAT static 

Ip nat inside source static <private IP> <public IP ISP1> route-map ISP1-NAT

Ip nat inside source static <private IP> <public IP ISP2> route-map ISP2-NAT

MHM

[Joseph W. Doherty]

If you have your own ASN, you should have your own public IP address block too; not one from either ISP.  So, I'm a bit confused that your one ISP has provided you a /24.  Could you clarify this?

If you "own" you own public IP and AS, you would peer with both providers, sending them your public IP address block, with your AS.  In turn, they can send you full Internet routes, a subnet of the full Internet routes with a default, or just a default route.

It's advisable you don't relay one ISP routes to the other, although likely they would filter them out if you did. 

If you only want to use one provider's path at a time, reserving the second for backup, you can easily prefer it for outbound traffic,  Inbound traffic would probably best be done with conditional BGP address block advertisement.

[Richard Dumag]

When we ordered the circuit from Zayo, we also ordered from them a /24 IP block for NATting users and online services.  Then we decided to have a backup internet circuit in case Zayo goes down. 

We then contacted Comcast about our plan for a backup internet circuit, they suggested BGP peering, as long as Zayo allows Comcast to route their /24.  So, we asked Zayo if they would let Comcast route the /24.  Zayo said yes and there will be forms to fill out and setup cost.  They also advised that we get our own ASN from ARIN, which we did.

Also, enable for the BGP peering to work, both internet circuits need to be BGP enabled by both ISP.

So, it sounds like once both ISP have enabled BGP on the circuit, it's just a matter of setting up BGP routing on our router using our ASN and adding both Zayo and Comcast as neighbors using their ASN and advertising the /24.  It sounds pretty straight forward but I wanted to check here if there are other configurations that need to be setup and don't want to miss anything that could cause an outage when we're ready to implement.

[Joseph W. Doherty]

Okay, so it sounds like you get to use the one's ISP /24 as if it were your /24.  (Since IPv4 IPs were depleted, guess that's now about the only way to obtain a public /24.)

In that case, also appears you understand eBGP multi peering.

Again, the two big considerations are do you use both ISPs concurrently or primary/backup, and what Internet routes you take from your ISPs.

If you do use both ISPs, concurrently, then you also can consider how to load balance the two ISPs.

[Richard Dumag]

Thank you MHM and Joseph for the information!  I have attached our topology for reference.  We are NATting at the firewall.

Joseph, our plan is primary/backup where Zayo is the primary and Comcast is backup.

My sample configuration on our Layer3 switch are as follows:

router bgp 3333
network 67.x.x.x
neighbor Zayo IP remote-as 1111
neighbor Comcast IP remote-as 2222

I won't be advertising any inside IPs.  Zayo will be the default route with admin 0 and Comcast with admin 1.

Am I in the right path?  Or should I seek professional services for this?

Thanks again for any information you can provide.

Richard

[Joseph W. Doherty]

You're on the right path.

If your device is actually a L3 switch, unless it's one of the top of the line models, it may be unable to take a full Internet route table, let alone two of them.  (Since you only want to use one ISP at a time, just taking the default route from your ISPs is all you need to do.)

Outbound, you might use local preference to prefer the Zayo connection.

For inbound, to preclude outbound traffic on Zayo not coming back on Comcast, you might try the (some what traditional) prefixing your ASN, multiple times, when you send your /24 or Comcast, or as I mentioned before, if supported, use BGP conditional advertisement.

[Richard Dumag]

Thanks Joseph.  I'm thinking partial route to minimize resource usage.  I will definitely look at the possible recommended solutions and do some testing in lab before doing it in production.  Will let you know how it goes.

Richard

[MHM Cisco World]

Can you elaborate more about prefix 67.x.x.x ?

MHM

[Richard Dumag]

Yes, so 67.x.x.x /24 is the IP range assigned to us by Zayo.  We use it for NATting internet access by users and online services at the firewall. 

For example:
67.x.x.250 - 254 is NATted for internet access
67.x.x.10 is NATted for public web server 1
67.x.x.11 is NATted for pubic web server app 1
67.x.x.12 is NATted for public web server app 2 
etc.

[MHM Cisco World]

if it assign by Zayo then only Zayo can forward this traffic, Comcast can not handle traffic to this ports 
so the best solution here is push these IP to interface connect to Zayo

MHM