What I'm trying to do is take two routers, "A" and "B" where 'A' is the primary router. Just like with active\passive firewalls and HSRP I want to "float" the default gateway between either Router A and Router B ( All downstream hosts will use as their DG.

Router A or Router B will need to advertise the IP space, but I only want the 'active' router to be working at a given point in time. That means when A is active I don't want providers sending traffic through B. Router B, just like a passive firewall, needs to just sit there but still have the entire BGP routing table available and even likely advertise for a quick failover. I only want Router B to 'kick in' if Router A goes down. Will this work?

I may also host at IXPs.

The vendor doesn't really matter but you can assume Cisco if describing in config helps.


  • Do you want to announce a single /24 or a larger network? If you have at least a /23 it's easy. With a single /24 it's more tricky.
    – JFL
    Apr 9, 2020 at 13:06
  • Why Do you need to need to achieve the active/standby concept via BGP? try to use IP SLA is better for you and save your time otherwise try to extend internal BGP until the switch layer if the switch l3. Apr 10, 2020 at 10:18
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 16, 2020 at 23:16
  • That topology is over-engineered and causes more problems than good. The provider should not be dual homed to each customer Internet facing gateway. You want one pipe from provider A to Router/Gateway A and one pipe from provider B to router/gateway B. Otherwise, it's over complicated and overly complex. May 30, 2022 at 17:56

4 Answers 4


From what you've described, I take it as you don't really mind if traffic comes in via Provider 1 or Provider 2, you just wish to make sure ALL traffic (Prior to a failover scenario) comes in via Router A? If this is correct, modifying the outbound BGP attributes on your neighbours on Router B will do the trick.

For this, you could modify AS_PATH or MED. I'd recommend AS_PATH as its easier to maintain/troubleshooting & much more visible. A simple AS_PATH Prepend outbound to Provider 1 & 2 from Router B should do the trick.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Ron Maupin
    Apr 9, 2020 at 16:13

Ingress Traffic

Many large IP transit networks support BGP community features including the ability to identify customer-advertised routes as backup routes, which then receive a worse/lower local-preference than even routes the transit network learns from its peers.

This is easier to explain with an illustration. What you must do is ask the ISP you wish to serve in the backup role if they support such a BGP community feature. If so, your job is easy; simply configure your router to add that community to the BGP announcement sent to that ISP. BGP Community Backup Routes

If you're not sure what to ask your backup ISP, just send them to this thread. They should understand immediately when they see this diagram.

Egress Traffic

Controlling egress traffic is easier. Simply set a higher local-preference on routes learnt from your primary ISP. A small amount of traffic may still go out via ISP-B due to it announcing a few longer routes to you, but the amount of such traffic is usually trivial.

  • 1
    The OP ask how to have both ISP prefer its router A, not how to have traffic coming from a specific ISP.
    – JFL
    Apr 9, 2020 at 14:10
  • 1
    Whoops; you're right. I mis-read his question. Apr 9, 2020 at 21:38

VRRP takes care of router failure only - the routers need to run two virtual routers for WAN, one each for Provider1 and Provider2. For the LAN side you run a third virtual router.

For provider failover, you basically advertise your network to both providers. To ensure that only Provider1 is used normally, you increase the advertised metrics towards Provider2 significantly, so that route is only ever used when the one via Provider1 fails.

For the details, you'll have to talk to your providers.


Yes this is a common scenario for dual homed businesses. Although, you don't want to have each Internet facing gateway dual homed, i.e. your diagrammed topology is over-engineered and will result in unnecessary downtime. Also, you ideally want your ISP links separated across physical distance, i.e. at different locations, for physical redundancy as ISP's typically share the same cable plant into your building/location. Default gateway refers to your internal gateways, i.e. how your inside IP hosts reach the Internet. That's why your diagram says "provider", to delineate between inside gateways and outside gateways.

As for ingress traffic from Internet Service Providers, or providers, that is where BGP comes into play. Noction.com's The Inbound Traffic Engineering article states:

To influence the inbound traffic path, customers can use certain attributes (such as MED, AS-PATH, BGP communities) in the updates sent to their providers. Another method is based on the longest prefix-matching behavior and can be accomplished by the BGP conditional route injection.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.