I'm using Quagga + BGP with Racoon IPSec to connect to AWS VPN tunnel. AWS provides 2 tunnels for redundancy. Everything is working with fine with Asymmetric routing in place. To test failover, I comment out a tunnels's psk and restart ipsec. Everything works fine for tunnel 1, but not tunnel 2. The first hurdle was specifying 2 neighbor IPs with the same ASN. After resolving that issue with allowas-in, BGP failsover to the second tunnel, advertises routes, but packets are still not traversing through.

Please see bgpd.conf below:

router bgp 60*** no synchronization bgp router-id 52.*.*.* network network_1/30 network network_2/30 network local_subnet/16 neighbor remote_address_1 remote-as 9059 neighbor remote_address_2 allowas-in 1 neighbor remote_address_2 remote-as 9059

  • I never seen the setting of two neighbors connect to same ASN. I don't know how BGP would behave when that happens but my guess is that AWS selected one of your neighbor as best route to your ASN.
    – Pue-Tsuâ
    May 17 '16 at 8:16
  • "The first hurdle was specifying 2 neighbor IPs with the same ASN". Parallel links between two ASs, such as between your AS60*** and their AS9059, are allowed in BGP with no special configuration. So what is the argument for "allowas-in" in more detail?
    – vk5tu
    May 17 '16 at 11:19
  • Also note that network_1/30 and network_2/30 don't really do much here. It's not like AWS won't throw those advertisments away (AWS knows where those routes are, you can only tell them some untruth, so they should filter the /30 link addresses from your advertisement). If you had iBGP to another router they'd be needed, and they certainly need to be in your IGP. You really should have incoming and outgoing route-maps. Especially since allowas-in suggest that you have a routing loop happening.
    – vk5tu
    May 17 '16 at 11:26
  • @vk5tu I have AWS support and they came back stating that allowas-in is not really needed and that all traffic load balanced across the 2 tunnels as it should be. Without the allowas-in directive, I'll still receive an error, but they have stated this is normal behavior. They have also stated that traffic should flow over to the second tunnel if one drops.
    – wesley
    May 17 '16 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.