10

We control IPv4 and IPv6 subnets. Now we'd like to use a part of a /24 IPv4 subnet at one datacenter and another part at another datacenter. I know that announcing the subnet on the internet at multiple DCs would create an Anycast scenario so that's not an option. Is there any way we could do this?


Edit:

Most peers only accept /24 or shorter so we can't split them and announce the subnet parts.

2
  • Can't you split the subnet in two /25?
    – Zac67
    Jan 20, 2018 at 18:50
  • 1
    You need a private connection between the two datacenters. It can even be a VPN, so long as each datacenter has at least one address outside that /24 to be a VPN endpoint. Jan 21, 2018 at 9:23

4 Answers 4

14

Connect the two DCs with a private connection. Then advertise the /24 at both Data Centers.

When traffic arrives at one DC for the other, your internal devices route or switch the traffic as required via the private link.


Second option depends on available connectivity options, you might be able to acquire a Layer2 (switched) link between both DCs and your upstream provider. This way, the ISP uses one of your IPs on their side as a gateway IP, and provides you with switched layer2 connectivity to both sides.

8

As previous answers also points out the solutions are going to involve either having a private connection between the two data centers or having enough IP addresses to advertise a block from each data center.

Those two options are however not mutually exclusive and there are a few more aspects to keep in mind when configuring this.

How to advertise if you have enough addresses

You'll likely end up deciding to get an IPv6 prefix which is short enough to advertise one half from each data center, which means a /47 or shorter. You then have a choice to make in how to announce this.

  • You can announce the two different /48 from the different data centers.
  • You can announce a single /47 in both data centers.
  • You can do both.

If you announce the two different /48 the traffic will be routed across the internet to the right data center, which keeps things simpler for you. If on the other hand you announce just the /47 in both locations you have to get the traffic to the right data center. This may be desirable if you have a private connection between the data centers that you find to be more reliable than the public internet.

Doing both of the above will serve as a sort of failover. Usually the traffic will go straight to the correct data center. But your private connection will be there as backup. However if other networks think you are sending them too many announcements they may decide to ignore your /48s and use just the /47, and your private connection will see some more traffic.

If you don't have a private connection between the data centers the best choice will most likely be to advertise the two /48 and not advertise an aggregated /47.

All of the above applies to IPv4 as well, just with different prefix lengths.

What to do if you can't get more IPv4 addresses

If you go ahead and advertise a /25 from each data center there is a significant risk the advertisements will just be ignored. Even if it works today there is a risk it will stop working in the future, so you will need a different plan.

If you don't have a private connection between the two data centers there is the possibility to use an IPv4 over IPv6 tunnel between the two data centers as a private connection.

The obvious drawback of the tunnel approach is that the tunnel is not going to be more reliable than the internet connection between the two data centers. And avoiding using the tunnel by only advertising the specific prefixes isn't an option because those specific prefixes would be too long.

An option worth pursuing if you are using the same transit provider at both locations is to advertise both the aggregated /24 and the more specific /25s. What you would need from the transit provider to advertise to the world is the /24. The two /25s you'd only need the transit provider to accept and use within their own network in order for the traffic to be routed to the correct of your two data centers.

Obviously before you do anything like that you'd have to discuss it with your transit provider to ensure that it is a configuration they are willing to support.

Other caveats with a tunnel

Another caveat in case of any tunnel is MTU issues. You need to ensure that you aren't doing something silly on your tunnel which would cause large packets to be silently dropped. Moreover you'd better configure your servers with a low enough MSS that it will work even if the people you are communicating with are silently dropping too big errors. For a setup like the one I describe setting the MSS to 1200 should be safe.

If your setup is going to involve any sort of DSR load balancing it is worth keeping in mind that the load balancing may need a tunnel as well. In that case make sure your DSR load balancer is configured such that the tunneling it is doing will be instead of the tunneling to connect your data centers - not another layer of tunnel on top of it.

Conclusion

The simplest solution is to just get enough IP addresses. But alternatives exist if you absolutely need them.

5

When you subnet a network, you do not advertise the full network from both places. Assuming you have the 10.0.0.0/24 network, and you want to use half at each data center, then you advertise 10.0.0.0/25 from one data center, and 10.0.0.128/25 from the other data center. You do not advertise 10.0.0.0/24 from both data centers, only advertise what is being used.


Edit:

Since you are trying to publicly announce to the Internet, you cannot advertise any prefix larger than /24 with IPv4 or /48 with IPv6. You will need to acquire another IPv4 public address block for your other data center, or you will need to connect the two data centers so that traffic in that block received at one data center can be internally sent to the other data center. This is possible if you go to the IPv4 address market, but it can be expensive. It is very easy with IPv6.

3
  • No, this is not possible as most peers only accept announcements with a mask of 24 or smaller for IPv4 Jan 20, 2018 at 18:52
  • It is true that ISPs will not advertise anything larger than /24, but you can do what you want in your own network. You have not given us any information on how anything is connected. If you are trying to publicly advertise to the Internet, then you have a problem where you cannot subnet, but if this is for your own use, then you can do this.
    – Ron Maupin
    Jan 20, 2018 at 18:55
  • Yeah, we're advertising on the internet. I'll edit that in. Jan 20, 2018 at 18:56
5

You have the basic point: your /24 can't realistically be split and advertised across multiple providers. If both sites connected to the same carrier and they opt to accept your pair of /25's then you could potentially have the aggregate the route into a /24 for advertisement to upstreams and peers while still allowing traffic to flow to the appropriate facility.

Failing this you'll need to advertise the /24 from both sites and establish some kind of logical connectivity that isn't tied to that /24. As others have mentioned, provisioning a private link between the sites would accomplish this. Another option would be to build some kind of tunnel (IPSEC, GRE, etc) tied to your carrier-assigned outside address (I'm assuming both to be static). In this case you'd potentially be receiving traffic for the other site that would then have to be encapsulated and sent across the tunnel (or private link) which, depending on your setup, might represent an unacceptable degree of inefficiency.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.