DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

[Vigor 3220] Weird Spoofing Defense behaviour

  • nomen nescio
  • Topic Author
  • User
  • User
More
09 Oct 2019 11:44 #7 by nomen nescio
Replied by nomen nescio on topic Re: [Vigor 3220] Weird Spoofing Defense behaviour

x64 wrote:
That can't be, as the two routers need to compare notes about who is alive and has connectivity.



Yeah, I don't fully understand it myself. The ISP previously mentioned both HSRP and BGP, so I don't know what the precise config of the Cisco routers is.

There is certainly no switch connecting them to each other on the LAN side though. They are only connected to the WAN interfaces on the DrayTek, and presumably there can't be any communication between them across those WAN interfaces?

It takes 2-3 minutes for the secondary Cisco to become active when the primary goes down, which I was told is because all the HSRP/BGP stuff is being done on the internet-facing side. They said that it could potentially be sped up by putting a switch between the Cisco routers, but that was apparently not part of the standard config they were using and would be classed as a custom solution, which they weren't keen to pursue.

That's as much as I know. Still waiting for a response from them on the matter.

Please Log in or Create an account to join the conversation.

More
09 Oct 2019 22:34 #8 by x64
HSRP allows the routers to compare notes to decide who should be active - that would happen on the inside interfaces normally with a direct link between the routers.
BGP is a routing protocol. It would in this scenario operate on the outside interface. It advertises your public IP addresses from the active router of the pair back to the ISP. That way your ISP's network knows which line (Primary or backup) to send your traffic down.

The switchover delay is from two processes, the detection of the failure and the decision which router should be active, and then that winning router distributing your public IPs as part of its BGP routing chatter.

Please Log in or Create an account to join the conversation.

  • nomen nescio
  • Topic Author
  • User
  • User
More
14 Oct 2019 14:13 #9 by nomen nescio
Replied by nomen nescio on topic Re: [Vigor 3220] Weird Spoofing Defense behaviour
Ok, well the ISP has apparently checked and double-checked and says that there are no private IP address ranges whatsoever assigned to either of the Cisco routers.

I don't really know what else I can do to try and figure this out, so I guess it will have to remain a mystery!

Please Log in or Create an account to join the conversation.