About KyleFreise

I'm attempting to wrap my head around a very critical piece of setting up BGP between 2 ISP's concerning how many Virtual Routers are required.   I currently have 1 ISP (A) up and running on BGP just fine and my other ISP (B) will be converted to BGP on Monday.  Both will be advertising my public IP space from ARIN.   So my question is, do I put both ISP A's and ISP B's interfaces on the same VR or do they need to be on their own separate VR's?   I'm receiving a few conflicted answers to this question, so I'm looking for real world experience.   Currently I'm still a strong believer in that I need to just add my ISP B as its own Peer Group to my current primary Virtual Router, add ISP B's own subinterface to the Resdistribution Profile along with ISP A's subinterface, configure a new Import Rule for ISP B plus an Export Rule with a Prepend of 2 if I choose to, and finally check ECMP for "load balancing".   All this sounded great until I was told the following from a Palo rep: "Two interfaces ( belonging to same VR ) cannot have IP addresses from the same subnet. x.x.x.x/24"   That threw a wrench into my whole thought process because both ISP's are advertising my /24 from ARIN, but are physically connected with 2 different /30's to each ISP's switch. ... View more

I'm running into an argument with our carrier for our 2 ISP links that I need to clarify.   We currently have two 3050's with 2 ISP links coming into both devices in an Active/Passive configuration using PBR's to route traffic.  We are adding a third ISP and dropping the slowest link, followed by implementing a BGP configuration with both ISP's.   Now I was all gungho to move forward with our current Active/Passive setup by adding BGP peering and now our carrier is telling us we cannot do that because it could cause a broadcast storm.  I'm being told that flipping between the Active/Passive firewalls could cause a flood because 1 IP address for 2 MAC addresses is bad practice.  Maybe I'm not understanding this well, but I thought active/passive is like literally unplugging a switch port and moving it.   Our carrier wants us to move to Active/Active with 2 IP addresses per ISP; one for each PAN-3050 peer.   I really do not see the purpose of moving to Active/Active as each PAN would then have an active BGP peer at a time, so anytime I perform maintence I would be bringing down one of the peers.  In our environment Active/Passive fits in great with our maintenance plans.   Any extra information on BGP experiences would be greatly appreciated. ... View more