Multihomed BGP to internet - use only 1 path inbound

[carl_townshend]

Hi All

We have a multihomed internet connection to 2 different ISPs.

We want traffic to only come inbound on one of the links.

What is the best way to achieve this? as-path prepend on the one we least prefer? or use the bgp conditional advertisement feature?

If we did use the conditional advertisement feature, how would we configure this? we have 2 routers, IBGP between them and just learning a default from each provider.

cheers

[Georg Pauwen]

Hello,

as-path prepend would certainly be the easiest way to achieve inbound traffic control. Conditional advertisement could be used as well. Post the full running configs of both routers, so we can fill in the necessary statements for conditional advertisement...

An example of how to configure conditional advertisement to accept the default route from one ISP only if the other ISP is not available would look something like this:

ip sla 1
icmp-echo <ISP1_NEXT_HOP> source-interface <YOUR_INTERFACE>
frequency 10 ! adjust frequency as needed

ip sla schedule 1 life forever start-time now

ip access-list standard ISP1_ACL
permit <ISP1_IP>

route-map ISP2_CONDITION permit 10
match ip address ISP1_ACL
set ip next-hop verify-availability <ISP1_NEXT_HOP> 1 track 1

router bgp <YOUR_ASN>
neighbor <ISP1_PEER_IP> default-originate route-map ISP2_CONDITION
neighbor <ISP2_PEER_IP> default-originate

[Giuseppe Larosa]

Hello @Georg Pauwen ,

I apologize if I'm wrong but why a customer should send a default route to its own upstream providers ?

It is supposed to be the opposite

@carl_townshend :  use of AS path prepend of your own AS number on the less preferred ISP is the way to go , but you can still get some traffic coming from the second ISP for example from other customers of that ISP

Hope to help

Giuseppe

[carl_townshend]

Hi There

Giuseppe is correct, we learn the default from the ISP, and want to limit us sending our prefix out to the ISP.

Also, how would the provider still prefer its local routes from that ISP, surely if we prepend enough that should over write everything ?

cheers

[Georg Pauwen]

@Giuseppe Larosa I mixed everything up. What I wrote does not make any sense.

Either way, thinking about it again, I seem to recall that conditional advertising is not really able to influence inbound traffic. The most you can do (since you only receive default routes) is to advertise the default route you receive from your preferred ISP to your iBGP, under the condition that the default route exists in the routing table. That still would only influence outbound traffic.

Let's say this is the router that is connected to the preferred ISP, the config would look like this:

router bgp 3
bgp router-id 4.4.4.4
bgp log-neighbor-changes
neighbor 192.168.24.1 remote-as 2 <-- IP address of preferred ISP
neighbor 192.168.34.1 remote-as 3 <-- IP address of iBGP neighbor
neighbor 192.168.34.1 default-originate route-map CONDITION
!
ip prefix-list DEFAULT seq 10 permit 0.0.0.0/0
!
route-map CONDITION permit 10
match ip address prefix-list DEFAULT

This will cause all your traffic to go out through this router, as the default route in the iBGP neighbor would point to this router. If the preferred ISP is down, the iBGP peer would put the default route it receives from the less-preferred ISP in its routing table...

[Giuseppe Larosa]

Hello @Georg Pauwen ,

now it makes more sense. However, to have an eBGP route propagated to an iBGP peer you don't need all this setup it is done in automatic I suppose.

Hope  to help

Giuseppe

[paul driver]

Hello
@Georg Pauwen 
Surely the IBGP peer also is receiving a default route from it ebgp ISP peer,  so why try to conditionally advertise a default towards it, makes no sense, In any case this would be for egress traffic, so local preference would be the best attribute to use.

As for ingress traffic,  as-path prepending is the most viable option as stated by @Giuseppe Larosa  alternatively without using as-prepending and depending on the ebgp peering's you could advertise summary prefixs towards the less preferred ISP via the ibgp rtr and the more specific prefixss towards the preferred ISP via the primary rtr

[Georg Pauwen]

@paul driver I do not want to make this thread unnecessarily long, but my config does not send a default route to the ISP, but to the other iBGP peer, and only if the default route TOWARDS the ISP exists on the router connected to the preferred ISP. Without the conditional route map, the iBGP router connected to the secondary ISP will keep the default route to the secondary ISP in its routing table.

Either way, as I said, it is not really conditional advertising anyway, and does not influence inbound traffic.

[paul driver]

Hello @Georg Pauwen 
I was aware you meant to send a default towards the IBGP peer but as I stated I believe that's not viable.
If you had an ibgp peer then 9/10 that ibgp peer also has an ebgp peering towards an ISP.

Possibly then both local bgp wan rtrs be receiving both default routes but only one of them by default will be selected to be entered into the route table, Which means you don't need to advertise any default from/to any ibgp peer to another ibgp peer, and conditionally if either default was withdrawn from the ISP that advertised it, the remaining one will be used,
Additionally using the local preference attribute you could state a preference on the local bgp rtrs as to what default route they should use, which is also conditional.

[carl_townshend]

The goal is to only use my faster link coming into our network, this includes the other isp local routes as they are a very big provider, is there no way other than prepending to do this? I thought conditional advertisement could solve this ?

[paul driver]

Hello

---

@carl_townshend wrote:

The goal is to only use my faster link coming into our network, this includes the other isp local routes as they are a very big provider, is there no way other than prepending to do this? I thought conditional advertisement could solve this ?

---

Can you share a topology diagram please, what you do not want under any circumstance is for you wan rtrs to become a transit path between ISPs

[Georg Pauwen]

@paul driver Using the default route to demonstrate how conditional advertisement works is flawed, absolutely. In this topology, the ISP only sends default routes, so that is all I could use to show how it works. I could have used an actual route if there were one...

Either way, as stated, conditional advertising is not a good choice (if any at all) to influence inbound traffic. 

[Giuseppe Larosa]

Hello @carl_townshend ,

an ISP gives higher local preference to routes received from direct customers in comparison to those received by other ISPs so in your case traffic from other customers of ISP2 can still use ISP2 ( if they are not multi homed ) to reach you.

Hope to help

Giuseppe

[MHM Cisco World]

I will share lab tonight or tomorrow morning.

Thanks 

MHM

[MHM Cisco World]

this Lab I test for conditional advertise 

NOW let talk about it 
-R1  and R2 is Edge router and connect via iBGP
-both R1 and R2 receive 0.0.0.0 from R3/R4
-there is LOCAL lo 12.12.12.12 in both R1/R2 
-we need R2 not advertise this LOCAL until it not receive prefix from R1 
here we can NOT use 0.0.0.0 since R2 always have this prefix in BGP table (either from R1 or R4)
so I add LO 1.1.1.1 and use as conditional prefix 
when R2 not see 1.1.1.1 it start advertise LOCAL (12.12.12.12)

-I use no exist-map NOT exist-map 
- this make R1 advertise LOCAL and all Inbound traffic through it 

MHM