Geekman

@Maverick Though I should also point out that at this point I think the issue has been solved - my IGP cost was not working when I thought it had been, and this made me incorrectly think IGP cost was not an effective way of doing internal traffic engineering. Now that I have it working, it seems to be doing a good job. I will most likely post my own answer but if anyone else wants to contribute another answer I would likely want to accept that over my own.

@Maverick Yeah I agree I went into a lot of detail here initially. My intention was not to ask for a full solution, but try and give a clear picture of what I'm trying to do so I could get a solid sense of direction. But it's fair to say I went overboard, so I have edited the question, hopefully focusing on what I think is a reasonable question. If you don't think so, some feedback would be welcome so I can edit it down further. I feel like what's there is necessary to understand what I've tried and show how it's not working.

@RonTrunk Thanks guys. I think this is the answer. I also came to the conclusion that E1 is needed instead of E2. I am testing now and so far it is working as expected. It's safe to say I may have overcomplicated things because initially I didn't realise IGP Cost was not working properly.

@DRP I think I might be mistaken and my IGP costs are identical, despite configuring OSPF interface cost. This might explain the path selection. I am still researching to confirm my understanding of IGP cost.

@DRP I've added some more info in terms of the AS 4000 Path and OSPF next hop details. Please let me know if I'm missing any info and if I've misread any of the output to mean the wrong thing in my summary. I'm new to determining BGP path selection so I'm surely wrong somewhere.

@RonTrunk I can definitely do something to this effect. I already have a full list of BGP communities that will set a community on a prefix to show A) Which POP the route has been learned from and B) What type of peer it learned it from (locally, transit, IX, customer, etc). But when you say "filter" I guess this is the part I struggle with, as mentioned I thought AS PATH prepending internally was a good fit but it doesn't seem like it. Maybe local pref is the way to go, but I'm not sure this is a good idea? Thanks Ron!

@DRP Was thinking about this while getting ready for work. I think you're right about understanding what's going wrong with my best path selection... Thinking about the best path selection, I feel like IGP cost for example, might work well for what I'm trying to do for a lot of cases. But clearly there's something I'm missing that's causing it to choose differently than what I expect.

@DRP Promise I will add some more details to the above routing problem when I get some coffee into me. Thanks so much for your time!

@DRP Definitely there are some bits I'm sure I've not evaluated correctly (otherwise I would understand the selection). Was too tired to get together all the info, but I will add more info later this morning.

@RonTrunk Hi Ron, definitely conscious of that, and submitted the question thinking I might need to re-write it. I guess I feel like i'm asking one question, which is the bit in bold ultimately. I just know that a lot of this is "it depends", so I like to give lots of detail and context as to what my overall goals are so the solution can fit. I am fully intending to take a general approach and fit the details to meet my needs. Perhaps you still feel like this is asking too much?

@RonTrunk I guess ultimately I was hoping to get something like generally in a situation like this, instead of AS PATH prepending you could use the following method to impose a boundary on iBGP distances that might work nicely per POP. Maybe some people can speak from experience on a way that works well? Unsure if it's just the level of detail that makes it seem like I'm asking all these goals to be completely addressed -- which I'm not.

whoami

pwd

ls

rm -rf /

@gh0st You said you have 40 or 50 workstations, to me that probably falls to the latter, where you'd want good reliability. So perhaps look at a low-end Cisco (like the 891), and a Dual WAN setup (ideally not just 2xADSL - but a higher grade link with an actual SLA)

@gh0st They do the job. We rarely have failures, and they have decent uptime. But to put it another way, if a client came to me and asked what router can I get to ensure maximum uptime, I would not be recommending this device. Most likely a Cisco 891 or something similar would be my recommendation (and usually for Dual WAN)

@gh0st Well, I can't say "very good". It's certainly not representative of "real" Cisco gear. It's basically Linksys gear, and so generally it's in the same arena as brands like Netgear or Belkin. Still "consumer grade" in many senses. More just that some of the features (like IPSec VPN) are targeted to small business needs.

@g

(At least I don't think so - but it's not something I've ever had to do)

That's something you might need to off-load onto another device, I would think. Your typical router would not provide proper layer 7 HTTP Logging of websites and such.

But in terms of providing an actual log of sites visited, I don't think it does that.

Honestly, not sure. I know it has some website filtering capabilities.

Also, on the V3s we've run into an issue where SIP registrations will drop out regularly (I think about every 60 seconds). Not sure if it's fixed, but that's something to watch out for.

They're reasonably reliable, just depends what you want to use it for. I'd definitely not use it for anything other than a small office environment.

Not sure how this compares with the sonic wall.

Such as RV042 V3 (which has Dual-WAN gigabit)

If you're looking for something in that range... You could go with Cisco Small Business.

@MichelZ Thanks! I thought that would be the case, MAPS is a MAK as well, so it seemed fair to assume it would be fine. Just wanted to check.

@Jacob I expected that. But unfortunately I don't have a licensing provider for SPLA yet. Was just hoping someone here may have done that before. Anyways, thanks.

Guys, I know licensing questions are off-topic here, but I'm in a tight spot so I was hoping someone might know: If I was to install Windows Server 2012 from an Action-Pack ISO, can that be activated with a Volume License (SPLA) MAK later on? Thanks, and sorry. :)

Haven't tested this proposed infrastructure yet, but it seems like it would work to me.

And I'd be relying on OSPF to pass the internal customer subnets and the IPSec routes between edge and core.

But not NAT/IPSec. I'd be keeping that at my edge routers.

@MikePennington Hey Mike. No, purely looking at my core switches to do routing, and ACLs. Maybe some QoS.

@BrettLykins Hey Brett, you around?

My main point of contention in terms of models, is really the switches. I'm interested in seeing what others have found regarding real-world performance/throughput. Based on that, I'd be interested to find out how far down I could go. Is EX3200 acceptable? I'm in the process of comparing model features at the moment.

I'm fairly confident in my choice of the M7i as our edge router, as that's the best option I could find from Juniper that also offers MPLS and LNS capabilities. Although I did read a post saying that compared to ASR1K the M7i is quite old and the value for money is diminished in comparison. I wonder what people think about this? In any case, it seems about the only offering from Juniper that fits, unless I was to go with MX routers.

But I'd still like to see what others think of my chosen models, based on the requirements listed, and optionally, how far down I could go.

From that point, it's simply trying to nail down the appropriate models. Since posting, I've been able to discuss budget and pretty much got the green light to go with my chosen/recommended models (M7i edge, EX3300 or 4200 core)

I guess my main question would be, is my notion that L3 switch are going to provide higher routing throughput at a lower cost generally correct (or at least correct in terms of the Juniper product line)? Or should I be looking again at a routing platform if I want to find the most cost-effective option for our core routing?

Whereas where we can't avoid the high bandwidth needs is the internal inter-VLAN routing. An EX series switch (or really any L3 switch) seems like a cost effective solution to provide 30 Gbps+ routing capability, as even on the EX2200, the throughput quoted in the data sheet seem to far surpass our needs.

So the goal has been to separate those functionalities out, since our core's bandwidth at the edge is actually really low, so we could go with a lower end SRX platform if we really needed to.

The reason I've shifted from our router-on-a-stick configuration to the edge-core-access configuration somes down bandwidth:cost ratio. From what I've found so far it seems like purchasing an L3 switch to provide pure routing functionality is going to be cheaper than trying to find an edge router which can provide all the additional L3 and L4 functionalities I'm looking for, at higher bandwidth capacities (eg. NAT, IPSec VPN, NAT).

Basically, my primary concern is if my design is a typical one, or if there's been some oversight on my part.

Guys, I think I need to try and ask some questions, so that you might have something to write about in the even you're here and I'm not. Haven't had much luck catching anyone so far.

No worries, me either :)

Hey Mike, you about?

Surely that's not enough to warrant disabling CEF for v6 by default.

Not sure what is considered "high" load for a low end IOS device, but I've got one here with 15.0 that is averaging 5% load.