1

I use AWS and gcp. Both of these cloud platforms have the ability to establish a VPN connection from a VPC in the cloud to an on-premise router or another cloud VPN endpoint.

They both use bgp ( and support private ASNs) https://cloud.google.com/vpn/docs/how-to/creating-ha-vpn2 https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNRoutingTypes.html

I'm curious why they chose bgp and not another routing protocol like ospf/isis. Is bgp just the lowest common denominator? is it available on more platforms? or is there a more fundamental technical reason. I'm curious because bgp has a huge a feature set and this use case is very narrow (just exchanging routes) so seemed like overkill

EDIT: so seems like BGP is the protocol of choice for ALL VPN connections between untrusted sites not just specific to cloud providers. I think I understand how it can be better for VPNs because of long timers- OSPF and other link-state protocols generally require lower latency and more frequent communication correct? I get how its easier to filter routes with BGP. Link-state requires you to send the entire topology and we just want to share routes. Im not 100% clear on why TCP is better for this. Is it because ipsec VPNs operate at L3 and OSFP also runs on L3 and because BGP is more like an application it rides on TCP and is easier to tunnel? Does this mean RIP might even be preferable to OSPF for VPNs?

Improve this question
8
  • 1
    OSPF is a link-state routing protocol. You can only effectively filter routing information on area border routers. It it intended to be used within one autonomous system where, if one router injects incorrect information, you have the control to go and fix the problem on the source, rather than filter the routes. ISIS also is link state. BGP is designed to be used between different autonomous systems that don’t fully trust each other and has advanced filter features. (Not listed as answer because I don’t have AWS or gcp experience).
    – Darrell Root
    Commented Jul 21, 2019 at 16:12
  • BGP is obvious choice because of nature of it. OSPF is link-state protocol and it is not good for many reasons to use it via VPN. ISIS is not usable at all because it is, actually, not an IP protocol. BGP is perfect - with long timers, undependent of MTU, not link-state protocol and uses TCP. Actually, BGP was built for this purpose - exchange prefixes, not a link-states or anything else, so it is obvious choice.
    – Konstantin Goncharenko
    Commented Jul 21, 2019 at 16:14
  • 1
    Voting to close as opinion based. Unless you work for AWS, it’s just a guess.
    – Ron Trunk
    Commented Jul 21, 2019 at 16:25
  • im confused whats makes you think I work for AWS? I dont think this is opinion based, this is a question about the fundamentals of routing protocols with VPNs which I would like to understand better. and from the other comments I can see there are significant technical (non-subjective) reasons to use one over the others
    – red888
    Commented Jul 21, 2019 at 17:08
  • It is primarily opinion-based because only someone working for AWS could actually give you the answer. We would just be speculating or guessing, which is off-topic here.
    – Ron Maupin ♦
    Commented Jul 21, 2019 at 17:53

0

Reset to default

Browse other questions tagged or ask your own question.