2

I have always used eBGP (with private AS numbers) to route between branches and headquarter sites. However, after reading the Cisco CCNP ROUTE Foundation Learning Guide, it states that best practice is to run an IGP between WAN sites.

Using OSPF as an example, I would imagine area 0 would be the headquarters location and each branch office would have its own area.

In my opinion, this is not optimal due to the nature of the business unit. For example, Site A and Site B are both single-homed to HQ via an MPLS connection. Everything is fine. However, a new BW-heavy application is being deployed at both of these sites. The business unit decides to create a private connection between site A and site B. Since they are both in non-zero OSPF areas, no type 3 LSAs will be advertised. Thus you will have to make a virtual link which introduces new design considerations and makes the design less scalable.

With eBGP, you would simply create another eBGP peering relationship and easily manipulate route preference over that link.

What do you experienced engineers out there think about this? IGP to branch offices or EGP? Also, would the connection type matter to you? For example MPLS vs VPN over Internet?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 6, 2017 at 17:49

2 Answers 2

Reset to default
2

I have had also similar situation.

It depends on different factors. I assume that your topology won't scale that much, so I would suggest keep going with BGP as you mentioned good pros for that. Also, you can implement BFD to have faster convergence and dead peer detection.

Regarding the connection type, VPN over Internet would by last option, because different drawbacks such as fragmentation, delay, complex management, etc.

Improve this answer
3
  • Can you go into more detail on "fragmentation, delay and complex management"?
    – Michael May
    Commented Aug 25, 2015 at 0:38
  • Regarding fragmentation for example with IPSec VPN, when a packet is nearly the size of the maximum transmission unit (MTU) of the physical egress port of the encrypting switch, and it is encapsulated with IPsec headers, it probably will exceed the MTU of the egress port. This situation causes the packet to be fragmented after encryption (post-fragmentation), which requires the IPsec peer to perform reassembly before decryption, degrading its performance. Then you will have to manually modify MTU, sometimes TCP MSS, ... Delay will be caused by fragmentation, hence it increases latency.
    – Mo Moghaddas
    Commented Aug 25, 2015 at 9:03
  • And obviously it's easier to get a ready link in comparison to setting up VPN connections. For example, imagine that something goes wrong in the Internet path between your endpoints, then you have to troubleshoot it step by step and see if it's really only an Internet problem or not. With a managed link, you just check your line and will have a support from the link provider.
    – Mo Moghaddas
    Commented Aug 25, 2015 at 9:07
1

While I'm not a fan of IGP over WAN circuits (mostly due to the low circuit speeds which could cause convergence problems if there are many branch sites), I have seen this work well. There is no single answer of eBGP, iBGP, or IGP for a WAN since there are a lot of factors to consider.

Traditionally, the WAN topology would be a hub-and-spoke with the headquarters serving as the hub (forcing site-to-site traffic to hairpin and creating a single point of failure). More modern WAN topologies leverage the telco MPLS VPN offerings which can save money by eliminating the expensive point-to-point circuits in favor of less expensive MPLS cloud connections. Besides money, an advantage of this is to give you any-to-any site-to-site connections and guarantees for things like QoS that you just can't find on a traditional Internet VPN.

I think where you are getting off track with OSPF is that you are envisioning the headquarters site as Area 0, but you are forgetting that OSPF works on router interfaces. If you set up the WAN interfaces of each site's WAN router in Area 0, and the LAN interfaces of each site, including the headquarters site, into a local stub area, this makes the WAN itself Area 0.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.