IDS on a load balanced BGP network

From: Ian Macdonald (secids@dirk.demon.co.uk)
Date: 09/04/02 

From: "Ian Macdonald" <secids@dirk.demon.co.uk>
To: <focus-ids@securityfocus.com>
Date: Wed, 4 Sep 2002 12:22:42 -0400

Has anyone ever come up with a solution for running a IDS system on a BGP
network.

If I have 2 datacenters that are linked together by a network connection.
Each has its own ISP connection to the internet. BGP is used to so that in
the case of a major failure at one site traffic for things like the web
servers can still come in via the other datacenter and travel via the
datacenter to datacenter link.

My understanding is that with BGP the packets can come over either link.
Does this mean that a season always comes in via the same ISP? or could the
first packet come in via one ISP and the second packet go via the other ISP?
If this is the case how can I set up an IDS to monitor the traffic coming
into both data centers?

Any bright ideas on this?

Ian

Relevant Pages

  • Re: IDS on a load balanced BGP network
    ... into a single datacenter, ... I think some other IDS vendors can now do this also, ... > Has anyone ever come up with a solution for running a IDS system on a BGP ... > Does this mean that a season always comes in via the same ISP? ...
    (Focus-IDS)
  • Re: FW: IDS on a load balanced BGP network
    ... You can run traceroutes to and from your network to get a general ... BGP can be flexible. ... >> My understanding is that with BGP the packets can come over either link. ... >> Does this mean that a season always comes in via the same ISP? ...
    (Focus-IDS)
  • Re: IDS on a load balanced BGP network
    ... >> BGP has nothing to do with this setup, ... Depending on how the network is numbered, ... Datacenter A's networks via Datacenter B, ... collasped core where the core is handling both core and ...
    (Focus-IDS)
  • Re: IDS on a load balanced BGP network
    ... >> My understanding is that with BGP the packets can come over either link. ... >> Does this mean that a season always comes in via the same ISP? ... > it totally depends on how your network is configured. ... BGP has nothing to do with this setup, ...
    (Focus-IDS)
  • Re: IDS on a load balanced BGP network
    ... If the upstream ISP are different, then the shortest route from the ... normally taken and the packets will be routed via the same ISP. ... BGP matrices, neighbors, paths, etc. and or bgp flaps, errors, net outages ... I recommend you do ID on the inside network, ...
    (Focus-IDS)