5

I'm aiming to build the following network (might need to open image in new tab due to width):

sample network

  • Assume those BGP links are different ISPs
    • Same ASN is advertised to both ISPs
    • Sites are interconnected via private line
    • BGP default routes only
    • We have a /24 (public address space)
    • EDIT: I should add that we're already advertising this /24 with BGP at siteA. So I'm essentially looking to add SiteB
  • Server 1 is accessible on the internet via NAT

My Question: I'm hoping to expose Server 1 via the same public IP regardless of which ISP a client comes in through. So therefore, I'm assuming the accepted method is to have the same NAT rules on both routers? Is this possible? What are the downsides to this?

2
  • 1
    Is the address space already SWIP'd to you? Or is the provider still the official owner of the /24 block of addresses that you have? – Mike Pennington Feb 26 '14 at 20:31
  • The provider owns the /24. We're already using the space at our existing location "site 1" – mwood Feb 26 '14 at 21:33
4

This won't work the way you describe it. Each connection has its own public IP belonging to your ISPs. You'll need public IP space (typically called PI space - provider indepentent) which you can advertise via BGP to both your ISP's at the same time.

The setup you describes doesn't have a shared public address between the two connections and your ISPs won't route eachothers addresses, so what you're describing is a server which is reachable through two networks on two different IP addresses. NAT rules can't solve this for you.

7
  • So yes, we'd have different peering IPs with each ISP. However, couldn't we advertise the same ASN and /24 block to each? I should add that the /24 block we're advertising is a public address space. – mwood Feb 26 '14 at 21:35
  • Ok, that changes some things. I assumed you didn't have public IP addresses since you're using NAT. If you have public space which is advertised to both ISPs it would probably work OK if you use the same NAT rules on both connections as long as your connections are stable (so you're not losing any NAT state). Personally, I wouldn't run servers behind NAT. – Teun Vink Feb 26 '14 at 21:39
  • 1
    And while I was typing my previous comment you added more details :) If the public space is assigned to ISP A, you probably won't be able to announce it to ISP B, at least not without ISP A's permission. – Teun Vink Feb 26 '14 at 21:43
  • Usually, he can get it SWIP'd to him, which gives him formal rights to announce – Mike Pennington Feb 27 '14 at 1:55
  • 1
    I marked this as the answer due to the follow-up comments etc. Basically it has clarified that mirroring NAT on both devices (though extraneous sounding) shouldn't be an issue as long as BGP is squared away -- which according to my providers won't be an issue. – mwood Feb 27 '14 at 14:20
1

The provider owns the /24. We're already using the space at our existing location "site 1"

There isn't a good way around your problem without rights to announce the IP block you have to two different upstreams. You either need:

  • Provider independent IPv4 address space (almost impossible to get these days)
  • IPv4 Addresses SWIP'd to you
  • Work exclusively with IPv6 (probably not an option)

I would ask the owner of the /24 addresses to SWIP them to you. Many providers are happy to do this because they have the potential to off-load some of their backbone traffic to another provider, while still charging you the same rate for your access circuit.

After the provider SWIPs addresses to you and you have your own ASN, you're perfectly in your rights to announce this same block of addresses to another upstream. As I mentioned in the hyperlinked comment, this arrangement tends to work better when you get addresses from a large provider, and you're dual-homing through a smaller provider. The large provider is happy to off-load traffic, and the small provider is happy to have the extra business.

If you're announcing that same /24 block of addresses to different ISPs, I don't see the point in NAT.

1
  • This makes sense. I think our address space is SWIP'd to us (new term for me): we have a redundant link at our first site with another ISP that we advertise this block to. The NAT is a carry-over from an (aging) existing design that I should probably disassemble. – mwood Feb 26 '14 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.