manual

8 Copyright © 2010, Juniper Networks, Inc.
APPLICATION NOTE - Branch Office Connectivity Guide
Figure 6: BGP routing design
The main advantages of this design are that it accommodates multiple devices and scales to a large number of
remote offices. Route processing is somewhat distributed by route reflectors. However, each device still has to go
through the BGP route selection process, but the number of sessions that each firewall has to maintain is minimal—
as is the number of messages that it has to process.
Unfortunately, while ubiquitous on service provider environments, BGP is not commonly used by enterprise
customers. This lack of expertise can prove to be challenging as the administration of the network becomes more
complex. Also, the extra cost of the equipment—when employing route reflectors—must be weighed when selecting
a final design.
Typically, when service providers sell the large-scale IPsec VPN service to their customers, they use BGP as the
routing protocol in a similar manner. This solution is well tested and has been shown to work in large customer
deployments.
Also, BGP might be a good choice as an interior gateway protocol (IGP) inside each data center (and between data
centers). For information about using this protocol, see the Internet Connectivity section.
Using Static Routes
A simple solution used for connectivity consists of using static routes at both endpoints of the tunnel. On each
branch, a single aggregate route for the entire internal network (and a more specific route pointing to the data center
terminating the tunnel) is configured. In turn, at the data center, a route for each remote network is configured by
mapping traffic to the particular tunnel. By modifying the metrics for the routes on both endpoints of each backup
tunnel, traffic is directed to the backup tunnels only during a failure. An IGP routing—for example, OSPF—can then
be used to distribute the static routes configured at each VPN concentrator. For additional information about the data
center IGPs, see the Internet Connectivity and the Internet Connections sections.
Although basic to deploy, using static routes has several disadvantages:
• Provisioning and managing the routes can become troublesome particularly because each site can have from
one to four tunnels. A minimum of 3,000 static routes must be configured (one on the data center for each site,
and two at each site).
• Modifying the addressing space at a branch requires manual reconfiguration. The firewalls at the head-end
of the network, terminating the IPsec tunnels, require reconfiguration with static routes pointing to the new
addresses.
• Relying completely on an external form of dead peer detection (DPD)—such as IPsec DPD, Internet Key
Exchange (IKE) keepalives, or VPN monitoring—is desired so traffic can be switched during a failure.
With this design, traffic originating at a device directly connected to a VPN concentrator and terminating a
backup tunnel cannot reach the remote office associated with that tunnel. The problem resides on the protocol
DATA CENTER 2
DATA CENTER 1
CE 1
CE N
RR1
RR2
OSPF
AREA 0
IBGP
IBGP
IBGP
IBGP
IBGP
IBGP
IBGP
Advertises
DC 1 Network
DC1 + DC2 Aggregate Network
Advertises
CE 1 Network
Local Pref 200
Advertises
CE N Network
Local Pref 100