AWS IPSEC on BGP routing (how to control traffic preference for each tunnel?)

[FortDoog]

Good day guys.

I have the following setup.

• 200F with dual WAN
• 4 tunnels to AWS (the usual IPSEC with 2 tunnels).
• Probably, next year, hopefully, I will have AWS Direct Connect.

Let´s begin with the IPSEC tunnels first:

I´m having issues with the ECMP on the AWS TGW, what I need is just failover between the tunnels, but I want to setup the priority in which they are used under normal conditions, like in the following graph:

I want to influence the traffic (inbound and outbound) so it has the Tunnels in this order of preference:

1. Main_Tunnel01
2. Main_Tunnel02
3. Secondary_Tunnel01
4. Secondary_Tunnel02

Or

1. Main IPSEC
2. Secondary IPSEC

Right now, what I´m having (with ECMP disabled) is that I´m loosing traffic partially if I lose a Tunnel. If I enable ECMP, I get traffic through all the tunnels, and I do not want that.

I found the Technical Tip : Difference between asymmetric routing and auxiliary sessions., I will testing that also, but right now I´m confussed with this AWS documentation: 

• https://aws.amazon.com/blogs/networking-and-content-delivery/creating-active-passive-bgp-connections....
• https://repost.aws/knowledge-center/direct-connect-asymmetric-routing
• https://repost.aws/knowledge-center/direct-connect-bgp-communities

IF I understood correctly the AWS docs, I should use:

• Outbound traffic: Local Preference, if not, then I should use AS_Path
• Inbound traffic: Local Preference, if not, MED, if not, then I should use AS_Path

Meaning that I would need two sets of route maps (right?) they would identical in prefix list (my case), but they will differ regarding the Local Preference, MED and AS_Path.

My questions are:

• do I need to setup Local Preference, MED and AS_Path for AWS IPSEC routing inffluencing (all of them, meaning more route maps)?
• or can I use just one of them? meaning, just two route maps, one with more influence than the other,
• if so, which one should I use (Local Preference, MED or AS_Path)???

Keep in mind that I have to leave the space for the future implementation of the Direct Connect, so, whatever I use, I have to leave it so that in case that the Direct Connect fails, the failover SHOULD be Main IPSEC, if the Main IPSEC fails too, then Secondary IPSEC.

Please, I need guidance, oh Wise People of the Community, Help. (FWI: english is my second language, that´s why I´m getting a little confused, sorry about that).

[jhonnymertin849]

You can control traffic preference for each tunnel by adjusting the BGP attributes such as local preference or MED (Multi-Exit Discriminator). This allows you to prioritize certain tunnels over others for outbound traffic. Additionally, you can use route maps or policies to influence inbound traffic preference. Consider exploring these 9anime options to fine-tune your setup for optimal performance. Good luck with your configuration.

[BillH_FTNT]

Hi,

Hi FortDoog,
I think what you planned to do with BGP prefixes was right. However, to work with the prefix list, I believe you should change it slightly.
I think the common rule for prefix-list is "len <GE <=LE"
In your case the prefix you configured a.b.c.d 255.224.0.0 ==> the len is 8+7 =15 (225 use 8 bits, 224 use 7 bits)
==> It should be "ge 15"
1. you can do "ge 15" only.
2. or ge 15 le 25
(In your first case, ge 11 is an invalid one, I think)
HTH
Bill

[FortDoog]

If I understood correctly, the subnet mask should match the filter ge then? (remember, simple terms, since this is all in english)

[BillH_FTNT]

 a.b.c.d 255.224.0.0

=> Subnet mask len is 15

So, the "ge" must be greater 15. 

[Toshi_Esumi]

ge and le length need to be longer than the network length. The error message says it all

FGTxxxxx1 (1) # next
Invalid prefix range -- make sure: len < ge-value <= le-valueobject check operator error, -650, discard the setting
Command fail. Return code 1

I think this is common with other routers like Cisco. Or FTNT copied this spec from Cisco.

Toshi

[FortDoog]

Ok, now I understand.

For posterity or anyone reading this. The filters (ge and or le) MUST be different than the subnet you are trying to filter.

Like Bill and Toshi said:

• set prefix a.b.c.d /20 for example.

The ge would NOT be 20, neither le.

It has to be:

• in case of ge, 19. So it will take all network greater than 19, those will be, 20, 21, and so on.
• Or the reverse of it,  in case of le, 21. Is kinda like a math equation.

[Toshi_Esumi]

I think 19 and 20 is prohibited if the network length is /20. Otherwise the error message the system gave me is wrong. Did you test and confirm as the fact?

Toshi

[FortDoog]

That´s the thing, it did NOT give me an error. Now, there is one big thing I believe I did not point out, and it was critital to say: the firmware is 6.x.x. (I don´t recall the exact number right now). So most probably, the whole problem was due an old forgotten bug probably. and most most probably corrected in newer versions.

I know, you will ask why in 2024 we are running a 200F firewall on 6.x.x firmware... ask my management about that... I decided just to do my best with what I got / what I am allowed to do.

[BillH_FTNT]

@FortDoog You should upgrade to a new one such as 7.0.13 or 7.2.6 

I think they are better

[wixvelodeveloper]

You can control traffic preference for each tunnel by adjusting the BGP.

wix velo developer,