This article is based on a discussion, Prioritizing a BGP route over other BGP routes for IPSec tunnel traffic redirection, posted by @tamilvanan. Read on to see the guidance from our Cyber Elite @aleksandar.astardzhiev!
Hi All,
We have a physical Firewall on-premise. We have Three ISP and a single virtual router with ECMP enabled(Balanced Round Robin) in it.
Recently, we had configured Two pairs of IPsec tunnels(Pair one -Tunnel 1 and Tunnel2// Pair 2 - tunnel 3 and tunnel 4) to communicate to AWS Peer(Only one Subnet on AWS 10.x.x.x/24) using the BGP Method for successful failover.
ISP 1 -->Tunnel 1, Tunnel 2
ISP 2-->Tunnel 3 and Tunnel 4
As we had already enabled the ECMP Balanced round robin method the traffic is currently passing through tunnel 2 and tunnel 4
Now, we need the traffic to pass through only tunnel 1 and the traffic should pass through other tunnels only if the tunnel 1 fails. All the tunnels are configured under BGP.
Thanks in advance!
My guess is do we have some metrics mechanism which will influence the Tunnel through which the traffic will be egressed.
I don't understand what ECMP have to do in this question... I understand you use ECMP for Internet access (your default route), but on top of that we are talking about IPsec tunnels, so the routing to AWS private range as nothing to do with the ECMP (as long as you have any tunnel up 🙂 ). So I will abstract from this.
Now I understand that you are receiving the AWS prefix via BGP from all four tunnels. So all you have to do is to create import policy under the BGP. As I said with BGP you have lots of options to controll what you receive, how you receive it and what you advertise, probably the straight forward would be:
- Create one import policy for BGP peer over tunnel1- Since you receive only one prefix, you can leave "match" tab as it is (meaning match any route received from that peer
- On "action" tab put 100 as local preference (for example)
- Create one more import below the previous one for BGP peer over tunnel2, 3 and 4
- Leave match tab as it is
- On "action" tab put 200 for local preference
This way your firewall will receive same prefix over all four tunnel, but it will prefer the route over tunnel1. If this tunnel fails, BGP peering will also fail and fw will stop receiving the prefix from tunnel1, so it will switch to the other tunnels.
Now depending what you actually try to accomplish you may want to split the second import policy and have four different policy for each bgp peer with different local pref for each.
