2

I have a Usecase where an Access Device need to reach a Core Device over the Internet. Access Device is configured with the Public IP of the Core device as of now so that it can reach the Core over the Internet.

Click here for current setup

However, we want to add another Public Interface via another ISP for Redundancy on the Core Device. The application that resides on the Core Device can only bind to one IP Address which means I have to use a loopback IP Address and have the two Physical Interfaces configured with Public IP1(ISP1) and Public IP2(IP2).

Click here to see i would like to achieve If my Access Device need to access the Application which is bound to a loopback IP, the loopback IP need to be a Public IP as well right? Is it possible to have a Public IP for a Loopback that's reachable via ISP1 and ISP2?

2 Answers 2

3

Yes a loopback IP can be and often is a public IP.

However you are unlikely to have much luck propagating a route for a single IP outside of your own network. The de-facto policy on the internet is not to accept any prefix longer than a /24 .

Now it is possible to dedicated a whole /24 to a single service, but it gets a bit spendy according to https://auctions.ipv4.global/prior-sales a /24 currently sells for about $14000

Also note that it can take time for internet routing to re-converge when a link goes down.

0

Generally, yes, that's possible.

In your case, the problem is the routing. The destination loopback IP needs to be routable on all hops along the path from the access device through both ISPs which isn't easily possible.

For that to work you'd need to get both ISPs to advertise the destination in their ASN (or re-advertise yours) in a multi-homed scenario, somewhat similar to anycast.

I'd suggest you consider using (VPN) tunneling which would solve the ISP advertisement problem, the public loopback problem (which can then be private), and the various additional security issues that likely arise.

2
  • Thanks @Zac67. I am considering sticking in a Router in front of the Core Device. Router will host the 2 Public IPs. Core Device can sit behind the Router with Private IPs. We can then have the Router to Port Forward all the traffic to Core Device's Loopback IP. The Core Device is actually terminating IPSec from Access Device. Also its not just a single VPN /IPSec tunnel. There will be several such access devices connecting to the Core Devices over Public Internet. Core Device's job is to setup IPSec tunnel and the forward it to the local network securely if that makes sense.
    – Alex
    Mar 27 at 23:22
  • Adding a router doesn't solve your routing problem...
    – Zac67
    Mar 30 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.