Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Bernardes
Advisor
Advisor
Jump to solution

Assymetric Routing

Gentlemen,

help me choose an option to solve an issue in the following scenario: The topology is as shown below. This company is an ASN and has 2 edge routers that advertise their /23 IP block (I am using private IPs to represent).

topology.png

Currently, each router has a configured VLAN. However, due to both routers advertising the /23, it can cause packets to return through either of the two routers. The example below better illustrates what I mean.

assym.png

So what would you do in this case?

Configuring both VLANs on each router would be a solution, right? Regardless of which router the packet returns through, it would be delivered to the originating VLAN and routed back to the correct firewall interface.

vlans.png

To configure VRRP between the routers, it would be necessary to change the addressing of the interfaces because for using a VRRP virtual IP, both routers need to have an interface in the same network, correct? With the current scenario, each router has a /29, a different subnet, and therefore VRRP would not work, right?

It would also be possible to configure BGP on the Check Point, correct?

However, I personally have never done that, so what would be the recommended approach for setting up a BGP peer on the Check Point?

I appreciate your assistance!

0 Kudos
1 Solution

Accepted Solutions
Bernardes
Advisor
Advisor

After analyzing the possibilities, we have opted for the simplest solution that was not initially considered. Since it is a /23 that both routers will advertise, it doesn't make sense to subnet and create different VLANs on the firewall side.

Instead, we will create a single bond interface, aggregate as many physical interfaces as necessary, and assign an IP from the /29 subnet to this bond interface. This ensures that the same firewall interface will receive the return packets and avoids creating asymmetry.

top-final.png

For routing redundancy, we will configure two default routes and enable ISP redundancy in active/backup mode. For this specific scenario, we believe this is the best option. What do you think?

View solution in original post

0 Kudos
5 Replies
the_rock
Legend
Legend

That sounds right, to configure same VLANs on both routers. Are these Cisco?

Andy

Bernardes
Advisor
Advisor

Hello @the_rock ! These routers are Mikrotik

0 Kudos
the_rock
Legend
Legend

The only reason I know about that company is because I saw their building in Riga, Latvia : - )

Anyway, does not change the fact they are not Cisco, I still believe in same suggesiton I gave.

Andy

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Have you considered iBGP between R1 & R2 ?

CCSM R77/R80/ELITE
0 Kudos
Bernardes
Advisor
Advisor

After analyzing the possibilities, we have opted for the simplest solution that was not initially considered. Since it is a /23 that both routers will advertise, it doesn't make sense to subnet and create different VLANs on the firewall side.

Instead, we will create a single bond interface, aggregate as many physical interfaces as necessary, and assign an IP from the /29 subnet to this bond interface. This ensures that the same firewall interface will receive the return packets and avoids creating asymmetry.

top-final.png

For routing redundancy, we will configure two default routes and enable ISP redundancy in active/backup mode. For this specific scenario, we believe this is the best option. What do you think?

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events