Dual-ISP Edge — BGP, LACP & vPC
The classic enterprise internet edge: EDGE-R1 and EDGE-R2 each peer eBGP with their own ISP and learn a default route, run iBGP with each other and with a Palo Alto Active/Passive HA pair southbound. Between them: a pair of Nexus 93180s doing pure layer 2 — two transit VLANs, every attachment a vPC, every bundle LACP. Toggle a layer to isolate it, click any device or link for its role and config, then walk the default route's journey — or break something and watch it converge.
How the default route reaches the firewalls
Each edge router learns 0.0.0.0/0 from its own ISP over eBGP. Press play to follow both defaults through next-hop-self, across the iBGP mesh riding two layer-2 transit VLANs, into the Palo's RIB — where BGP attributes (not admin distance!) pick the winner — and finally carry a user's packet out to the internet.
Companion reading: the VXLAN EVPN Multi-Site lab for what happens when the switch layer isn't just L2, ASNs explained, prefix-lists & route-maps, and reading a BGP looking glass. Configs follow IOS-XE, NX-OS, and PAN-OS conventions; this is a teaching topology — trim and adapt before production.
Rebuilding it in a lab?
· Deep-linkable: #layer=ibgp, #node=pa1, #walk=vpc:3 all restore this page's state.
