Stateful HA with BGP

Similar Questions

• BGP configuration

  Hi all

  Please can someone help me understand this concept...

  Let me show you the scenario

  a single MPLS of ISP connection come to my router and my router in the DMZ servers

  I have to connect to the remote server to my server DMZ

  The ISP gave me the details of BGP configure

  now what do I Route my private network for remote servers...

  I run NAT on my router to go through the ISP connection... now I can ping to the gateway of the ISP and can see all the router in table bgp #sh

  is this correct or I need to directly transfer traffic from the internal network of ISP through BGP... or

  Do I have to create Tunnels... If the Tunnels are necessary then I need to know the remote desktop

  

  Thank you very much in advance

  You have 1 site that has a circuit of mpls and the other doesn't, or go in the same provider and SPLM on both sides? If you have mpls on both sides by the same provider, it should be as easy as peering with the supplier with bgp on both sides and advertising then your internal subnets. If you have the public internet between you, you will need tunnels of lan-to-lan creat between two routers. Here is a guide to help you to do:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094634.shtml

  HTH,
  John

  Please note all useful messages *.

• Help routing with double connections 1 ISP, 2 routers, Firewall-2 lights

  My company is moving to a new building and ordered redundant Internet connections by the same ISP.  I did have a chance to talk to the ISP seller, but from what I've heard say that they expect us to participate in the BGP as will force us to balance load and high availability for inbound web traffic.  My limited experience with BGP has been in a lab environment.  The company has already bought two routers and two ASAs.  We have a block of public IP addresses.

  My goals are to

  1 allow internal out of the Internet users
  2. allow to outside users to browse our public web site.
  3. configure the routers and the ASAs so that if any one device Internet connections or lack fails, the business will continue as usual.

  Here are some of my questions to help me make sure that I'm heading down the correct path:

  -The IP addresses on the links point to point between our routers and the ISP will come from our IP address block, or if they are separated/30 links provided by the ISP?  (Even once, I have not had the chance to talk to the seller)

  ' '-Will be the link iBGP "has" requires the use of public or private IP addresses IPs can be used?  In addition to configuring iBGP on these routers, is thus a first protocol redundancy Hop configured here?

  -Should there be links routed between R1 and R2 and FW2, FW1?  Too complicating the design without real value?

  -Would be OSPF or EIGRP usually configured for links B, C D & to allow redundancy you want between the firewalls and routers?

  -What is the best practice for the determination of the flow of outbound traffic layer 3 switch (6509 s configured as a VSS) to the two ASAs?

  Any help is greatly appreciated.

  Mike

  

  Hello

  first of all that you need in your design for me of course that traffic inbound and outbound flows must be aligned end-to-end

  answers to your questions are by below:

  -The IP addresses on the links point to point between our routers and the ISP will come from our IP address block, or if they are separated/30 links provided by the ISP?  (Even once, I have not had the chance to talk to the seller)

  Any dose not need and ask the ISP to provide their own IPs for p2p links (to avoid wasting your public IP addresses)

  ' '-Will be the link iBGP "has" requires the use of public or private IP addresses IPs can be used?  In addition to configuring iBGP on these routers, is thus a first protocol redundancy Hop configured here?

  You cannot use private IP addresses

  -Should there be links routed between R1 and R2 and FW2, FW1?  Too complicating the design without real value?

  Here, it's better to use a shared VLAN L2 (switch) for these interfaces get FHRP of routers and the FWs failover works as expected

  -Would be OSPF or EIGRP usually configured for links B, C D & to allow redundancy you want between the firewalls and routers?

  If you use between HSRP/VRRP routers and using failover between the FWs, then using a shared vlan L2 as suggested above will be necessary without IGP, such as EIGRP also the link between the firewall used for FW failover is not like the one used between routers 'dose not need routing.

  -What is the best practice for the determination of the flow of outbound traffic layer 3 switch (6509 s configured as a VSS) to the two ASAs?

  If you put the ASA FWs in failover mode, then the IP address of th eprimary/active ASA FW will be used for your static routes in the L3 switches to point to and this IP address will be used by the secondary FW in a failover situation "transparent and automatic.

  hope this helps

  If useful rates

• BGP MPLS ATT

  I'm having a problem with a circuit ATT MPLS Ethernet with BGP.  I have a 140 circuit with ATT MPLS network and this is the only site where I will have this type of problem.

  RECS to the CPE BGP to Rabat and the circuit goes up and down.  Finally the circuit will remain difficult.  I see at the bottom of my router.  ATT tests the circuit and say they are testing their equipment clean.  If I go in my equipment and close the physical interface that connects to the ATT equipment the port constantly monte to the TOP and BGP is restored without any problem.

  * 26 sep 23:37:36.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state down
  * 26 sep 23:37:37.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to down
  * 26 sep 23:37:51.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to
  * 26 sep 23:37:52.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed State to
  * 26 sep 23:37:53.195: % ADJCHANGE-5-BGP: neighbor 172.X.X.X Up
  * 26 sep 23:40:07.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state down
  * 26 sep 23:40:08.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to down
  * 26 sep 23:40:08.319: % NBR_RESET-5-BGP: neighbor 172.X.X.X reset (flap Interface)
  * 26 sep 23:40:08.339: % ADJCHANGE-5-BGP: neighbor 172.X.X.X down the flap of the Interface
  * 26 sep 23:40:08.339: % BGP_SESSION-5-ADJCHANGE: 172.X.X.X a unicast IPv4 topology neighbor base removed from Rabat Interface session
  * 26 sep 23:45:20.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to
  * 26 sep 23:45:21.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed State to
  * 26 sep 23:45:22.527: % ADJCHANGE-5-BGP: neighbor 172.X.X.X Up
  * 26 sep 23:46:53.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state down
  * 26 sep 23:46:54.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to down
  * 26 sep 23:46:54.319: % NBR_RESET-5-BGP: neighbor 172.X.X.X reset (flap Interface)
  * 26 sep 23:46:54.339: % ADJCHANGE-5-BGP: neighbor 172.X.X.X down the flap of the Interface
  * 26 sep 23:46:54.339: % BGP_SESSION-5-ADJCHANGE: 172.X.X.X a unicast IPv4 topology neighbor base removed from Rabat Interface session
  * 26 sep 23:46:56.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to
  * 26 sep 23:46:59.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to down
  * 27 sep 00:01:16.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to
  * 27 sep 00:01:17.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed State to
  * 27 sep 00:01:24.171: % ADJCHANGE-5-BGP: neighbor 172.X.X.X Up
  * 27 sep 00:02:18.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state down
  * 27 sep 00:02:19.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to down
  * 27 sep 00:02:19.319: % NBR_RESET-5-BGP: neighbor 172.X.X.X reset (flap Interface)
  * 27 sep 00:02:19.339: % ADJCHANGE-5-BGP: neighbor 172.X.X.X down the flap of the Interface
  * 27 sep 00:02:19.339: % BGP_SESSION-5-ADJCHANGE: 172.X.X.X a unicast IPv4 topology neighbor base removed from Rabat Interface session
  * 27 sep 00:10:11.971: % LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state down administratively
  * 27 sep 00:10:16.963: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to down
  * 27 sep 00:10:20.319: % LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed State to
  * 27 sep 00:10:21.319: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed State to
  * 27 sep 00:10:23.911: % ADJCHANGE-5-BGP: neighbor 172.X.X.X Up

  Hello

  Looking at this exit there is certainly a problem of layer 1 over there if its wiring or connection mux fault t, 9/10 its side ISP but you will likely replace the local wiring to keep out them

  carrier lost 13, 0 no carrier, 0 break out

  carrier and no carrier has lost the carrier is an electrical signal that use Ethernet devices to detect if the wire is being used by an another transmitting station.

  The carrier lost counter increases whenever there is a loss of sense of the carrier. This occurs when the material emits a frame on the wire and does not see its own carrier wave on the Ethernet. The absence of the carrier signal increments the counter by any carrier.

  carrier lost

  Description: Cisco IOS sh interface meter. The number of times that the carrier was lost in the transmission. Common causes: find a bad cable. Check the physical connection on both sides.

• MPLS BGP route push DMVPN rays

  I have an MPLS with BGP. I have sites that are not connected directly to the SPLM, also, but need a VPN s2s hub sites that are connected to the SPLM and in this way they access resources MPLS. I need to communicate the changes to itinerary for the SPLM when the DMVPN fails on another hub.

  Currently, this is my config:

  Datacenter (MPLS only)

   interface GigabitEthernet0/1 description MPLS ip address 192.168.0.34 255.255.255.252 interface Vlan2 ip address 192.168.96.2 255.255.255.0 router bgp 65511 bgp log-neighbor-changes network 192.168.96.0 neighbor 192.168.0.33 remote-as 65510

  Hub site 1 (MPLS + internet)

   interface Tunnel200 ip address 10.99.99.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication auth ip nhrp map multicast dynamic ip nhrp network-id 12345 ip nhrp holdtime 600 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 200 tunnel protection ipsec profile dmvpn interface GigabitEthernet0/1 description MPLS ip address 192.168.1.2 255.255.255.0 secondary ip address 192.168.0.2 255.255.255.252 router bgp 65001 bgp log-neighbor-changes network 192.168.1.0 network 192.168.21.0 !10.99 clients are DMVPN spokes neighbor 10.99.99.3 remote-as 99010 neighbor 10.99.99.3 route-reflector-client neighbor 10.99.99.21 remote-as 99001 neighbor 10.99.99.21 route-reflector-client !as 65000 is the MPLS PE neighbor 192.168.0.1 remote-as 65000

  Hub 2 site, has the same configuration, except for the local ip address and the router BGP ID.

  Spoke site:

   interface Tunnel200 ip address 10.99.99.3 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication auth ip nhrp map 10.99.99.1 PUBLIC_IP_HUB_1 ip nhrp map 10.99.99.16 PUBLIC_IP_HUB_2 ip nhrp network-id 12345 ip nhrp holdtime 600 ip nhrp nhs 10.99.99.1 priority 1 ip nhrp nhs 10.99.99.16 priority 5 ip nhrp nhs fallback 60 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 200 tunnel protection ipsec profile dmvpn interface GigabitEthernet0/1 description Internal ip address 192.168.3.1 255.255.255.192 router bgp 99010 bgp log-neighbor-changes network 192.168.3.0 neighbor 10.99.99.1 remote-as 65001 neighbor 10.99.99.16 remote-as 65013

  This site speaks

   #sh ip route B 192.168.1.0/24 [20/0] via 10.99.99.1, 00:47:01

  which is the network of HUBS, but the rest of the MPLS roads are not "learned".

  What Miss me?

  Thank you!

  192.168.21.0 is another spoke, sorry for Terseco not that. Same configuration as the op 192.168.3.0. So I make a record of the domain controller and it will the first hub and not backup

  The difference is that your hubs are advertising the subnet 192.168.21.0/24 IE. you have configured it as a statement of network under your BGP configuration on the hubs and not the rays where this subnet is actually which brings me to my next point.

  The hub will switch to backup when I mannualy closed the internet interface, but not the entire router. This could be a problem?

  Yes because the Hub 1 site still has its MPLS connection until 192.168.21.0/24 advertising to the domain controller is.

  If this subnet was announced by speak it that it belonged and not the hubs then it should be announced only by hub site 2 because the Hub 1 site is more would receive it on the site talks about.

  So why are advertising a route speaks on hubs instead of reception by spoke them and transmit to the MPLS network?

  Edit - for this subnet to advertise you must have a route in the IP routing for her table.  How are getting you this route in the routing table, it with a route static and if yes, what is the exact route you entered?

  Jon

• AIDC vs COPP

  We have a 7600 router and 7600 has 2 links with BGP.

  We have a direction of ACL interface in to block a part of traffic, for example BGP traffic.

  We also have a COPP-BGP with an ACL also, with fewer blocks.

  This is who will be checked first class, AIDC or COPP.
  After some time, the reading and research, I found a document:

  http://www.Cisco.com/Web/about/security/intelligence/coppwp_gs.html

  It shows a picture with AIDC before COPP, so my first thought seems to be false (that COPP will be first and AIDC would be checked after).

  What is the order? AIDC--> COPP and COPP--> AIDC

  If AIDC is initially the COPP ACL can be less retrictive.

  Anyone know what is the correct order?

  thnks

  As the packet enters the device, "therefore" the interface the AIDC will be put into action.

  Once the package is within the unit, it can be punted to the CPU, and this is where CoPP is put into action.

  In the basic architecture as the 7600 material, not all packets are punted to the CPU, so you will have a more granular protection with AIDC.

  Kind regards

• VPN problem taking in charge the VRF CSR

  Hello community,

  I am currently evaluating CSR at AWS (60 day trial) and already around the usual problems and specialty architecture network AWS design.

  I can't open a TAC case, because we purchased no license. We will, once this last problem is solved.

  Current configuration:

  • Two councillors in a VPC in two AZs
  • Transit between two advisers of the GRE tunnel
  • running supports the BGP VRF
  • using door VRF
  • the RSC is connected to several AWS VPC (customers) via the AWS VPN feature - route entirely mesh based VPN--a VRF customer - all running with BGP
  • Link to local is done in the same way: entirely mesh route based VPN - using door VRF - all running with BGP
  • VRF import/export rules

  It works fine - no problems here. All HA tests work as expected. So far, so good.

  Now, we had to create a VPN connection to a special local location of our society. We should create a policy based VPN location (no support for VPN road based there). It is a two-to-one VPN. Two advisors of the connection to a gateway onPrem. The two tunnels, run the same field of encryption. OnPrem routing is based on the State of the tunnel. We put this tunnel in the VRF door of entry. Routes are injected to the door VRF routing table by VPN process (reverse-way static in crypto map). To get these exported to consumer VRF routes, there is a network statement in door VRF BGP process.

  Well, this also works fine if we do this only with CSR A. Reachablity is out. CSR B the delivery of the CSR due to taking work supported the VRF VPN. However, if we establish the second CSR B tunnel, there is something strange happens.

  Tunnel is very well implemented. Traffic through the tunnel at CSR B is accepted and routed to the destination. Created at door VRF on CSR B traffic is routed in its own VPN very well. However, traffic from a VRF client who reached CSR B (traceroute proved that) is not routed through the VPN tunnel, despite the VPN client routing table is to say. CSR A running the same configuration, there is no problem. Only on the CSR B.

  I don't understand this. If remove us the configuration of the tunnel of CSR and create only tunnel on CSR B, it still does not. I don't understand why, because I did a comparison of config and found no difference.

  Someone at - it an idea, whats going on?

  How can I debug this problem?

  CSR - A:

  B 172.29.13.176/28 [20/0] via 1.1.119.182 (vrf - default), 3w4d

  CSR - B:

  with route (doesn't work is not for the customer VRF)
  B 172.29.13.176/28 [20/0] via 1.1.119.182 (vrf - default), 00:00:02

  No itinerary (work, because only sent by public transit to the CSR - A)
  B 172.29.13.176/28 [20/0] via 192.168.254.53 (vrf - default), 00:38:23

  This problem is hard to describe, I would really appriciate discuss with a TAC engineer in a WebEx. Is this possible?

  Thank you.

  Hello Tobias,.

  The problem you describe is going to be outside our CSR platform expertise. Looks like the CSR works well and HA works as well, and now you're trying to find a solution to a problem of network/VPN that you are facing.

  Our team is led to find an internal resource to resolve your issue, please allow us a day or two to get back to you with an answer

  Concerning

  Tony

• Remote blackhole filtering trigger

  I have a few points to the RTBF with BGP that I can't understand it, it confused me

  first of all, it is a part of the config.

  black-hole-trigger permitted route map 10
  corresponds to the tag 66
  set ip next-hop 192.0.2.1
  the local-preference value 200
  set origin PGI
  game no-export community
  route black-hole-trigger map deny 20
  

  why we need the last 4 lines, as in some configuration, I found that allowing the last line, it is rather od DENY, why?

  Another question, is I need to know bgp for ccie lab dry or just outline would be enough?

  set local-preference 200
  

  This is necessary to ensure that, if we receive the same path to another TITLE (default local pref 100), all in our BGP routers will use our itinerary local relaxation with local AC 200

  set origin igp
  

  by default the static routes redistributed BGP will be incomplete original, and this command will update the original IGP. IGP wins over incomplete. It plays a similar role like the one above.

  set community no-export
  
  

  It's pretty simple. We do not want to advertise in our road to trigger other AS' are.

  route-map black-hole-trigger deny 20
  

  It depends on the situation. You have more roads without tag 66 you want to inject? If Yes, do not allow, if not, decline the use (or rely on implicit deny)

• IPSEC and routing protocols

  Hello world

  I read that IPSEC does not support routing with VPN's Site to the other protocols because both are Layer4.

  This means that if Site A must reach the B Site over a WAN link, we use static IP on the Site A and Site B router?

  In my lab at home I config Site to Site VPN systems and they work correctly using OSPF does that mean that IPSEC supports the routing protocol?

  IF someone can explain this please?

  Thank you

  Mahesh

  There is no problem with the routing on IPsec protocol, there are limits to some implmentations.

  Our old (strives, but still popular) crypto maps where such implemtation.

  What you need to remember, is that to make routing protocols (more) on IPsec, you must ensure that multicast is allowed through, i.e. your traffic selectors should be postponed. Another thing is that some of these protocols do a check if Hellos were recived leave a subnet connected etc etc. Of course, this isn't a problem with BGP (or most of the problems can be overcome easily).

  New implementations - side Cisco using protections of tunnel - we can run protcols routing on IPsec with very few restrictions.

  M.

• Of autonomous LR6 in terms of photography

  I autonomous LR6 but Im considering getting the Plan of photography.

  I store my photos on an eternal disc & have LR6 downloaded on my hard drive and move towards the external hard drive when you work.

  1. download the Adobe P/Plan affect my LR6?

  2. should I uninstall LR6?

  3. I have an old version of P/Shop installed, do I need to uninstall that too?

  4 are the images stored on the cloud, or can I still stop them on my EXDrive & P/Plan find them there?

  5. If I cancel the P/Plan & uninstalled LR6, always will I be able to reinstall & use LR6 (an updated downloadable version, I stated out with LR3 & updated at each new full upgrade)?

  1 installation of the cc versions will probably uninstall your lr6 (and possibly your ps) unless you uncheck this option during installation.

  2. your choice

  3. your choice

  4 store them wherever you want.  I don't trust of storage only cloud with something important.

  5. Yes.  you just need to secure your serial numbers.  It would be prudent to save the installation files, too, but they are always available and, based on adobe's past behavior, you can expect to be available for another 10 years or more.

• Compatibility of the chipset for the HP DL380 G5 and ESX 3.5

  I hope I have this question posted in the right place.

  I am running 13 HP DL380 G5s that were purchased about two years ago to run VMware Infrastructure.  We use ESX 3.5 and in the process of upgrading servers in update 3.  I also intend to add 15 extra guests in my environment but was informed that these new hosts can be placed in the same organizational groups currently in place and using DRS.

  Recently, I attended a WMware Mini Forum where Intel made a presentation stating that with ESX 3.5 Update 2, the question of adding hosts andditional with a different chipset in existing clusters has been eliminated and that DRS could VMotion virtual michines between the hosts of different chipsets with no problems.

  Can someone let me know where I can find additional documentation that supports the declaration of Intel.

  Thank you

  Doug

  You should be good. Just another thing you need to look for, is if the current processors are compatible SSE4.x. If they are then it's a cake walk even with active CVS.

  If they are not then you have nothing to worry about. Just select VCA with VC 2.5 U2. You're all set in all cases.

  I hope this helps.

  -Surya

• Several GRP files

  Hi Experts,
  
  I have the problem in our forms design scenario. I'm just stating it with a few simple examples here.
  
  Company (Key1): "COMP."
  
  LOB (key2): "LOB1."
  Formula 1
  Formula 2
  Formula 3
  Form No. 4
  
  LOB (key2): "LOB2."
  Form 5
  Form 6
  Formula 7
  Form 8
  
  COMMON forms: both LOB1 and LOB2
  Form 9
  Form 10
  
  I'm putting in place the GRP files such as:
  
  COMP_LOB1
  COMP_LOB2
  COMP_ALL
  
  I am trying to add Key2 aliases such as LOB1 and LOB2. But when I set up triggers for form 1 and form 9, only of formula 1. Same way for form 5 and form 9, only form 5 is seen. It seems that Documaker retrieves only one GRP file for a given operation. Is there anyway that we can set up like that? I understand that I can easily add common to both LOB1 and LOB2 forms and solve this problem. But I want a better design to have all the most common forms under a single LOB rather than to show them under each of the LOBs separately.
  
  Thank you.

  Hi Nirmal,

  The system is not design to evaluate, or keep available, several key values. One of the reasons for the use of the key is to reduce the number of triggers that have to gauge when the system is running. If all triggers need to be assessed then the performance of the system would be negatively affected.

  What you can do, however, is to simply place a reference for common forms in each of the groups. You will always have a real form to maintain.

  Hope this clears things up for you,
  ~ Andy

• I get a 'Secure connection' error failed with google stating "certificate contains the same serial number.

  When I click on a link to a google search, I get the "Secure connection" error failed in Firefox. He says, "please contact the administrator of the server or email correspondent and give them the following information: your certificate contains the same serial number for another certificate issued by the certification authority."

  I followed the instructions here:
  https://support.Mozilla.org/en-us/KB/certificate%20contains%20The%20Same%20serial%20number%20As%20another%20certificate
  and looked at this article:
  https://support.Mozilla.org/en-us/questions/1028103?ESAB=a & As = AAQ

  I uninstalled and reinstalled Firefox, deleted the entire folder profiles and reset Firefox. I see that the older (orphans) article points to my router. However, I have a new router and have updated their software. There is no button to add an exception (as stated in the article), so I can't just work around it. This problem does not occur with IE, so I have a hard time to believe that it is my router.

  How to solve this problem? I really want to change browser.

  Finally, I tracked the issue. The answer was found here:
  https://support.Mozilla.org/en-us/questions/1028985

  It turns out that Avast has a web shield that passes through its own verification of certificate https. Of course, this feature is not quite right and loses track of the certificates. Disable "https scanning" in the settings of Avast resolved the problem.

• Vista Home Premium will not read/recognize/burn HD videos taken with my Canon camcorder HDD21/AVCHD (MTS format). Results in the message stating "Windows Media Player may not supported file type or the codec that the file compressed.

  I have a Vista Home Premium 64-bit, Service Pack 2 Dell.  He read/won't recognise no videos HD taken with my Canon camcorder HDD21/AVCHD (MTS format).  Each attempt generates a message stating "Windows Media Player may not support the file type or the codec that the file compressed.  I used a Windows 7 PC, which allowed me to play the video from the camcorder and burn a DVD of the video to share with the family.  I'd appreciate any help.  Thank you

  Information on the types of media files that supports Windows Media Player
  http://support.Microsoft.com/kb/316992

  For better support please try the Microsoft Vista for photos and video forum instead. http://social.answers.Microsoft.com/forums/en-us/vistapictures/threads

• By default static route with recevied BGP default route

  Hi guys;

  I have a problem and I don't know how to find or solve it.

  My chart is attached, please check everything first.

  Secondly, I have a multihomed BGP with two Internet service providers, I received two ISPS via BGP default route.

  Now, I have two types of IP addresses as follows:

  1 - my own prifixes, who has recorded with my ACE

  2 - iPs purchased ISP2.

  I have two networks, the first will contain my own prefixes and second will contain my prifixes ISP2. so I have to go on the internet, static route by default to the ISP2 need and that's fine, now the problem that carry the second defect I received two ISPS in routing however my table if I show ip bgp I see that I received it, but because of favorite and distancing China he disappear the default road statistics.

  so now a network is already online and the second network that contain my own IPs is out of service, of course this second network I need to routed to my isps1 via bgp and when isps1 down, go through ISP2 and I do using weight and as path prefix.

  Thank you

  Hi Nathan,

  With ACB option, you config-route map is your own prefix and set its next hop ISP 1 and 2 PSI when ISP 1 IP is not accessible. Apply the road map to interface with Network1. ACB is processed before routing.

  With option VRF, put the Network1 interface and isps1 VRF1, so it will have separate routing table. Under the vrf1 you static default config with higher AD and the next hop pointing to ISP2 in the global routing table. This will be used when you lose by default isps1. Because separate ridges VRF table routing, so netwoek1 will use the default route in vrf1 to isps1 as primary, the Network2 use ISP2.

  HTH,
  Lei Tian

  Sent by Cisco Support technique iPhone App