Timeline for Use case for two BGP ASNs?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 30, 2018 at 20:00 | comment | added | Teun Vink | If you have more than one globally routable prefix, you could use one prefix for production and one for non-production, and use different export policies. However separating ASNs isn't required then, you could do that with one ASN just as well. | |
| Nov 30, 2018 at 18:40 | comment | added | Kaboose | Let’s put aside cost here for a minute and assume completely separate prod and non-prod infrastructure (routers, firewalls, Internet circuits). Even though I advertise my external prod network out two redundant circuits, and my external non-prod network out two different redundant circuits, how would I prevent ingress non-prod traffic from coming across my prod circuits with a single ASN? (And vice versa.) That’s where I’m getting hung up. Segregating the egress traffic seems easy but I don’t know how to achive full prod/non-prod ingress traffic separation within one ASN. | |
| Nov 30, 2018 at 6:01 | comment | added | Teun Vink | Unless you have dedicated uplinks and routers for your non-production traffic (which I don't think many enterprises have), this will always be the case. Running a separate network just for non-production traffic with dedicated circuits, devices and people operating it has huge operational costs. Most often connectivity is shared in some way, but internally traffic between production and non-production is separated by firewalls, VLANs and VRFs. | |
| Nov 30, 2018 at 2:21 | comment | added | Kaboose | Thanks Teun. Makes sense. I’m just concerned about ingress non-production traffic coming across my production circuits/equipment, and vice versa. I really want to ensure that separation, and I’m too green with BGP still to have confidence. | |
| Nov 29, 2018 at 5:48 | history | answered | Teun Vink | CC BY-SA 4.0 |