2

I have the following network. I want to prevent Subnet 2, S2, from being routed outbound of ISPA (preferring ISPC is also acceptable).

None of my ISPs use BGP communities. Given that this is a live network, I'm scared to be cavalier and use trial and error here. I think I might be able to do this with MED and the always-compare-med option, but I really don't know enough to be confident.

ISPA  ISPB      ISPC  ISPD
  \     /         \    /
    R1    --------  R2
    |                |
S1    S2          S3   S3

edit

This is with Arista (cisco-like) equipment. Using VRFs isn't a good option here.

I've just tried the following. The in/out pieces here are confusing me. Is this a valid way of assigning attributes to a particular subnet?

neighbor ISPC route-map COG-RM-IN in

route-map COG-RM-IN permit 10
   match ip address access-list COG-ACL-OUT
   set local-preference 110
!

ip access-list COG-ACL-OUT
   10 permit ip S3/24 any
!
  • 2
    Just out of curiosity: why wouldn't VRFs work well with Arista? We use routing in different VRFs on Arista ourselves. – Teun Vink Apr 5 '18 at 19:35
  • VRFs will work fine on Arista, but I'm dealing with a live network with a lot of traffic and zero chance of a proper change window. I haven't had to do BGP anything in years and do not feel up to doing a big change like starting to use them on a live network. – Brando___ Apr 5 '18 at 19:39
  • MED deals with hinting to an ISP with multiple paths to you as to which path you prefer it to take, inbound to you, but the ISP is free to completely ignore any such suggestions, and MED is specific only to the single ISP, not multiple ISPs. You can control how you route traffic out from your network, but you cannot control how anything is routed to you, nor can you control how it is routed after it leaves outbound from your AS. You may be able to use PBR to route based on the packet source, but it is resource intensive. – Ron Maupin Apr 5 '18 at 20:28
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:13
4

MEDs will only affect inbound traffic, so that wouldn't help you here. The fact that your ISPs do not support communities doesn't affect your outbound routing either.

For outbound routing, you would need some sort of policy routing. You could achieve that by doing source based routing on R1, so traffic coming from S2 would be forced to use another ISP as nexthop. However, you'd lose redundance then.

Alternatively, you could put S2 in a seperate routing instance on R1, in which routes from ISPA are not available. That way you'd still have outbound paths to the other ISPs.

If this is possible in your setup and how you'd actually implement this is hard to tell without any more details (router brands and types, configurations).

UPDATE: That route-map wouldn't work, since your ISPs wouldn't announce your S2 prefix to you, so that access-list will never hit.

  • Is there a way to do this with local-pref? What I've just tried to do is place a route-map on ISPC to modify the local preference of the address range of S3, but it didn't seem to do anything. Adding more detail to the OP – Brando___ Apr 5 '18 at 19:32
  • That would affect routing for all subnets, not just for S2. – Teun Vink Apr 5 '18 at 19:33
  • 1
    ahhh, you're right it did. I'm going to give myself a heart attack i.imgur.com/55p8Bf0.png – Brando___ Apr 5 '18 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.