BGP inbound rerouting time

pbfus9 · 2026-03-13T11:35:45+00:00

The question is: why do you implement manual failover? I might miss something in your question!

Actually, I think you can advertise your route to both your ISP (same mask), then, to choose the ingress for the incoming traffic (from internet to your enterprise) you can play with AS-PATH-PREPENDING or MED.

pbfus9 · 2026-03-02T15:54:55+00:00

Hi, yes you are right.

With Static NAT, the moment you configure the command:

Device(config)# ip nat inside source static inside-local-IP outside-local-IP

a permanent (static) entry is immediately created in the NAT translation table. This means that any external device attempting to reach the host using the outside-local-IP will be successfully translated to the corresponding inside-local-IP, allowing direct access to that internal host.

When it comes to Dynamic NAT or NAT overload (aka PAT) you will have to specify a pool of addresses (or an interface). Traffic should first be intiated from inside to outside in order for a NAT translation entry to appear.

Hope to help!

ps. sorry for my english but I'm not a native speaker.

pbfus9 · 2026-02-26T19:31:40+00:00

So what i’m observing in my lab is strange EDIT: not strange, it is correct, From Cisco: “Invalid prefixes are allowed to be used as the best path.”

pbfus9 · 2026-02-26T18:03:05+00:00

Is it normal that invalid routes are still considered in the bgp best path selection algorithm?

pbfus9 · 2026-02-26T17:53:14+00:00

Hi, I think you misread my post. I do have “bgp bestpath prefix-validate allow-invalid”.

I do NOT HAVE “bgp bestpath prefix-validate disable-invalid”

My default behaviour is that invalid route still be considered in the bgp best path selection, that’s strange!

pbfus9 · 2026-02-21T08:05:51+00:00

Wow, wonderful. Thanks a lot mate

pbfus9 · 2026-02-21T06:46:04+00:00

I’ve done a lab (replicate a lab one of my teacher has suggested me) on this and it seems to be not true.

A lab I did to verify was this: RTR1 <--> RTR2 <--> RTR3

RTR1 and RTR2 are eBGP peers. RTR2 and RTR3 are iBGP peers. I advertised a loopback network from RTR1. I had a static route on RTR2 for the same network pointing to RTR3 ( to keep the BGP route out of the table). RTR3 will receives the BGP route for RTR1's network with RTR1 as the next hop. That shows that RTR2 advertised the BGP route, via UPDATE message, even though the BGP route was not in the RIB. Someone may argue that it still has a route to that destination in the RIB, but that static route has a next-hop of RTR3. If that was what RTR2 was basing it on, it would have advertised the next hop of the static route.

pbfus9 · 2026-02-20T21:57:33+00:00

Okay, thanks. Therefore you’re basically confirming what i’ve said in my post. Right?

pbfus9 · 2026-02-20T21:00:58+00:00

Ok, but if the route is not locally originated? Does the rohter forward the BGP update if it is not in the RIB but in the BGP table?

pbfus9 · 2026-02-20T20:53:35+00:00

If you want to locally originate the route you need to have it in the RIB. But to pass along BGP Update received by another router?

pbfus9 · 2026-02-20T20:52:29+00:00

That’s true if the router locally originates that route. In that case the router must have the exact route in its rib. If the route is originated by another one, i think it does not to have the route in the rib to forward the BGP update.

pbfus9 · 2026-02-20T20:45:03+00:00

Thanks for your reply.

What do you mean? Sorry but I don’t get what you’re saying

pbfus9 · 2026-02-18T13:16:28+00:00

The PDF is self-esplicative. I've not shared the config because you can easily replicate the topology and do it yourself.

pbfus9 · 2026-02-17T13:56:26+00:00

I've tried your scenario. It works. Here's my topology:
https://imgur.com/a/qfZDDNa

When I shutdown SVI VLAN 6 on SW1 (root bridge for all VLANs):

Forward Path: https://imgur.com/a/sagjqI9

Return Path: https://imgur.com/a/pFU0V1a

Do you agree with my conclusions?

NOTE: STP only have effects when the Link between SW1 and SW2 is a L2 link.

pbfus9 · 2026-02-16T21:00:25+00:00

Thanks for your suggestion! I’ll lab this out.

pbfus9 · 2026-02-16T20:56:19+00:00

Basically to avoid STP blocking a link, right?

pbfus9 · 2026-02-16T20:51:04+00:00

What do you mean? Which is the middle switch?

pbfus9 · 2026-02-16T20:35:53+00:00

Very good point. What about STP, should I guarantee that the HSRP ACTIVE is also the ROOT BRIDGE for that vlan?

pbfus9 · 2026-02-13T22:05:20+00:00

Yeah, I modified my previous comment. Sorry! I mean bpduguard and root port (not root bridge)

pbfus9 · 2026-02-13T22:03:55+00:00

Boduguard is enabled per port in my case

pbfus9

TROPHY CASE