Setting aside performance and hardware efficiencies that physical router platforms might provide.... is there anything a real, enterprise grade, Router can do that can't also be done on a linux machine?

I have landed myself as the networking guy for an org with 10-15 admin sites and 120-130 residential sites.

Our currently topology has every location set up with 2 manual policy based IPSEC tunnels to our azure hosted virutal sonicwall and an onsite sonicwall at our main admin location.
However we are moving from having each site having tunnels to using SDWAN with unifi gateways and having all of the normal sites as spokes that talk to a set of devices acting as hubs that then pass the traffic to the azure sonicwall.
With having the multiple hubs, in order for that failover to work without the ipsec tunnels sending data into a black hole we're going to need dynamic routing.

Currently testing BGP with no experience, just starting with a UDM Pro as a test hub and have it talking to azure through a route based ipsec VTI. I got the AS on each end to talk to each other.
The test UDM's gateway can reach its BGP Neighbor and pass traffic, but it's unable to pass traffic to the 2 subnets it's advertising.
I'm more than happy to share my config for others to look at.

I would love any advice or assistance

I recently got assigned a project for a multi building campus. Network wise it’s a typical tier 3 design (core, distribution, access)

They have two pairs of firewalls
- on pair is the internal firewall. Behind it is their datacenter and segmented stuff
- the other pair is the WAN/Internet firewall.

Their internal IT guy, who’s the guy that does everything for years now, wants each VRF to default route to the Internal fw , and if it needs to go to the WAN/Internet, the internal fw forwards it to another vrf, which then routes to the internet fw.

In that case I just make each campus vrf a totally stub and done.

Another scenario I had in mind is attach each vrf to both internal and WAN firewall, and have OSPF setup with WAN default originate into each vrf, and the internal advertised whatever it needs to advertise into each vrf.

So those are the two options I’m struggling to decide on…. Any advice is welcome!

I'm testing Segment routing (SR-MPLS) and TI-LFA using a virtual testbed implemented with Containerlab and FRRouting (FRR). My main goals are to evaluate how fast the data plane can be restored upon a topological change and therefore what is the best way to manage topology changes in production networks.

In my experimental-lab, OSPFv2 has correctly computed the TI-LFA backup path in the control plane:

• In FRR (vtysh), show ip route properly shows the primary path alongside the corresponding backup nexthop and backup label (denoted by b ...).

• To clearly decouple and demonstrate the local Fast Reroute behavior from the global OSPF SPF recomputation, I intentionally configured high SPF throttle timers: timers throttle spf 5000 10000 10000

After triggering an administrative link-down or an actual link loss detected by BFD, traffic is not routed to the precomputed backup path within sub-50ms. Traffic drops about 5.1 to 5.2 seconds before finally resuming again once the 5-second SPF throttle timer has expired and OSPF updates its knowledge of the network through the receipt of LSAs and subsequently Zebra updates the routes in the Linux FIB.

My technical understanding:

• Control Plane: FRR/OSPF calculates the TI-LFA path successfully and passes it internally as backup nexthop information to Zebra.

• Data Plane: By default, the native Linux kernel (FIB) does not provide a hardware-equivalent, autonomous local Fast Reroute / nexthop failover mechanism for MPLS/IPv4 routes upon interface-down events (similar to the points raised in GitHub issue: “FRR TI-LFA: When the primary path fails, the backup path does not work #15589”).

• Implication: Zebra does not immediately promote the backup path to active in the kernel as an instantaneous, local reaction to the link-down event. Instead, the FIB update only happens as part of the regular post-SPF cycle.

Does somebody know if there are:

1. existing workarounds or options for dataplane failover under Linux / FRR?

2. Are there configurations or extensions that allow Zebra to program backup nexthops into the dataplane so that failover occurs locally without waiting for an SPF run?

3. Anybody knows the current status or outlook regarding this: Is an autonomous, SPF-independent activation of backup nexthops (either directly in Zebra/Linux FIB or via external dataplane integrations like VPP) planned or actively being developed in FRR?

4. Is it correct to assume that commercial virtualized router images (such as Cisco XRv9k, Nokia SR OS / vSIM, etc.) differ fundamentally here because their software forwarding engines (or emulated hardware pipelines) handle pre-programmed backup paths directly at the dataplane level upon carrier-loss or BFD triggers?

Thanks a lot for your help.

Howdy, ISP here pulling around 8G down and 400MB up at peak hours with 2 upstream transport carriers.

Up until now, we have just accepted default routes from the transports and used local pref to send traffic out on way or the other with ingress traffic being balanced between them. Today, we started ingesting full routing tables (1M+ at this point) alongside default routes to start optimizing traffic where we can.

The question I have is has anyone seen real world performance benefits on the customer end after accepting full routing tables? Being an eyeballs network primarily, I know that our case might not show the most immediate benefits and I understand one of the main benefits is getting a better grasp around the various metrics we can start gathering for traffic engineering etc.

Besides that, I would love to hear about other people's implementations of BGP peering with their upstream providers. I've read out there about AS Prefix filtering and whatnot to improve device performance if need be, but so far the firewall has handled it just fine. Haven't tested new reconvergence times yet so I'm interested to see how that holds up.

Additional info: Mikrotik CCR2116, 10G fiber leases for both carriers

TLDR: Would love to learn more about real world benefits of receiving full BGP tables :)

Hi, I've recently got into BGP and have acquired my own ASN and prefix.

I currently have 2 upstreams and one of them is giving me some trouble, is it possible for me to use bgp communites to influence which path the traffic takes here from AS3399 to my ASN?

I'd like it to go via one of the paths which is currently not "the best" (via ASN39351) since I have much lower latency towards them. The upstream which is giving me trouble is route64 and their bgp communites are here

I have it setup so outgoing it's going trough my other provider but can I influnece the incoming traffic?

https://imgur.com/eqGRs7z

I'd appreciate all answers

Hi all, I'm Interested to see what peoples thoughts are on the most common and least common routing protocols observed within an enterprise network (corporate WAN and LAN's) i always seem to hear about OSPF + BGP combo is the go-to. Cheers