One of my readers wanted to use EIBGP to load balance outgoing traffic from a pair of WAN edge routers (hint: wrong tool for this particular job¹). He’s using a design very similar to this one with VRRP running between WAN edge routers, and the adjacent firewall cluster using a default route to the VRRP IP address.

The problem: all output traffic goes to the VRRP IP address which is active on one of the switches, and only a single uplink is used for the outgoing traffic.

This is how my reader wanted to use EIBGP load balancing:

I considered changing settings in the firewall to do ECMP to the physical interfaces (IP) of the switches. We checked it and it seems easy but need to be tested. Or maybe I could use EIBGP, but I’m not sure about this solution and where to put it and how plus I read some comments about possible forwarding loops.

Unless you’re using BFD with static routes (or some similar vendor-specific functionality like reliable static routes), it’s not a good idea to use static routes pointing to physical IP addresses from the resiliency perspective. An interface might go down, and the static route would keep sending traffic into a black hole.

However, that’s easy to solve with an ancient trick: use two VRRP (or HSRP or GLBP) groups, each one “owned” by one of the switches, and have two static routes pointing to the two VRRP addresses.

Ideally one would run a routing protocol between the WAN edge routers and the firewall cluster, and advertise the default route from both switches (that’s why the routing protocols were invented).

Finally, if you’re faced with a security professional who considers OSPF insecure, go for EBGP.

Revision History

2023-10-09

Added link to a video explaining EIBGP load balancing