ISP Redundancy vs BGP routers

[jmcgrady]

I'm designing a firewall solution with two SPLAT checkpoint NGX firewalls connecting through two cisco routers to two ISPs. The client has asked for some traffic to be routed to ISP B and all other traffic to route to ISP A. I'm configuring BGP routing between all three parties.

I'm not sure if i will be able to selectively route without getting split routing on the return traffic. So i'm thinking of making ISP A the default for all traffic with ISP B as the backup (i will convince the client). I'm trying to decide whether i would be better off using Checkpoint's ISP redundancy. I dont like the idea of having to NAT all traffic, but the facility does look robust.

What do people here think? Is ISP redundancy a solid mechanism? Would it provide benefit in my case?

[RobertGraham]

I had to do this once, it was with Nokia devices on R53, so I didn't have the option of CheckPoint's ISP Redundancy at that time.

The result was that I had to resort to loading the full BGP table all 190000 entries then(no idea how big it is now). IMO, this is the only real professional and scalable way to do this. I contend that "ISP Redundancy" is an ugly kludge that shouldn't be used. This is my opinion and I'm sticking to it.

Why is that? Firewalls in contrast to routers don't work well with asymmetric routing(because of the state tables). This is what ISP Redundancy is trying to cover up. If you put a router in front that performs the routing without issue and keep the firewall ignorant of the whole thing, it's a much more resilient solution. There are also many benefits of BGP in and of itself, but that's left as further reading.

Regardless, you do have to consider the costs of BGP:

<> Powerful router to carry whole table with lots of RAM
<> BGP migration (planning, testing, downtime, etc)
<> Network admin versed in the arts of BGP to set it up
<> Network admin versed in the arts of BGP to maintain it


If you can afford the extra cost with a solid business case, definitely go for BGP. Otherwise, if you're on a small budget, you could try to get by with ISP Redundancy.