IP ROUTING

[fmugambi]

Hello guys, below is my topology,

I have added internet fw  and introduced ISP on site B.

Before site B resources/ servers would go via mpls to site a to access internet.

I introduced the above to make each site use its own isp respectively.

I ran to challenges, site b resources were not able to get to their isp/internet, until i introduced " ip route 0.0.0.0/0 sitebinternetfw interface. --> which works but causes some issues.

is there a way, to manipulate just internet traffic for site b resources without introducing static entries? and not affecting site a and b from communicating with each other?

[paul driver]

Hello
Can you confirm:

• Are both sites using bgp for ISP connectivity
• Is your LAN traffic from each site running an IGP (such as ospf for example)
• Are you receiving any default route from the isps?

If the answer to the above is true then, you do not need to do very much to accommodate optimal routing and resiliency.

1. create ibgp peering between fw and sites core rtr
2. redistribute local site ospf into bgp ( filtering any default route)
3. advertise via ospf the default route you are receiving from bgp ( default-information originate metric x metric-type 1)

Basic example - SITE A
FW
bgp 1
neighbor <Core rtr> remote-as 1
neighbor <Core rtr> next-hop-self
neighbor <isp1> remote-as 99
redistribute ospf x internal external 1 external 2 route-map no-default

router ospf x
default-information originate metric 50 metric-type 1

Core rtr
router bgp 1
neighbor <fw > remote-as 1
neighbor <fw > next-hop-self
neighbor <core site1> remote-as 2
redistribute ospf x internal external 1 external 2 route-map no-default

router ospf x
default-information originate metric 150 metric-type 1

[fmugambi]

yes both sites use bgp to peer with isp.

all downstream uses igp-ospf. site a has process id 20, site b has process id 30.

so at the core both sites for mpls, i peer both sites with bgp, then redistribute ospf processes for the two sites respectively. such that site a resources can reach site b resources and vice-versa.---> this works well.

challenges begun when i intended to route each sites' resources via their own isp. 

site b resources have been using site a isp. if i introduce a default route on core on site b, this works, but i wanted to have zero static routes. again with my current setup issues arise when i do this. 

am sharing the topological issue or what happens, maybe that is where we need to start correcting issues.

[fmugambi]

so bgp at 1941s, has route maps out, for downstream serverfirm subnet.and redistribution of ospfs' respective of the site.

Site A has some static routing, but on site A core sw ospf redistributes static routes.

so issues begin here, for example when you check for a route on site b, the route is not known, until you introduce a static route on 1941 of site b..-> since the bgp redistributes static as well, then the route now is known by site b 1941, which advertises it downstream , and servers in site b can reach the subnet now on site A and vice versa.

on site A, there a re quite number of ipsec tunnels, which have static entires on site A core sw. so you find these entries are not known in site b, so traffic from site b flows via mpls to core in site a then this core knows these guys needs to be routed via vpn.--. connectivity is ok.

question, where is this behaviour on the 1941s?

now when i want to introduce isp specific access to each site, the easiet way i went about it was, introducing the 0.0.0.0/0 to ciscoasa fw on site b.--> site b resources now get their internet access via their site b isp. my problem comes, when vpn clients are not able to reach site b resources, since now rem, since the vpn client routes are not known on the site b side, they fall under default category and forwarded to site b asa fw which does not know the route back to vpn clients.

a workaround would have all vpn static routed on site a core , on site a 1941 mpls edge router as well with core sw sita a as destination..-which would then be distributed by bgp across the sites, making 1941 mpls edge router on site a knowing about these routes, distributing them downstream to site b resources..,then these vpn clients routes would no longer fall under "default-route" and vpn clients would manage to access the site b resources.., problem is re-introduction of lots of static routing, which i wish to avoid/reduce.

Any insights here?

1. how to sort vpn learnt static routes be advertised to site b without introducing static routes at 1941 site mpls edge router?

2. is it possible as the setup is, make site b resources uses site b isp, without introducing default route at site be core sw?

Thanks.

[fmugambi]

this is one scenario.

this is on site a.

i introduced a new subnet .130/24. its known by downstream devices which advertise it up to 1941 mpls edge, but same is not put in bgp table of the 1941.

[MHM Cisco World]

for next-hop this prefix 30.30.30.30 is in which site and show you sharing for which 1941 ?

I run lab test OSPF redistribute cases that prevent router behind the BGP/OSPF 1941 router learn prefix 
 

if you run ibgp between two site not ebgp then 
bgp redistribute-internal <<- this need "

MHM 

[fmugambi]

this is the core on site a , downstream of 1941.

[MHM Cisco World]

Core not use BGP and I see the prefix is OK learn as E2 
am I correct ?

MHM

[fmugambi]

no bgp in core. just ospf, and static

[fmugambi]

the mpls bgp is ebgp as both sites have different AS.

so how should i approach this?

[MHM Cisco World]

if all above true

-the bgp is ebgp
-there are some prefix appear like 30.30.30.30 and other not appear 
then 
the 
redistribute ospf <x> match external 1 external 2 internal 

is issue here 
the BGP only redis the internal as default and you need to add match ex1 ex2 to make it redis the external OSPF prefix 1 and 2

MHM 

[fmugambi]

still facing issues on my lab, what am i missing?

[MHM Cisco World]

route map you use with outbound are it include the prefix shown in show ip bgp ?
this last think effect advertise the prefix between two ebgp 

MHM

[fmugambi]

[fmugambi]

question, since network 172.16.57.0/24 is known by r3 via static route, which is then advertised to ospf 30, r3 wont advertise this static route across to r1 via bgp? even without the prefixes on bpg?

[MHM Cisco World]

NO 
you redistribute static into ospf then distribute ospf into bgp
instead 
redistribute static into BGP directly  

the BGP not redistribute prefix not found in show ip bgp 
MHM