ISP REDUNDANCY B/W (1 ISR router connection to 2 X Cluster Checkpoint firewall)

[sharanb4u]

Dear All,

I have a query regarding the following setup as explained

we have 2 ISPs, and we have obtained /30 and /29 Public pool from each ISP.

/30 for WAN links, /29 for ISR router and Checkpoint firewall connectivity and  (Basically LAN and WAN pool)

we have ONE ISR router and TWO checkpoint firewall configured in Cluster mode.

Need to configure ISR router and Checkpoint firewall for ISP redundancy ACTIVE/STANDY mode.

Do we need to configure BGP for Acitve/Standy config on ISR router.

Please suggest/guide

Thank you in advance.

[pigallo]

Hello,

to achieve fast rerouting in your configuration, if your ISP links do not belong to different VRFs, you could set two BGP sessions to each ISP.

Then configure a higher Local preference towards the ISP that you want use to forward packet out first and leaving second neighborship active with default LP. This is to manipulate outoing traffic.

To influence inbound traffic to your network configure different origin codes towards the two speakers to make traffic entering from second ISP as a less preferrable path.

If one session fails you already have the second BGP neighbor ready to route traffic in/out.

You could also consider the idea to implement BFD to speed up the control plane fault detection.