topic Re: Active Active BGP AS Number in General Topics

Active Active BGP AS Number

Gene_Barden — Mon, 18 Jan 2021 14:39:09 GMT

Have a Active/Active spit data center solution and question has been brought up if it is possible to use different AS numbers on each of the Palo's. My thinking is why have Active/Active, just use each Palo as a separate individual firewall at each DC. I'v never seen Active/Active Palo's having separate BGP AS numbers. It looks like it is possible since the VR config isn't synced but seems it would create an issue. Anyone else ever seen this or have an opinion?

Re: Active Active BGP AS Number

reaper — Mon, 18 Jan 2021 14:44:31 GMT

it's possible since you can split routing completely but it would take out all reason to have a cluster in the first place, unless you'd have some site specific AS with an upstream shared AS somehow (so you do end up sharing the same IP subnet over different AS)

adding clustering will only increase overhead at no gain

Re: Active Active BGP AS Number

Gene_Barden — Mon, 18 Jan 2021 14:50:20 GMT

Thanks, that was my thinking also, why even have the AA cluster at that point.

Re: Active Active BGP AS Number

reaper — Mon, 18 Jan 2021 23:33:13 GMT

i've been thinking it over a bit, the thinking is probably that each site would act as DR for the other site and a floating IP could move to the other site if one site fails ? to provide internet connectivity?

if there's an option to integrate OSPF that would be the better option, but if the network is super flat with no routing an AA A/P-P/A could work (although it will bring heartache and acid reflux 😜 )

Re: Active Active BGP AS Number

Gene_Barden — Tue, 19 Jan 2021 13:10:26 GMT

The customer is already running BGP internally even though their current ASA is all static routes. I had thought about OSPF but we ended up deciding on BGP internally since that is what they are currently running and upstream to ISRs. The A/A setup is a single firewall at each DC which was originally supposed to be A/P. It's already given me enough heartache so I don't want to introduce any more. 🙂