Backdoor routes

Question

We are starting a conversion of a rather large network from atm/frame to mpls. We will be managing the ce routers and talk bgp to the pe routers. Our current network is eigrp. We will have quite a few backdoor links in the network. Some will be backup only and not carry normal traffic, others such as the backdoor links between our data centers will be the primary path between the sites.
My question is what is the best way to handle the backdoor links. We are looking at:
1)running bgp on the backdoor links also and ibgp between the routers for the backdoor and the ce router.
2)running eigrp on the backdoor but under a seperate eigrp as number and redistributing into the primary eigrp as.
Both have their pros and cons. I was wondering which way other organization have gone and why.

Answer 1

Hello,
my 2 cents on the subject.
I haven´t been involved with a customer in the situation you are. So those are some thoughts on the subject not backed up by experience.
First, you need mutual redistribution BGP<->EIGRP on all CE routers.
Second, as EIGRP will always prefer internal routes over external ones, you need another protocol on the backdoor links, which should be really backdoor.
This said I would first select the links, which really shall be backup to the MPLS network. All other (prefered) links should be running EIGRP with main AS to reduce complexity.
So lets first look at the "MPLS is backup" scenario. You will have the same networks on the CE learned through EIGRP and eBGP. The latter having AD=20 is prefered, which is undesired in this case. Setting eBGP to AD=150 could fix this. Additionally you need to tag the EIGRP networks learned from BGP with a site specific tag, which would allow to exclude them from redistribution back into BGP once they are announced through EIGRP to another CE.
Generally a tag should indicate that this network was already passed through the MPLS VPN and thus MUST not be redistributed again.
Now lets have a look at the "MPLS is primary" scenario. As you already stated you need another routing protocol/EIGRP AS in this case. On the CE this would still work, because external EIGRP with AD=170 is worse than (modified) AD=150 of BGP.
What remains is again to set proper filters to avoid routing loops most likely again with tags and route-maps for scalability.
With all this mutual redistribution it is clear, that any mistake in configuration or design of the filters will result in a routing loop.
The other option would be BGP everywhere. Be aware however, that this will most likely not remove the redistribution and filter complexity.
What I do not quite understand is, how the physical design looks like, i.e. where you have BGP routers and where EIGRP (main AS). In case you don´t want to black hole yourself, you need to redistribute back into EIGRP in any case, or run an iBGP full mesh on most of your internal routers.
So in the end you have a lot of complexity in both solutions. Both of them can be implemented. From an operation point of view I would say, that my tendency would be towards EIGRP instead of BGP. But just because your staff might know the latter good enough to operate the whole thing without too much pain.
Looking from a distance:
1) Have you pushed the SP hard enough (=$$ ?) to allow EIGRP on the PE-CE link? This would simplify the whole situation.
2) Have you thought of pushing the SP into OSPF on PE-CE and convert everything to OSPF internally? This would also simplify things. OSPF is better prepared to handle routing loops in MPLS VPNs and also sham links allow for having backdoor links, when required.
Hope this helps! PLease rate all posts.
Regards, Martin