RE: [FW1] Multiple WAN Links.

["Mark L. Decker" <mdecker@FW1-NOSPAMrainfinity.com>]

iden_fw wrote:
> Regarding the negatives to BGP:
> 1. uneven load sharing --  If you have 2 circuits with the
> same ISP, this is not an issue.  Otherwise, if you have a circuit
> with 2 ISPs (as the original poster indicated) -- load sharing
> becomes uneven, and requires a more
> complex configuration.  And constant tweaking...

True, but if both circuits go to the same ISP, you don't have much
redundancy.  A problem with the carrier or ISP is likely to simultaneously
take down both links in that case.  Using different types of links (e.g. a
T1 and a DSL) to two different providers yields the most fault tolerant
design.

> How does Rainfinity load-balance incoming traffic?

For connections initiated from inside, the return traffic is load balanced
because the source address alternates between the two ISP ranges as it heads
out.  For connections initiated from outside to a webserver hosted
internally, RainWall doesn't do any load balancing of the links.  You'd need
some kind of intelligent DNS to do that, maybe custom scripting or a product
like 3DNS.

> 3. requires AS number and cooperation from both ISPs --
> Requires little
> effort, and a little $.  The only cooperation you need from
> the ISPs is for
> them to configure a BGP session with you, which any ISP
> should be able to do
> in their sleep.  I would not classify this as a negative to a
> BGP solution.

Sure, if you are a big company with your own Class B (i.e., clout).  If
you're a smaller company, many major ISPs won't peer with you.  They don't
want to be bothered advertising your routes unless you have a dozen Class
C's or more.  Some smaller ISPs may have more lenient BGP peering policies,
but even they tend to draw the line at a full Class C.  Those using NAT with
a CIDR block smaller than /24 are typically out of luck.

> 4. giant routing tables that eat gobs of router CPU and RAM,
> etc -- ;)  A
> full routing table is in the neighborhood of 88000 network
> entries.  I have
> recommended, that if you are going to take full feeds from 2
> providers on
> one router that the customer have 128 megs on at least a  36XX Cisco.

I agree.  That would be my minimum spec as a BGP router; 128M should be able
hold the ever-growing routing tables for at least a year or two.  If you
don't want the router to be a single point of failure, I'd recommend two of
them with HSRP.

> What is the list price of a Rainfinity solution?  What are
> the maintenance
> contract costs?

RainWall is US $5,000 for active/standby, or US $12,000 for active/active
with load balancing.  Standard support is 25% of the software list price for
a 1-year contract.  For comparison, a pair of Cisco 3640s with 128M DRAM
running BGP/HSRP will cost over US $24,000, before you even put any LAN or
WAN modules in them.

Mark L. Decker
Rainfinity
mdecker@rainfinity.com <mailto:mdecker@rainfinity.com>================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================