BGP Mesh with Private ASNs
Full eBGP triangle across a two-node Proxmox cluster and pfSense edge firewall. Private ASNs, redundant path learning, zero static routes.
Peer status
Route table
Two valid paths per prefix — automatic reroute if any peer drops.
The problem with static routes
Static routes work until the network changes. Every new subnet means updating routes on every node manually. Miss one and traffic silently breaks. BGP makes that automatic — advertise a new prefix from one node and every peer learns it within seconds.
RFC 6996 reserves a private ASN range (64512–65534) for exactly this use. No registration, no ISP involvement, no public routing. Same operational behavior as a real ASN inside the lab.
eBGP between all three
Running eBGP (different ASNs per node) rather than iBGP keeps path selection simple and gives each node an independent topology view. Adding a fourth peer is one config block.
FRRouting on everything
pfSense runs the same FRR daemon via the package manager — identical vtysh interface, identical config pattern, identical show bgp summary output. One mental model across the whole setup.
Cluster upgraded same session
Both nodes went from 9.1.9 → 9.2.2 and kernel 6.17 → 7.0.2 before BGP was configured. Rolling upgrade with HA maintained throughout — node 2 first, verify quorum, then node 1.
Advantages
Trade-offs
Roadmap
Stack