Purchased Internet address space and dual ISPs / SD-WAN

[TreyMoor]

What's the best way to handle utilizing purchased Internet address block with dual ISPs (AT&T and Comcast) and SD-WAN and ensure no asymmetric routing occurs? The scenario in my head would be outbound traffic via AT&T going to a destination where the recipient only uses Comcast, will that return traffic then prefer the Comcast link path coming back?  I assume BGP will be utilized but not sure how the ISPs will need to setup their end? Maybe I'm making an issue where there is none?  I just recall in the pre-SDWAN days and utilizing routers running VRRP, the ISPs had to be involved to agree to which one would handle the traffic as the primary and the other would be the backup.  It's a bit different now with SD-WAN and I'm not sure how best to tackle this.  Any suggestions?

[AEK]

I may not have a full response to your question but as far as I remember the default behavior of FGT is to return the response traffic from the interface that received the request. It means, if the request was received from port 1 and forwarded to port 2, then the response must comeback from port 2 and will be forwarded to port 1. Unless you use asymmetric routing (not recommended) or auxiliary sessions.

Also for outbound traffic, if you send a request to remote server with a source on your AT&T link, then the remote server will definitely answer to the same, not to another IP on your Comcast link.

[funkylicious]

the tricky part would be advertising your ISP space via both LIRs, in the end you would need to choose a primary one and a backup one.

SD-WAN wouldnt really help with that in this case, in my opinion it will just complicate things to be honest.

you could use SD-WAN with separate IP spaces provided by each ISP and configure it for outbound traffic, but inbound i would not over complicate things with using SD-WAN with your IP space and choose/configure to do redundant services for each link.

[Toshi_Esumi]

Based on your initial post, I assume you don't have BGP setup with either AT&T or Comcast now. And if you get additional subnet like /29, /28, or larger subnets from either ISP, those belong to the ISP and they would just set up a static route(s) to route all traffic destined to the subnet(s) to your interface IP when the packets arrive at the ISP from somewhre else.
In other words, only in case if you have your own public BGP ASN, and you have your own public subnets, you can advertise your subnet(s) to both ISPs over eBGP.
Although it's configurable, but It's not ethical (if not illegal) that you advertise somebody's (not yours), like AT&T subnet, to somebody else, like Comcast. The owner (the ISP) would definitely complain if they see the same subnet advertisement coming from another direction. Most likely it would be dropped at the receiving ISP anyway. 

SD-WAN (not only FTNT's) is generally not designed to handle those effectively. So you have to set proper rules not to route AT&T IP-sourced packets to Comcast, and vice versa, manually. Comcast expects only Comcast IP-sourced packets because your circuit is NOT "transit", but just an end-point/customer circuit. 

Toshi

[TreyMoor]

Thank you all for your responses. The client owns their own IP range they wish to employ. They have IP space provided to them from their ISPs now which they are currently using, but wish to switch to using their own IP space at some point. Currently, the client does not have SD-WAN configured and has asked us to get that setup for them. It's been over a decade since I had any experience with using purchased IP space and AS number.  We didn't have Fortinet back then and just used Juniper routers outside of the firewalls to handle the connection to the ISPs.  The firewall only had a single, VRRP IP to hand off to no matter which ISP route was active.  I'm not sure what the best way to utilize this purchased IP space today with the FortiGate and SD-WAN.  I'm inclined to just setup SD-WAN with the currently assigned IP space from their two ISPs they have now and not utilize their purchased address space just yet.  I did consider splitting their IP range and assigning half to be used with AT&T and the other half to be used by Comcast, but I've not yet worked that scenario out completely to see what gotchas I'd run into.  

Thanks again for your response and input on this.

[aguerriero]

The internet in general, will not pass anything between ISPs and IXPs with a prefix length greater than 24 bits for IPv4 or 48 bits for IPv6. You would also need your own BGP ASN. then you can control ingress traffic with AS Path prepends and outbound with SD-WAN, local preference, or any of the the other BGP path selection criteria. 

The customer would need to request a /24, /48 or larger cidr and ASN. I don't know what your region is but you if you want US addresses and a US ASN you will need to start by creating an account at arin.net. once you have that setup they should be able to fill you in on any of the finer details about the request, pricing, and approval process.