Given the advantages to be gained by creating a BGP session with a remote AS over a VPN connection (such as traffic ingress and egress control) why are there no providers offering this type of service?

HE.net has a IPv6 tunnel service that almost like this for IPv6 Tunneling, but why isn't anyone offering VPN based BGP sessions?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8 '17 at 9:30

This kind of trick was used by certain ISP's abusing peering relationships - provider A peers at two points (let's say east and west coast of the US). Provider A builds a tunnel between his peering nodes across B's network and B is suddenly unwillingly providing free cross-country bandwidth. Needless to say, this kind of behavior was (and is) highly frowned upon.

Now - as to the use of BGP over VPN tunnels for transit/end users there are a couple of problems:

1.) The routing of the underlying tunnels is completely opaque. Assuming you have two tunnels to two different providers it is possible (...if not likely in the case of consumer grade service) that these tunnels could traverse some of the same intermediate points, which kind of defeats the purpose if HA is the goal in mind.

2.) Supply and demand - Sure, ISP's could offer these kinds of services but realistically who is buying them? If you're at a point where you've secured an ASN and have either gotten PI space (unlikely) or negotiated appropriate route leaking, chances are that you're spending a fair amount on transit service (at a minimum). In contrast, consumers spending $59 USD a month for Internet service aren't likely to provide the revenue to (profitably) offset not only the cost of the hardware to land tons of BGP sessions but also the operational overhead of maintaining and supporting said sessions. There's also a hidden cost in terms of the backhaul of traffic that's even less likely for ISP's to want to pay for.


Even if you peer with another AS that is down/upstream from you, unless you are directly connected there is no real way to engineer the path traffic will take.

The reason why it can be handy in examples such as HE is that your upstream might not support IPv6 yet but you want to start running it within your AS and so need a tunnel out to them.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.