eBGP Dual ISP, Dual Edge Router

Question

I am currently using a very simple eBGP and iBGP configuration in my network to route out through a single ISP. This diagram gives a rough idea of what I currently have in operation:

I am running out of capacity through ISP 1 and would like to add an additional ISP and create a dual homed setup. I have a /20 from ARIN that I am advertising to ISP1.

This is the setup I would like to end up with:

I know that I can use local-pref to control which of my two edge routers customer traffic should exit through. However, inbound route control is more difficult.

I would like to advertise my same /20 to both ISP 1 and ISP 2. Is there any way I can load-balance incoming traffic into my network? I know there are tricks such as as-path prepending, etc...

I don't want to run into a situation where all inbound traffic is taking preference through ISP 1, to the point where I'm maxing out the 1G connection, while ISP 2 sits idle.

I use VyOS on my edge routers.

Answer 1

inbound route control is more difficult

Understatement of the century. Just as you can use local-pref to push traffic out which ever pipe you wish, others can as well. As a result, you have little control over how traffic reaches you. AS-PATH is the only sure-fire way to remotely influence route preference (and the local network admin can still override it, but my experience says that's rare.) Depending on your two ISPs, there may be various communities that can limit where your routes go.

Answer 2

Rule number 1 of BGP: "You can't tell someone else what to do with their traffic. You can only gently prod them in the right direction."

AS-Path Prepending would be my recommendation. If your upstream strips of the prepending, phone them up and ask them nicely to stop. :)

Local-Preference would be my recommendation for outbound load balancing. You can easily create policies that attach a local preference to BGP communities. You then tag the communities when the routes are advertised to you. The ISP I work for does this to seperate out domestic peerings vs international, and public peering exchanges, different locations, and so on. Makes it easy to see where routes have come from and then apply an L-Pref to them. You can then also potentially use communities to advertise bgp remote triggered black hole (RTBH), if your upstreams support it of course.

Edit: Was just thinking. We have a situation where we want a 100% guarantee that an upstream will use a certain path for return traffic. We advertise to them the individual /24's instead of the bigger supernet. Could be a potential option as longest match always wins over anything else.

Answer 3

Like others have said, there's no foolproof way to do this, and it will constantly need tweaking. That said, we've had the best luck by deaggregating. I know it's very frowned upon, but it seems to be pretty effective. Essentially, continue to advertise the /20 to both providers, but then also advertise the first half of the /20 (a /21) to ISP 1 and advertise the last half of the /20 (a /21) to ISP 2. Thus, all traffic destined to the first /21 uses ISP 1, and all traffic destined to the second /21 uses ISP 2. If either connection fails, the /20 advertised to the other ISP will keep everything flowing.

Like I said, I know this is bad form and frowned upon...but it works.

Answer 4

You can use MED to influence inbound traffic to your AS.