Secondary ISP using Policy Based Routing

mdieken011 — Mon, 13 Jun 2022 16:48:35 GMT

Here is my situation. I need to route my guest traffic out a secondary ISP. I need my normal traffic to route out my primary ISP so I intend to use PBR to accomplish this. Does the below config look like it will accomplish this task?

I have kept out the actual public IP for security reasons. They are listed as Secondary.ISP.IP and Primary.ISP.IP.

My internal Guest traffic is 10.2.0.0/16. My Internal traffic is everything else.

interface GigabitEthernet0/0
nameif Secondary.ISP
security-level 0
ip address Secondary.ISP.IP 255.255.255.248
policy-route route-map PBR

!Define the traffic to route out the Secondary ISP interface

access-list PBR_ACL1 extended permit ip 10.2.0.0 255.255.0.0 any

!Define the traffic to route out the Primary.ISP Internet.
access-list PBR_ACL2 extended permit ip 10.0.0.0 255.0.0.0 any
access-list PBR_ACL2 extended permit ip 192.168.0.0 255.255.0.0 any
access-list PBR_ACL2 extended permit ip 172.16.0.0 255.240.0.0 any

Create the route map to change the route to the secondary ALLO interface.
route-map PBR permit 10
match ip address PBR_ACL1
set ip next-hop Primary.ISP.IP

route-map PBR permit 20
match ip address PBR_ACL2
set ip next-hop Secondary.ISP.IP

Apply the route map to the Internal interface.
!interface Port-channel1
!nameif Inside
!security-level 100
!ip address 10.100.10.2 255.255.255.0 standby 10.100.10.3
policy-route route-map

Apply the route map to the Guest interface to change the route.
interface Port-channel2.2
! vlan 2
!nameif Guest
!security-level 25
!ip address 10.2.0.1 255.255.0.0 standby 10.2.0.2
policy-route route-map PBR

interface Port-channel2.666
vlan 666
nameif DMZ
security-level 50
ip address 10.1.0.1 255.255.0.0 standby 10.1.0.2
policy-route route-map

Remove the existing NAT statement for Guest because the IP will be different.
no object network Public
! nat (Guest,Outside) dynamic Seconary.ISP.IP

Set the new NAT statement so the Guest traffic is routable.
object network Public
subnet 10.2.0.0 255.255.0.0
nat (Guest,Allo) dynamic Secondary.ISP.IP
This is already there and is the default route for everything else.
!route Outside 0.0.0.0 0.0.0.0 Primary.ISP.IP

Re: Secondary ISP using Policy Based Routing

Rob Ingram — Mon, 13 Jun 2022 16:57:49 GMT

@mdieken011 I would just keep it simple. Just use PBR to redirect the guest traffic via the Secondary ISP.

The normal traffic would be routed via the default route, no need to define PBR for that.

Re: Secondary ISP using Policy Based Routing

MHM Cisco World — Tue, 14 Jun 2022 12:48:00 GMT

I agree with Mr. @Rob Ingram solution.
make it simple.

Re: Secondary ISP using Policy Based Routing

Mohammed al Baqari — Mon, 13 Jun 2022 17:25:19 GMT

Agreed with Rob. Also, swap your PBR priority order. Your current order
will match guest under 10.0.0.0 and route it over primary.

***** please remember to rate useful posts

topic Re: Secondary ISP using Policy Based Routing in Network Security

Secondary ISP using Policy Based Routing

Re: Secondary ISP using Policy Based Routing

Re: Secondary ISP using Policy Based Routing

Re: Secondary ISP using Policy Based Routing