Routing

Hi everyone,

I have a quick question to double check my own sanity.  I have two routers, each connected to one of my two ISPs.  The routers are interconnected and are taking full BGP route tables from each ISP.  They talk to each other using iBGP.

My question is, what route(s) does the Firewall need to have to achieve redundancy in case router A or router B fails?

Is a simple 0.0.0.0/0 -> Router A and  0.0.0.0/0 -> Router B on the firewall enough to achieve this, or do I want to run OSPF or maybe iBGP between the routers and the firewall?

Thanks in advance, I really appreciate any ideas.

SH

I hope you don't mind if I ask you some quick questions 🙂

1/ is your Firewall directly connected to RouterA and RouterB?

2/ do you want only redundancy or redundancy _AND_ outbound traffic load-sharing on your Firewall?

3/ how many routes your Firewall is capable to hold in its routing table?

Rgds

Alex

Alex,

Thanks for the reply.   To answer your question:

1.  Yes, the firewall directly connects to router A and router B via gigabit ethernet interfaces

2.  Preferrable load sharing of outbound traffic would be nice.  Especially because router A is connected to an ISP that offers us I2 access and another network that connects to some larger sites (such as google) in what is usually less AS jumps than the ISP that router B is connected to.  I do get full BGP route tables (i think like 280k+ routes) from both ISPs regardless.

3.  Unfortunately, the firewall only holds about 20k BGP routes, and I cannot take full routing tables.  I also remember our SE suggesting that we should not run BGP on the firewall, but if we, for example, were only taking a default route via BGP  I do not see how that could be a big issue.

Thanks for your help!

SH

Sven,

Thanks for your answers. I would probably go for a limited number of "special" routes (like you mention below) advertised to your Firewall from Routers A & B via iBGP and also two 0/0 equal-cost iBGP routes.

Do not forget to enable ECMP in your Firewall (I assume Netscreen).

This way you will get failover and per-session load-share for outgoing traffic on 0/0 routes.

Rgds

Alex

Alex,

Thanks a bunch for your help!  I'll start looking into that.  For some reason I think I was making it more complicated to myself than it really had to be.

Thanks again!

Sven