3

in this diagram :

enter image description here

we are peering with 2 ISPs, let's say I have a class c IP space like 200.200.200.0/24 and let's say my ASN is 65000, the thing is where should I run NAT? on which device? I mean on Cisco Routers that face the internet or could I run that on the FortiGate? and where on which device should I config the peering? again on Cisco routers facing those ISPs or is it possible to have BGP peering configured on the FortiGate? I know some stuff about BGP and how it works, an I know it's based on the TCP session and it's not working like IGPs in which peers are directly connected, but the thing is how could I have NAT alongside the BGP in this diagram?what's the best to do?

  • 1
    I think you should run iBGP peering between your Cisco routers as well as eBGP with your ISPs. You can also do NAT on these same devices. Just specify the interface towards ISP as outside NAT interface and towards Fortigate as inside and do your NAT – Alex Nov 26 '14 at 13:37
  • let's say those internet facing routers are not that powerful to be able to hold 2 copy of almost Full BGP table because of at least 2 connections that they got those ISPs ASs or could handle the NAT table and iBGP yes that's something obvious which is 100% needed but I forgot to mention in my question – user7741 Nov 26 '14 at 16:35
  • @Mike Pennington what's your opinion Mike? – user7741 Nov 26 '14 at 16:37
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 15:31
2

You should run BGP on your Cisco routers connecting to ISP. If FW supports BGP, it should run iBGP with the routers.

I would prefer doing NAT on the FW. All you have to do is make sure that the traffic leaving a FW comes back to the same. I think you would already be doing that.

HTH.

| improve this answer | |
  • so why do I need to have iBGP peering between FW and those cisco routers anyway? could u please tell me how would be the traffic flow from inside to the internet here? – user7741 Nov 27 '14 at 19:34
1

You don't have to accept all the routes from the Internet. Simply apply an in-bound filter to accept only the default route and a few other prefixes.

You can either use VRRP/HSRP on router's inside interfaces or use E/iBGP on the firewalls. This will allow routers to send the default route to the FW dynamically. If one router goes down, FW will not be black-holing the traffic to it as that route will simply go away.

Regards.

| improve this answer | |
  • which one is common practice, having some kinda First Hop Redundancy Protocol (FHRP) like HSRP or having iBGP peering between FW and Routers, or having both in place? – user7741 Nov 30 '14 at 6:04
  • Both are common practices. I prefer dynamic.Thanks. – Rais Dec 1 '14 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.