I have the following design:

MPLS PE --- CE --- L2 SW --- CE --- PE MPLS

The CEs are connected to a regular L3VPN MPLS network (same provider) and they use private ASN. There is one single L2 switch connected via access ports to a router. These links are design to be active-active with load-sharing. The routers are running GLBP with each other for FHRP and tracking the CE-PE link.

What are the advantages/pros and what are the disadvantages/cons or running iBGP between the CE routers?

Hopefully someone will provide some insight on this.


  • Is there any time when you would have to provide connectivity between the PEs? In other words would you ever act as a transit network?
    – Ron Trunk
    Feb 22 '14 at 2:03
  • 2
    Hey, no need to acta as a transit network. I think transit would not even work in this case as the PEs are from the same provider and, thus, from the same ASN. Therefore, eBGP loop prevention mechanism would not allow PE2 to receive routes from PE1 and vice-versa. Feb 22 '14 at 20:22
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5 '21 at 18:11

From routing point of view for this particular setup I don't think there is any problem apart from discontiguous AS, but that's just a cosmetic thing here.

Generally, you will lose traffic engineering ability for upstream traffic, which may or may not be an issue and it will create asymetric routing and may cause unbalanced use of inter-AS links. While with iBGP you'd have outgoing traffic engineering possible.

I think that validity of this design is dependent on if you have some kind of stateful device (firewall, ...) which would break under asymetric routing and from troubleshooting point of view it would be harder to troubleshoot any issue if you have asymetry.

This is the same setup as if you'd have a single AS which would become discontiguous, in such case forwarding between parts of now-discontiguous AS and rest of the world would still work, but forwarding between the now-discontiguous parts themselves wouldn't work, but that is not an issue in this particular scenario because you have only one downstream subnet for each router.

If you'd have multiple subnets (multiple vlans or overlapping subnets) and for example 2 switches in daisy-chain topology then a single link failure could cause traffic drops between the now-discontiguous ASes, because the subnets themselves would become discontiguous.

For iBGP disadvantages: I would say that minor added configuration complexity (for more complex networks I would suggest peering using IGP-advertised loopbacks).

From my knowledge in this setup the advantages of using iBGP would outweigh its disadvantages.


Here is a different perspective:

Since you are connected to a single provider, there is no need for “upstream traffic engineering,” since it all goes to the same provider. In fact, there is no need to receive anything but a default route from your provider. IBGP really offers you no advantage in that case.

Asymmetric routing can be a issue with firewalls as @Kveri says , but there are many ways to control that. For example, you can advertise different subnets out each connection with differing metrics. If you have no firewalls (!), then this is not an issue.

You can still run eBGP with your provider to track reachability to them (not just the link status). You can also use IP SLA to accomplish the same thing. It’s your choice, depending on your comfort level with the configurations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.