What I'm trying to do is take two routers, "A" and "B" where 'A' is the primary router. Just like with active\passive firewalls and HSRP I want to "float" the default gateway between either Router A and Router B ( All downstream hosts will use as their DG.

Router A or Router B will need to advertise the IP space, but I only want the 'active' router to be working at a given point in time. That means when A is active I don't want providers sending traffic through B. Router B, just like a passive firewall, needs to just sit there but still have the entire BGP routing table available and even likely advertise for a quick failover. I only want Router B to 'kick in' if Router A goes down. Will this work?

I may also host at IXPs.

The vendor doesn't really matter but you can assume Cisco if describing in config helps.


  • Do you want to announce a single /24 or a larger network? If you have at least a /23 it's easy. With a single /24 it's more tricky.
    – JFL
    Apr 9, 2020 at 13:06
  • Why Do you need to need to achieve the active/standby concept via BGP? try to use IP SLA is better for you and save your time otherwise try to extend internal BGP until the switch layer if the switch l3. Apr 10, 2020 at 10:18
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 16, 2020 at 23:16

3 Answers 3


From what you've described, I take it as you don't really mind if traffic comes in via Provider 1 or Provider 2, you just wish to make sure ALL traffic (Prior to a failover scenario) comes in via Router A? If this is correct, modifying the outbound BGP attributes on your neighbours on Router B will do the trick.

For this, you could modify AS_PATH or MED. I'd recommend AS_PATH as its easier to maintain/troubleshooting & much more visible. A simple AS_PATH Prepend outbound to Provider 1 & 2 from Router B should do the trick.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Ron Maupin
    Apr 9, 2020 at 16:13

VRRP takes care of router failure only - the routers need to run two virtual routers for WAN, one each for Provider1 and Provider2. For the LAN side you run a third virtual router.

For provider failover, you basically advertise your network to both providers. To ensure that only Provider1 is used normally, you increase the advertised metrics towards Provider2 significantly, so that route is only ever used when the one via Provider1 fails.

For the details, you'll have to talk to your providers.


Ingress Traffic

Many large IP transit networks support BGP community features including the ability to identify customer-advertised routes as backup routes, which then receive a worse/lower local-preference than even routes the transit network learns from its peers.

This is easier to explain with an illustration. What you must do is ask the ISP you wish to serve in the backup role if they support such a BGP community feature. If so, your job is easy; simply configure your router to add that community to the BGP announcement sent to that ISP. BGP Community Backup Routes

If you're not sure what to ask your backup ISP, just send them to this thread. They should understand immediately when they see this diagram.

Egress Traffic

Controlling egress traffic is easier. Simply set a higher local-preference on routes learnt from your primary ISP. A small amount of traffic may still go out via ISP-B due to it announcing a few longer routes to you, but the amount of such traffic is usually trivial.

  • 1
    The OP ask how to have both ISP prefer its router A, not how to have traffic coming from a specific ISP.
    – JFL
    Apr 9, 2020 at 14:10
  • 1
    Whoops; you're right. I mis-read his question. Apr 9, 2020 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.