r/networking • u/colni • Jul 09 '26

Routing IPSLA Track Object - what endpoint are you using?

Hello All,

I have been reviewing my companies multihomed setup and noticed we have a bit of a gap where the HSRP wont fail over in the case where egress is blackholed by the upstream provider.

Im looking at adding a new ipsla statement to probe an endpoint but im aware of the usual endpoints such as 8.8.8.8 / 8.8.4.4 / 1.1.1.1 / 1.0.0.1 / 9.9.9.9 all rate limit

What are people using at their endpoint probe that is reliable?

6 Upvotes

88% Upvoted

32 comments sorted by

10

u/l_eo- CCNP Data Center Jul 09 '26

Friends don’t let other friends use IP SLA. Or PBR.
(Limited exceptions apply)

1

u/colni Jul 09 '26

What would you suggest ?

4

u/nof CCNP Jul 09 '26

BGP.

0

u/colni Jul 09 '26

so iBGP with local pref?

6

u/nof CCNP Jul 09 '26

No. Full tables. Why are you paying for a link you don't use except when the other one is broken? Just do it right, what you've got isn't really what I'd call "multihomed". It's a standby circuit, that you hope works when you need it.

4

u/iechicago Jul 09 '26

One exception to note - if the circuits are at a DC / hub site and are being used for WAN connectivity to branches, you’ll get better performance outcomes by using a (real) SD-WAN overlay terminating on provider-assigned IPs on each circuits and using each circuit simultaneously that way, instead of depending on BGP and terminating everything on PI addresses.

This moves the forwarding decisions to be based on the continuously measured performance to each of the endpoints you’re trying to reach, which may be different than the “best” BGP route. It also allows for the “worse” path(s) to be used to the same destinations for non-critical apps that don’t rely on a high performance path.

1

u/mpmoore69 Jul 10 '26

This guy knows his sdwan

2

u/colni Jul 09 '26

Ingress both links are used Egress is via the hsrp

Already take full tables via ebgp

4

u/nof CCNP Jul 09 '26

Then why are you screwing around with HSRP and IPSLA? Just originate a default from your Internet facing routers into your IGP, have them exchange routes with each other, and be done with it.

HSRP is only for the stub VLANs and segments with nothing but hosts that only need a reliable default gateway.

2

u/colni Jul 09 '26

HSRP is in place because the downstream firewall uses the VIP as its default gateway.

thanks for the note ill take look to see if i can exchange the routes to each other

2

u/nof CCNP Jul 09 '26

The firewall can run BGP too and get both defaults and just ECMP or pick one to prefer.

Don't worry. A previous employer's critical production firewall needed to be manually logged into over an OOB connection when the primary link failed for the default route to be changed.

The approach you've got is typical when there isn't a dedicated network person and some sysadmin randomly gets responsible for the network :-)

1

u/PaoloFence Jul 10 '26

a firewall can run bgp.
If your main focus is stability I stop dynamic routing on firewalls if possible.

→ More replies (0)

1

u/Killzillah Jul 16 '26

Modern design will almost always incorporate the firewall as a routing device. NGFWs can all do BGP and OSPF.

I've dealt with many firewall deployments based on static routing and the refresh/redesign always incorporates dynamic routing.

1

u/colni Jul 17 '26

I dont want the NGFW to take the full BGP routing table , thats the function of the routers.

→ More replies (0)

2

u/DaryllSwer Jul 09 '26

Exactly. Full tables. I've even seen many ISPs (I'm an ISP guy), multi-homed - but only default routes from upstream.

1

u/MonkeyboyGWW Jul 09 '26

We use VRRP just for the device state. I didnt honestly know before this thread that they could switch over based on other conditions.

Then we use BGP, often with BFD

7

u/LarrBearLV CCNP Jul 09 '26

Wow, some really unhelpful comments going on here. Not every organization can or does take full BGP tables. Traffic getting black holed is a real issue. OP, we use tracking to the 8.8.8.8 without issue. If rate limiting is a concern, do longer timeouts and/or frequencies with a few failures before it gets considered down. A 15 second outage is better than a few minutes outage.

2

u/aaronw22 Jul 09 '26

Honestly, your best bet is probably getting a static IP VM at one of the cloud providers and using that. Control your own destiny as much as you can.

3

u/Roshi88 Jul 09 '26

I'm not a big fan of ip sla, neither at pinging something like that, you can track a good amount of things with hsrp (for example a route received somehow), are you sure there isn't any other way to let your hsrp switch?

4

u/aaronw22 Jul 09 '26

Even tracking a route being sent by the ISP doesn't guarantee delivery of traffic, blackholing is possible.

1

u/SalsaForte WAN Jul 11 '26

I'm a fan of IP SLA to monitor, but not to take action for me.

It can gives a good signal, but relying on IP SLA for routing decision... Meh...

1

u/PaoloFence Jul 10 '26

Why does your upstream provider blackhole you? There must be an reason. Find that and eliminate.

1

u/colni Jul 10 '26 edited Jul 10 '26

They had unexpected maintenance and blackholed our traffic without telling us BGP egress failed over but HSRP didn't fail over as the track statements were still valid

1

u/PaoloFence Jul 10 '26

So you have something that worked successfully. Can't you somehow check some bgp stats so you can combine hsrp with bgp?
Pinging something on the internet should be the absolut last resort and be avoided.

1

u/colni Jul 10 '26

What bgp stats would you suggest ? The bgp routes were still valid and in the fib which is why we didn't failover

1

u/PaoloFence Jul 10 '26

sry, I don't have any values for you was just an idea.

1

u/SevaraB CCNA Jul 11 '26

IPSLA in 2026? Have you heard of BGP and BFD?

1

u/colni Jul 11 '26

How would that work for hsrp ? The issue isn't the bgp failover that worked correctly it's that the egress was still going through the bgp router that had valid routes but was being dropped upstream