3

in this diagram :

enter image description here

we are peering with 2 ISPs, let's say I have a class c IP space like 200.200.200.0/24 and let's say my ASN is 65000, the thing is where should I run NAT? on which device? I mean on Cisco Routers that face the internet or could I run that on the FortiGate? and where on which device should I config the peering? again on Cisco routers facing those ISPs or is it possible to have BGP peering configured on the FortiGate? I know some stuff about BGP and how it works, an I know it's based on the TCP session and it's not working like IGPs in which peers are directly connected, but the thing is how could I have NAT alongside the BGP in this diagram?what's the best to do?

Improve this question
4
  • 1
    I think you should run iBGP peering between your Cisco routers as well as eBGP with your ISPs. You can also do NAT on these same devices. Just specify the interface towards ISP as outside NAT interface and towards Fortigate as inside and do your NAT
    – Alex
    Commented Nov 26, 2014 at 13:37
  • let's say those internet facing routers are not that powerful to be able to hold 2 copy of almost Full BGP table because of at least 2 connections that they got those ISPs ASs or could handle the NAT table and iBGP yes that's something obvious which is 100% needed but I forgot to mention in my question
    – user7741
    Commented Nov 26, 2014 at 16:35
  • @Mike Pennington what's your opinion Mike?
    – user7741
    Commented Nov 26, 2014 at 16:37
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 10, 2017 at 15:31

2 Answers 2

Reset to default
2

You should run BGP on your Cisco routers connecting to ISP. If FW supports BGP, it should run iBGP with the routers.

I would prefer doing NAT on the FW. All you have to do is make sure that the traffic leaving a FW comes back to the same. I think you would already be doing that.

HTH.

Improve this answer
1
  • so why do I need to have iBGP peering between FW and those cisco routers anyway? could u please tell me how would be the traffic flow from inside to the internet here?
    – user7741
    Commented Nov 27, 2014 at 19:34
1

You don't have to accept all the routes from the Internet. Simply apply an in-bound filter to accept only the default route and a few other prefixes.

You can either use VRRP/HSRP on router's inside interfaces or use E/iBGP on the firewalls. This will allow routers to send the default route to the FW dynamically. If one router goes down, FW will not be black-holing the traffic to it as that route will simply go away.

Regards.

Improve this answer
2
  • which one is common practice, having some kinda First Hop Redundancy Protocol (FHRP) like HSRP or having iBGP peering between FW and Routers, or having both in place?
    – user7741
    Commented Nov 30, 2014 at 6:04
  • Both are common practices. I prefer dynamic.Thanks.
    – Rais
    Commented Dec 1, 2014 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.