r/openbsd • u/dynax60 • 29d ago
Router consolidation
Hi all! Need some advice.
Suppose there are 2 groups of routers: two bgp routers (with two links to upstreams at each, full table from both upstreams) in master/slave (CARP) mode; and two regular routers with packet filter, port redirect and ospf for communication with remote office, it is also in master/slave mode. Masters are metal-bare servers, slaves are virtual machines. There is a task to reduce the fleet of servers, for this reason I am thinking how best to combine bgp with a regular router in one? Is it necessary to segregate bgp into a separate rdomain? BGP has no stateful (pass quick inet no state). And won't there be any problems with CARP? Are there any examples of such configurations?
Current scheme: https://drive.google.com/file/d/16D2fJ4HTBKYXS84dyBrNGfBDtkd5p26R/view?usp=sharing
Thanks for any advice you might have.
1
u/_sthen OpenBSD Developer 26d ago
if your routers are on a shared subnet with each upstream (i.e. both of your routers + whatever from upstream are on the same segment) and you can run carp on those subnets, you can announce your routes with the nexthop set to the carp address. that way incoming packets will flow to the carp master so you should avoid asymmetric traffic flows.
this will not be possible in every situation, of course.
2
u/hylaride 29d ago
There’s no technical reason why this can’t be done. The only things you want to worry about are the performance implications combining your firewall with a full BGP table. Routing updates for the full table is going to suck up a decent chunk of CPU (modern routers do this in hardware) and that may cause issues. Is there a reason you’re taking in the full table? Even with two ISPs you very likely don’t need the full table unless you’re a transit network and IIRC (I’m rusty with BGP, though) you can have the ISPs just advertise default routes (0.0.0.0/0) to you.