You run BGP with two ISPs. How do you control which link traffic uses, outbound and inbound?
Show the answer
Say this first
Outbound is mine to control: set a higher local preference (default 100) on routes from the preferred ISP, or take a default from each and prefer one. Inbound I can only influence, because other networks choose: AS path prepending toward the backup ISP, announcing more-specific prefixes on the preferred path, and the ISPs' own BGP communities that lower local preference inside their network. MED only works between links to the same neighbor AS.
Go deeper
Before you start
- A public ASN and provider-independent space, or the ISP's permission (often a letter of authorization) to announce its space through another provider.
- At least a /24 for IPv4 and a /48 for IPv6. Longer prefixes are filtered by most networks.
- IRR route objects and RPKI ROAs for your prefixes, so both upstreams and their peers accept them.
- Decide what to receive: default only, default plus the ISPs' customer routes, or full tables (memory heavy).
Example on one router
Our AS 64500 with 198.51.100.0/24. ISP1 (AS 64501) is primary, ISP2 (AS 64502) is backup.
ip prefix-list OUR-PREFIX seq 10 permit 198.51.100.0/24
ip prefix-list DEFAULT-ONLY seq 10 permit 0.0.0.0/0
!
route-map ISP1-IN permit 10
match ip address prefix-list DEFAULT-ONLY
set local-preference 200
route-map ISP1-OUT permit 10
match ip address prefix-list OUR-PREFIX
route-map ISP2-IN permit 10
match ip address prefix-list DEFAULT-ONLY
route-map ISP2-OUT permit 10
match ip address prefix-list OUR-PREFIX
set as-path prepend 64500 64500 64500
!
router bgp 64500
bgp log-neighbor-changes
neighbor 192.0.2.1 remote-as 64501
neighbor 203.0.113.1 remote-as 64502
address-family ipv4
network 198.51.100.0 mask 255.255.255.0
neighbor 192.0.2.1 activate
neighbor 192.0.2.1 route-map ISP1-IN in
neighbor 192.0.2.1 route-map ISP1-OUT out
neighbor 203.0.113.1 activate
neighbor 203.0.113.1 route-map ISP2-IN in
neighbor 203.0.113.1 route-map ISP2-OUT out
!
ip route 198.51.100.0 255.255.255.0 Null0- The outbound route maps announce only our prefix, so we never become transit between the ISPs.
- The Null0 route lets
networkfind an exact match in the RIB. - With two edge routers, local preference carries across iBGP so both routers agree on the exit.
Why prepending is not enough
ISP2 itself usually gives routes from its customers a higher local preference than routes from its peers, and local preference beats AS path length. So ISP2 and its customers still send traffic to us over the backup link. To make ISP2 a true backup, use the community ISP2 publishes for "lower my local preference for this route".
More-specifics
Announcing a /23 to both ISPs and its two /24s only on the primary works everywhere, because longest match wins. It needs a block larger than /24, adds routes to the global table, and the RPKI ROAs must allow the longer prefixes or they become invalid.
They will ask next
Why does MED not help between two different ISPs?
By default MED is compared only between paths from the same neighboring AS. Two different ISPs are different ASes, so the far side never compares your MEDs. It is useful when you have two links to the same ISP.
How many prepends are useful?
Usually one to three. Beyond that most paths are already longer, and very long prepends look odd, get filtered by some networks and only make the route less attractive where length still matters.
Traps
- Saying you can control inbound traffic. You can only influence it.
- Forgetting outbound filters and leaking one ISP's routes to the other, which turns you into transit.