Active\Passive Routers w\ BGP

Question

What I'm trying to do is take two routers, "A" and "B" where 'A' is the primary router. Just like with active\passive firewalls and HSRP I want to "float" the default gateway between either Router A and Router B (99.99.99.1). All downstream hosts will use 99.99.99.1 as their DG.

Router A or Router B will need to advertise the 99.99.99.0/24 IP space, but I only want the 'active' router to be working at a given point in time. That means when A is active I don't want providers sending traffic through B. Router B, just like a passive firewall, needs to just sit there but still have the entire BGP routing table available and even likely advertise for a quick failover. I only want Router B to 'kick in' if Router A goes down. Will this work?

I may also host at IXPs.

The vendor doesn't really matter but you can assume Cisco if describing in config helps.

Answer 1

From what you've described, I take it as you don't really mind if traffic comes in via Provider 1 or Provider 2, you just wish to make sure ALL traffic (Prior to a failover scenario) comes in via Router A? If this is correct, modifying the outbound BGP attributes on your neighbours on Router B will do the trick.

For this, you could modify AS_PATH or MED. I'd recommend AS_PATH as its easier to maintain/troubleshooting & much more visible. A simple AS_PATH Prepend outbound to Provider 1 & 2 from Router B should do the trick.

Answer 2

Ingress Traffic

Many large IP transit networks support BGP community features including the ability to identify customer-advertised routes as backup routes, which then receive a worse/lower local-preference than even routes the transit network learns from its peers.

This is easier to explain with an illustration. What you must do is ask the ISP you wish to serve in the backup role if they support such a BGP community feature. If so, your job is easy; simply configure your router to add that community to the BGP announcement sent to that ISP.

If you're not sure what to ask your backup ISP, just send them to this thread. They should understand immediately when they see this diagram.

Egress Traffic

Controlling egress traffic is easier. Simply set a higher local-preference on routes learnt from your primary ISP. A small amount of traffic may still go out via ISP-B due to it announcing a few longer routes to you, but the amount of such traffic is usually trivial.

Answer 3

VRRP takes care of router failure only - the routers need to run two virtual routers for WAN, one each for Provider1 and Provider2. For the LAN side you run a third virtual router.

For provider failover, you basically advertise your network to both providers. To ensure that only Provider1 is used normally, you increase the advertised metrics towards Provider2 significantly, so that route is only ever used when the one via Provider1 fails.

For the details, you'll have to talk to your providers.

Answer 4

Yes this is a common scenario for dual homed businesses. Although, you don't want to have each Internet facing gateway dual homed, i.e. your diagrammed topology is over-engineered and will result in unnecessary downtime. Also, you ideally want your ISP links separated across physical distance, i.e. at different locations, for physical redundancy as ISP's typically share the same cable plant into your building/location. Default gateway refers to your internal gateways, i.e. how your inside IP hosts reach the Internet. That's why your diagram says "provider", to delineate between inside gateways and outside gateways.

As for ingress traffic from Internet Service Providers, or providers, that is where BGP comes into play. Noction.com's The Inbound Traffic Engineering article states:

To influence the inbound traffic path, customers can use certain attributes (such as MED, AS-PATH, BGP communities) in the updates sent to their providers. Another method is based on the longest prefix-matching behavior and can be accomplished by the BGP conditional route injection.