No no no I can't advertise my prefixes to the provider they are not all from public address space. Never the less customer is now willing to spend a little more money and to by ASA :) Thank you for your help
On Thursday, July 11, 2013, Pshem Kowalczyk wrote: > Hi, > > I'm also slightly confused by the requirements here. If all the sites > are publicly addressed, with internet access, why don't you just plain > route the traffic across the internet? Each site has a default route > from your provider and advertises its internal ranges to the provider. > All the other sites can see that as well, so a local 3560 either sends > it to the provider (for all remote sites, the provider does the > routing towards the end site) using default route, or keeps it > internal based on its local routing table. If you use the same AS in > all the 'islands' then 'allowas-in 1' on the BGP session with the > provider should do it. > > kind regards > Pshem > > On 12 July 2013 07:49, Pavel Dimow <[email protected] <javascript:;>> > wrote: > > Hi Phil, > > > > the main problem is that I have 3560 at branch offices which I can not > > change. The 3560 have a very poor GRE tunnel performance (when it acts as > > endpoint). I have multiple branch offices (each with 3560) and one > central > > office. I am wondering if there is any mechanism that I can use on 3560 > to > > tunnel traffic from branch office to central location? Keep in mind that > it > > is very expensive to have L2 or L3 VPN. I need to exchange routes between > > central and branch offices and my solution would be some BGP and few > static > > routes for my super nets. > > My best guess is that I will need to change 3560 but I want to be sure > that > > there is nothing else I can do with those boxes.. > > > > > > On Thu, Jul 11, 2013 at 11:15 AM, Phil Mayers > > <[email protected]<javascript:;> > >wrote: > > > >> On 10/07/13 21:18, Pavel Dimow wrote: > >> > >>> Hi, > >>> > >>> I have a a few branch offices and I want to connect them with central > >>> site. > >>> Now I have a few problems. First at every branch I have the same > provider > >>> but it is very expensive to use any kind of their L2 or L3 MPLS > services > >>> hence I have only internet access. Also, at every branch we have cisco > >>> 3560 > >>> with very bad GRE tunnel performance (about 2Mbps). > >>> Now my only solution is to like this: > >>> Setup EBGP with ISP (require only default route) and setup IBGP with > >>> route > >>> reflector at my central location. With this I should be able to have > only > >>> default route from my ISP and all routes from my network (central and > >>> branch offices) and use only a single link from ISP without the need > for > >>> GRE tunnel. > >>> Any ideas if I am missing something? Any advices for better solution? > >>> > >> > >> I don't understand your solution. Without some kind of tunnel or > >> encapsulation, your routing table is irrelevant - once the traffic > reaches > >> your ISP, it obeys their routing table, and will either be forwarded > >> correctly (in which case you don't need the iBGP) or incorrectly (in > which > >> case iBGP does nothing) > >> > >> Can you describe in more detail what you mean by "isolated L3 islands"? > >> > >> I suspect you're going to need an additional or different box at each > site > >> to encapsulate the traffic. > >> > >> ______________________________**_________________ > >> cisco-nsp mailing list [email protected] <javascript:;> > >> https://puck.nether.net/**mailman/listinfo/cisco-nsp< > https://puck.nether.net/mailman/listinfo/cisco-nsp> > >> archive at http://puck.nether.net/**pipermail/cisco-nsp/< > http://puck.nether.net/pipermail/cisco-nsp/> > >> > > _______________________________________________ > > cisco-nsp mailing list [email protected] <javascript:;> > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
