DrayTek UK Users' Community Forum
Help, Advice and Solutions from DrayTek Users
[Vigor 3220] Weird Spoofing Defense behaviour
- nomen nescio
- Topic Author
- Offline
- New Member
Less
More
- Posts: 7
- Thank yous received: 0
09 Oct 2019 11:44 #95062
by nomen nescio
Yeah, I don't fully understand it myself. The ISP previously mentioned both HSRP and BGP, so I don't know what the precise config of the Cisco routers is.
There is certainly no switch connecting them to each other on the LAN side though. They are only connected to the WAN interfaces on the DrayTek, and presumably there can't be any communication between them across those WAN interfaces?
It takes 2-3 minutes for the secondary Cisco to become active when the primary goes down, which I was told is because all the HSRP/BGP stuff is being done on the internet-facing side. They said that it could potentially be sped up by putting a switch between the Cisco routers, but that was apparently not part of the standard config they were using and would be classed as a custom solution, which they weren't keen to pursue.
That's as much as I know. Still waiting for a response from them on the matter.
Replied by nomen nescio on topic Re: [Vigor 3220] Weird Spoofing Defense behaviour
x64 wrote:
That can't be, as the two routers need to compare notes about who is alive and has connectivity.
Yeah, I don't fully understand it myself. The ISP previously mentioned both HSRP and BGP, so I don't know what the precise config of the Cisco routers is.
There is certainly no switch connecting them to each other on the LAN side though. They are only connected to the WAN interfaces on the DrayTek, and presumably there can't be any communication between them across those WAN interfaces?
It takes 2-3 minutes for the secondary Cisco to become active when the primary goes down, which I was told is because all the HSRP/BGP stuff is being done on the internet-facing side. They said that it could potentially be sped up by putting a switch between the Cisco routers, but that was apparently not part of the standard config they were using and would be classed as a custom solution, which they weren't keen to pursue.
That's as much as I know. Still waiting for a response from them on the matter.
Please Log in or Create an account to join the conversation.
- x64
- Offline
- Junior Member
Less
More
- Posts: 95
- Thank yous received: 0
09 Oct 2019 22:34 #95066
by x64
Replied by x64 on topic Re: [Vigor 3220] Weird Spoofing Defense behaviour
HSRP allows the routers to compare notes to decide who should be active - that would happen on the inside interfaces normally with a direct link between the routers.
BGP is a routing protocol. It would in this scenario operate on the outside interface. It advertises your public IP addresses from the active router of the pair back to the ISP. That way your ISP's network knows which line (Primary or backup) to send your traffic down.
The switchover delay is from two processes, the detection of the failure and the decision which router should be active, and then that winning router distributing your public IPs as part of its BGP routing chatter.
BGP is a routing protocol. It would in this scenario operate on the outside interface. It advertises your public IP addresses from the active router of the pair back to the ISP. That way your ISP's network knows which line (Primary or backup) to send your traffic down.
The switchover delay is from two processes, the detection of the failure and the decision which router should be active, and then that winning router distributing your public IPs as part of its BGP routing chatter.
Please Log in or Create an account to join the conversation.
- nomen nescio
- Topic Author
- Offline
- New Member
Less
More
- Posts: 7
- Thank yous received: 0
14 Oct 2019 14:13 #95088
by nomen nescio
Replied by nomen nescio on topic Re: [Vigor 3220] Weird Spoofing Defense behaviour
Ok, well the ISP has apparently checked and double-checked and says that there are no private IP address ranges whatsoever assigned to either of the Cisco routers.
I don't really know what else I can do to try and figure this out, so I guess it will have to remain a mystery!
I don't really know what else I can do to try and figure this out, so I guess it will have to remain a mystery!
Please Log in or Create an account to join the conversation.
Moderators: Chris
Copyright © 2025 DrayTek