Help with Internet failover

[wdoellefeld]

Hi,

I inherited managing our network. My knowledge of Cisco is pretty limited but growing. I need help configuring a failover from our T1 to a wireless broadband connection. We have a Cisco 2651 for external, a Cisco 2610 internal, and a PIX in between. I've been working on the config but can't seem to get it working. Here is the config, I marked my additions to it.

interface FastEthernet0/0

ip address 53.150.x.x.x.255.128

duplex auto

speed auto

!

interface Serial0/0

bandwidth 1544

ip address 161.x.x.x.x.255.252

ip access-group InternetIn in

ip access-group InternetOUT out

no ip proxy-arp

no ip mroute-cache

no fair-queue

service-module t1 timeslots 1-24

!

interface FastEthernet0/1 (ADDED BY ME)

description MESA Networks

ip address 208.121.x.x.x.255.192

ip access-group InternetIn in

ip access-group InternetOUT out

no ip proxy-arp

no ip mroute-cache

duplex auto

speed auto

!

ip classless

ip route 0.0.0.0 0.0.0.0 Serial0/0

ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 200 (ADDED BY ME)

ip http server

!

!

ip access-list extended InternetIn

permit ip host 10.10.147.250 host 53.150.135.251 log-input

permit icmp host 10.10.147.250 host 53.150.135.254 log-input

deny ip 0.0.0.0 0.255.255.255 any log-input

deny ip 10.0.0.0 0.255.255.255 any log-input

deny ip 127.0.0.0 0.255.255.255 any log-input

deny ip 147.100.0.0 0.0.255.255 any log-input

deny ip 169.254.0.0 0.0.255.255 any log-input

deny ip 172.0.0.0 0.31.255.255 any log-input

deny ip 192.0.0.0 0.0.0.255 any log-input

deny ip 192.168.0.0 0.0.255.255 any log-input

deny ip 194.87.6.0 0.0.0.255 any

deny ip 209.1.230.0 0.0.0.255 any

deny ip 224.0.0.0 31.255.255.255 any log-input

deny ip 240.0.0.0 7.255.255.255 any log-input

deny ip 248.0.0.0 7.255.255.255 any log-input

deny ip host 255.255.255.255 any log-input

deny tcp 209.1.230.0 0.0.0.255 53.150.135.128 0.0.0.127

deny icmp any any echo log-input

deny icmp any any echo-reply log-input

deny tcp any any eq 135

deny udp any any eq 135

deny udp 194.87.6.0 0.0.0.255 any

deny udp 209.36.6.0 0.0.0.255 53.150.135.128 0.0.0.127

deny udp 128.63.0.0 0.0.255.255 53.150.135.128 0.0.0.127

permit tcp any host 53.150.135.252 log-input

permit udp any host 53.150.135.252 eq isakmp log-input

permit udp any host 53.150.135.252 eq 10000 log-input

permit esp any host 53.150.135.252 log-input

permit ahp any host 53.150.135.252 log-input

permit esp any host 53.150.135.253 log-input

permit ahp any host 53.150.135.253 log-input

permit udp any host 53.150.135.253 eq isakmp log-input

permit tcp any host 53.150.135.243 eq 443 log-input

permit ahp any host 53.150.135.251 log-input

permit esp any host 53.150.135.251 log-input

permit udp any host 53.150.135.251 eq isakmp log-input

permit udp any eq domain any gt 1023 log-input

permit tcp any 53.150.135.128 0.0.0.127 gt 1023 established log-input

permit tcp any host 53.150.135.243 eq 143 log-input

permit gre any host 53.150.135.244 log-input

permit tcp any host 53.150.135.243 eq smtp log-input

ip access-list extended InternetOUT

permit ip 53.150.135.0 0.0.0.255 any

deny icmp 53.150.135.0 0.0.0.255 any

permit ip 208.121.158.0 0.0.0.255 any (ADDED BY ME)

deny icmp 208.120.158.0 0.0.0.255 any (ADDED BY ME)

logging trap warnings

logging facility local5

logging 53.150.135.243

access-list 12 permit 53.150.135.0 0.0.0.255

access-list 13 permit 208.121.158.0 0.0.0.255 (ADDED BY ME)

!

line con 0

line aux 0

line vty 0 1

access-class 12 in

password xxxxx

login

line vty 2 4

access-class 12 in

password xxxxx

login

!

end

[thisisshanky]

Your configuration looks alright. What happens if the T1 link goes down ? Doesnt the floating static route kick in ?

[wdoellefeld]

Thanks for the reply Shanky.

I'm unfamiliar with the term "floating static route", if you mean does it fail over, no it does not. Could it be something in the PIX? I've, looked over the config on it and I don't see anything that would prevent.

[thisisshanky]

The config that you pasted belongs to 2651 or 2610 ? I believe its the 2651.

Wireless Backup---|Cisco 2651---PIX---Cisco 2610---

Serial T1---------|

Is this the way your network is setup ? Is the PIX doing NAT for you ? Do you have two different blocks of Public IP allocated by your ISP ?

A floating static route is a static route which has been configured with a higher administrative distance. For example,

ip route 0.0.0.0 0.0.0.0 Serial0/0

ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 200 (ADDED BY ME) <---- this is floating static default route.

[wdoellefeld]

This config is for the 2651.

Both ISPs (T1 and Wireless) are on the 2651. Yes the PIX is doing NAT. I have a block of public IP for the T1 but only 1 IP for the wireless.

Thanks for defining floating static route for me. The answer is no, it doesn't appear to kick in.

[wdoellefeld]

Just got me thinking about NAT on the PIX and if that was my issue. Here is a copy of my PIX config.

PIX Version 6.3(1)

interface ethernet0 10baset

interface ethernet1 10baset

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxx

passwd xxxxx

hostname PIX

domain-name technology.net

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

access-list inside_access_in deny udp any any eq 109

access-list inside_access_in deny udp any any eq 110

access-list inside_access_in deny udp any any eq 220

access-list inside_access_in deny udp any any eq 993

access-list inside_access_in deny udp any any eq 995

access-list inside_access_in deny tcp any any eq pop2

access-list inside_access_in deny tcp any any eq pop3

access-list inside_access_in deny tcp any any eq 220

access-list inside_access_in deny tcp any any eq 993

access-list inside_access_in deny tcp any any eq 995

access-list inside_access_in permit udp any any

access-list inside_access_in permit tcp any any

access-list inside_access_in permit gre any host 166.39.161.79

access-list mailserver permit tcp any host 53.150.135.243 eq smtp

access-list mailserver permit udp host 53.150.135.254 host 53.150.135.243 eq syslog

pager lines 24

logging on

logging timestamp

logging trap warnings

logging facility 3

logging host inside 172.21.1.7 6/49205

mtu outside 1500

mtu inside 1500

ip address outside 53.150.x.x.x.255.128

ip address inside 172.21.1.253 255.255.240.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 53.x.x.x.150.135.240 netmask 255.255.255.128

global (outside) 1 53.x.x.241 netmask 255.255.255.128

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) 53.150.x.x.x.1.1 netmask 255.255.255.255 0 0

static (inside,outside) 53.150.x.x.x.1.7 netmask 255.255.255.255 0 0

static (inside,outside) 53.150.x.x x.x.1.101 netmask 255.255.255.255 0 0

static (inside,outside) 53.150.x.x.x.1.100 netmask 255.255.255.255 0 0

access-group inside_access_in in interface inside

conduit permit udp host 53.150.135.248 eq ntp any

conduit permit tcp host 53.150.135.243 eq https any

conduit permit gre host 53.150.135.244 host 166.39.161.79

conduit permit tcp host 53.150.135.243 eq imap4 any

conduit permit udp host 53.150.135.243 eq syslog host 53.150.135.254

conduit permit tcp host 53.150.135.243 eq smtp any

route outside 0.0.0.0 0.0.0.0 53.150.135.254 0

timeout xlate 0:10:00

timeout conn 0:20:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

url-cache dst 128KB

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

sysopt ipsec pl-compatible

service resetinbound

telnet 53.150.x.x.x.255.255 outside

telnet 53.150.135.254 255.255.255.255 inside

telnet 172.21.0.0 255.255.240.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 60

console timeout 0

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

terminal width 80

Cryptochecksum:xxxx

: end

[rick.martin]

Is the Internet service on the wireless network and the serial T1 network provided by the same ISP? You mentioned that you only had one IP address for the wireless ISP so I assume that they are different.

If your T1 ISP is advertising your 53.150.135.x network to the Internet and you attempt to send packets to another ISP using that same IP block the Internet will probably return the traffic to the T1 ISP which is down so the packets will not make it back to your network. Additionally your wireless ISP may not accept your 53.150.135.x IP addresses.

You might want to NAT/PAT the outbound traffic on the wireless link. If the only route off your network happens to be the wireless link AND you only have one IP address provided by your ISP - Port Address Translation is probably your best method of hitting the Internet and having packets find their way back to your network.

Good luck

[a.awan]

I agree with Rick that in case the backup is from a different provider your public ip subnet routing is probably the cause of the problem here. Like he suggested do a PAT on the failover link rather than just letting your public IP addresses through.I would take off the access-lists to start with and try the PAT approach and once everything works put the access-lists back on.

I would also incorporate Richard Burt's suggestion to use the ip address of the next hop device rather than just Fastethernet0/1 to avoid proxy-arp related issues.

[Richard Burts]

I think I see at least one issue with your config that may explain why failover is not working. Your added static route (the floating static) is configured like this:

ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 200 (ADDED BY ME

There are two ways to configure static routes, you can identify the output interface or you can identify the next hop address. The first method is especially appropriate on point to point interfaces like serial. The method that identifies the outbound interface is less appropriate on multipoint interfaces like Ethernet. The issue is that to forward out the FastEther interface the router needs a MAC address and so for every packet it tries to forward it will need to ARP for the destination address. If something responds to the ARP the router will be able to forward and if there is no response the router will drop the packet. I suspect that whatever you are connected to for your wireless broadband is not responding to all those ARPs and that is why your failover is not working.

The second method of configuring static routes identifies the next hop address and would look like this:

ip route 0.0.0.0 0.0.0.0 200

The advantage of this for the FastEther is that the router will need to ARP for the connected device and when it gets a response (which it is much more likely to get) it can forward all packets with no more overhead.

If you change your added static route to this form I think you will have much better chance of it working.

A second comment (though not central to your question) I notice in the outbound access list that you have configured:

permit ip 53.150.135.0 0.0.0.255 any

deny icmp 53.150.135.0 0.0.0.255 any

permit ip 208.121.158.0 0.0.0.255 any (ADDED BY ME)

deny icmp 208.120.158.0 0.0.0.255 any (ADDED BY ME)

The issue is that the deny for icmp will never affect anything because the icmp packets were permitted by the preceeding line. You should reverse the order of these if you really want to deny ALL icmp.

In fact I would suggest that you think carefully before you deny ALL icmp. There are a number of icmp messages (fragmentation required but DF set is one that comes to mind) that are quite helpful and not dangerous. If you block all imcp you will break Path MTU discovery among other things.

HTH

Rick

[wdoellefeld]

Thank you all for the replies.

Yes, the backup link is from a different provider.

Richard Burts - What is an easy way from the router to identify the next hop off of that interface?

Rick Martin - Researching how to enable PAT on the interface for the backup link but having trouble finding a guide. Do you have a link to anything that may help?

Thank you all very very much!

[Richard Burts]

There are several approaches to find the address of the next hop.

- ask the wireless provider. its their device and they should easily be able to tell you.

- depending on the interface config you may be able to deduce the address. In particular if it is a fairly specific mask (ideally a 255.255.255.252) you should be able to find the address.

- if the connection is over Ethernet there should be an ARP entry for the other device. Do a show ARP and look for an address associated with that interface.

HTH

Rick

[wdoellefeld]

Thanks Rick. I forgot about the show command. I really need to learn more IOS. It's been rough going from a department of 2 to a department of 1.

I've got the route configured with the next hop. Now all I need to do is figure out the NAT/PAT piece. Been researching poking around all morning but not finding much. It's confusing since the PIX is NATing with the block of IP from my "primary" provider. I'd rather not go away from that since I'm really just looking for some Internet failover and not load balancing. How to get the end router to NAT out of the "backup" interface is my hangup I think.

Thanks for your help.

[rick.martin]

Below is a link to a good document to get you started down the road to NAT or PAT. The difference in Cisco terms is overload. You will want to configure NAT in your environment to use the overload option. This will translate your 127 existing public IP addresses into the single IP address provided by your wireless ISP.

Basically you will create a NAT pool using the single IP address provided by your ISP, assign IP NAT inside to the inside interface and NAT outside to the wireless ethernet interface. Create a one line access list to permit 53.150.135.128 0.0.0.127 and assign that ACL to your NAT pool.

When this is setup correctly all packets that leave the Ethernet interface destined to the wireless link will be translated to the single IP address your ISP has provided to you. While on the normal ISP link no translation will take place. The obvious drawback to this scenario is that you cannot have outside access to any device on your network while you are operating on the wireless connection (from outside to inside). If you have an email server or web server they cannot be accessed from the outside, but these devices will be able to hit the outside via the address translation.

Here is the NAT get started link;

http://www.cisco.com/en/US/customer/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml