"Quote from: Patrick M. Hausen on September 17, 2026, 07:03:13 PMI'd recommend not to combine the redundant BGP and the redundant firewall functions on the same devices. BGP routers typically each run their own eBGP session(s) to your peers and iBGP among each other. Asymmetric routing is expected and not a problem. Then you place the firewall pair behind the routers. Both firewalls and routers run CARP, HSRP or VRRP depending on the vendor.This is the way!
I have had this running for a few years now without any significant downtime. My ISP is providing the BGP sessions for me and terminates them in to one VRRP IP to use as transport net and I provide them a CARP IP as next hop for the subnet.
Works with IPv6 as well, although in that case it's prefix delegations in stead of a routed subnet.
Since CARP and VRRP are very similar, make sure to use a different VHID group to that of your ISP, or it will be very funky!
