4

I’m new to BGP and have a relatively simple question, or so I think it is for you BGP veterans. I would like to build two new seperate edge networks at my company; one for production services and another for non-production services. We own a large public IP block and one ASN right now. Each edge network needs redundant ISP connections in a multihomed BGP setup across two routers with iBGP between them for high availability. Mapped out like this across 4 routers:

Production network:

Router 1 - ASN X - advertise X.X.X.X/23 -> ISP A Circuit 1

Router 2 - ASN X - advertise X.X.X.X/23 -> ISP B Circuit 1

Non-production network:

Router 3 - ASN ? - advertise Y.Y.Y.Y/23 -> ISP A Circuit 2

Router 4 - ASN ? - advertise Y.Y.Y.Y/23 -> ISP B Circuit 2

What ASN should I use in my non-production network to maintain separation? Can I use the same ASN as my production network and achieve the separation through an advanced configuration? Or should I request a second ASN from my regional Internet registry? Would the RIR even give me a second ASN?

Looking for guidance here. Thanks!

Improve this question
7
  • You really only need one ASN, but you can advertise different prefixes from each router.
    – Ron Maupin ♦
    Commented Nov 29, 2018 at 4:00
  • And still be able to fully separate both egress and ingress traffic?
    – Kaboose
    Commented Nov 29, 2018 at 4:44
  • I'm not sure what that means. Ingress and egress traffic is naturally divided by the direction it is traveling.
    – Ron Maupin ♦
    Commented Nov 29, 2018 at 4:45
  • Really? C’mon man. I’m talking about seperating production and non-production traffic. I don’t want ingress non-production traffic (which is harder to control) to traverse my production circuits, and vice versa.
    – Kaboose
    Commented Nov 30, 2018 at 2:14
  • That is a completely different question than ingress and egress separation. We can only respond to what you ask, and if you ask the wrong question, then you will get a response you do not want or expect.
    – Ron Maupin ♦
    Commented Nov 30, 2018 at 3:27

1 Answer 1

Reset to default
4

What ASN should I use in my non-production network to maintain separation? Can I use the same ASN as my production network and achieve the separation through an advanced configuration?

Typically, you would use the same ASN. You just separate the non-production network using VLANs and possibly firewalls. An additional VRF (routing instance) can be used if you need to re-use the same IP addresses between production and non-production.

Or should I request a second ASN from my regional Internet registry?

No, you shouldn't request a second ASN for this. The main reason for requesting a second ASN would be to be able to implement separate routing policies between the two networks. As I pointed out above, you don't need separate routing policies, you just need some filters to keep production and non-productions separated.

Using more than one ASN in what you consider to be one single network sharing routers can become complex. Many routers can be part of only one ASN (some are able to use virtual routers or routing instances for this), but in any case routing traffic between the two ASNs and your upstream networks would become more complex. And if eventually there's no difference in the routing policies, what's the point of introducing a second ASN?

Would the RIR even give me a second ASN?

Yes, most likely they would.

Improve this answer
4
  • Thanks Teun. Makes sense. I’m just concerned about ingress non-production traffic coming across my production circuits/equipment, and vice versa. I really want to ensure that separation, and I’m too green with BGP still to have confidence.
    – Kaboose
    Commented Nov 30, 2018 at 2:21
  • Unless you have dedicated uplinks and routers for your non-production traffic (which I don't think many enterprises have), this will always be the case. Running a separate network just for non-production traffic with dedicated circuits, devices and people operating it has huge operational costs. Most often connectivity is shared in some way, but internally traffic between production and non-production is separated by firewalls, VLANs and VRFs.
    – Teun Vink
    Commented Nov 30, 2018 at 6:01
  • Let’s put aside cost here for a minute and assume completely separate prod and non-prod infrastructure (routers, firewalls, Internet circuits). Even though I advertise my external prod network out two redundant circuits, and my external non-prod network out two different redundant circuits, how would I prevent ingress non-prod traffic from coming across my prod circuits with a single ASN? (And vice versa.) That’s where I’m getting hung up. Segregating the egress traffic seems easy but I don’t know how to achive full prod/non-prod ingress traffic separation within one ASN.
    – Kaboose
    Commented Nov 30, 2018 at 18:40
  • If you have more than one globally routable prefix, you could use one prefix for production and one for non-production, and use different export policies. However separating ASNs isn't required then, you could do that with one ASN just as well.
    – Teun Vink
    Commented Nov 30, 2018 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.