BGP Routing

[Network Pro]

Hi 

This is my topology

   BGP Router (100.100.100.1/25)

         |

  |

___________

|        Switch |---------------------Production ASA (100.100.100.3/25)

|__________|----------------------DMZ ASA (100.100.100.4/25)

|

DMZ Network (100.100.100.129/25)

My public ip address is say for instance 100.100.100.1 for BGP router and advertising out 100.100.100.0/25. the outside for Prod ASA is 100.100.100.3 and DMZ ASA is 100.100.100.4

I have a null route on the BGP router "ip route  100.100.100.0 255.255.255.0 Null0"

Now I need a DMZ network 100.100.100.129/25 on the DMZ Firewall - how does this work - do i need any static routes ? I have created the DMZ interface but just need the static routes 

do I need this on the BGP Router ip route  100.100.100.128 255.255.255.128 100.100.100.129

[Philip D'Ath]

Assuming the BGP router is already advertising 100.100.100.0/24 to the upstream,  the BGP router just needs a static route added.

ip route  100.100.100.128 255.255.255.128 100.100.100.4

[Network Pro]

Thanks just noticed that i had a typo..

ip route  100.100.100.128 255.255.255.128 100.100.100.4

but when i added this previously , there was an outage, not sure if this was caused due to ISP or because of this route(could be coincidence)

how does this route work - will this not cause any routing loop ?

[Philip D'Ath]

Why would this cause a loop?  A loop between what devices?

[Network Pro]

the whole BGP session was down and changed state to Active, but it could be a coincidence as well

how does this work, so the above static route will advertise out to ISP saying to reach the DMZ subnet go through DMZ Outside Interface, right?

[Philip D'Ath]

I assume the BGP router is yours.  The static route does nothing but control your internal routing, directing the subnet to the right ASA.

It is up to the BGP router to advertise what is required to the ISP.

[Network Pro]

yes i thought as well it could not impact but it was a real coincidence really!

so when i have the static route and null route it would not cause any issues right ?

ip route  100.100.100.128 255.255.255.128 100.100.100.4

ip route 100.100.100.0 255.255.255.0 Null0

[Philip D'Ath]

That is fine.  You should also have a static route for 100.100.100.0/25 going to the production ASA.

[Network Pro]

Prod ASA does not have any DMZ. 100.100.100.3 is outside interface ip

only DMZ ASA have DMZ interface subnet (100.100.100.128/25) and an outside of 100.100.100.4 ip address

now in order for DMZ subnet to reach out to internet will you need the following on BGP router (doesnt seem to work without that):

ip route  100.100.100.128 255.255.255.128 100.100.100.4

[Philip D'Ath · Accepted solution]

Ok.  In that case, you only need the static routes you have given.

[Network Pro]

cool thanks