On Mon, 2010-04-19 at 14:29 +0200, Peter Rathlev wrote: > On Mon, 2010-04-19 at 14:11 +0200, shadow floating wrote: > > I've one of my customers who wants to stick to single ISP but wants to > > implement the full redundancy (no single point of failure) network > > scenario, is there a way to connect to 2 routers internet facing with > > in an active/standby fashion to a single ISP with a single IP range? > > The provider and the customer could both use HSRP (or VRRP or GLBP). It > needs a L2 connection between the two sites though, and that might not > be optimal. It can work fine though. We currently use this as a customer > of AS3308. > > +----------+ +----------+ > | ISP PE 1 |--- (?) ---| ISP PE 2 | > +----------+ +----------+ > | | > | | > +------+ +------+ > | CE 1 |--------------| CE 2 | > +------+ +------+ > > The top link (between ISP PE 1 and PE 2) is not strictly necessary and > the ISP might prefer not having it.
A much simpler and more robust approach is to get a private ASN from your ISP and run BGP. This is the scenario private ASN's are intended for and eliminates many layer 2 dependencies. All you need to do is accept a default route from the ISP and advertise your prefix to the ISP. Don't forget to test and verify that the ISP is passing on your prefixes from your advertisements rather than static routing. You will regret depending on a link failure being detected by the interfaces on both ends. Of course, if you really care about redundancy, you need to make sure the two paths between your routers and the ISP's routers are physically diverse so that when one fails, the other has a fighting chance of staying up. Watch out for common paths not just getting to the ISP but also from the ISP's points of presence you are using to their upstream connections. Also consider physical diversity of the routers at each end, you probably don't want a site problem (e.g. fire or extended power outage) to take you off the Internet either. Lot's of possibilities, your choices are limited only by your budget. For example, you may want to extend your routing through your firewalls to your internal sites so an internal network problem does not isolate the survivors (yes, you can dynamically route through firewalls without sacrificing security. But just like it is easy to add redundancy that sacrifices, rather than improves, availability; it takes care and effort to route through firewalls without degrading your security). Bottom line is you can protect against everything except your ISP fat fingering their routing tables and going completely off the air. Good luck and have fun! -- Vincent C. Jones Networking Unlimited, Inc. Phone: +1 201 568-7810 [email protected] _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
