Multiple routes for Internet access?

[decore]

I have a remote site connected to headquarters via a poin to point T1. This allows them to have internet access through our internet connection.

I also have a dsl line at that location for backup should the T1 go down. Between the two local routers I have hsrp running and the one on the dsl line is idle. On my dsl service I have multiple ip addresses to use. I setup a 506e pix on that line as a secondary internet connection to be used locally, in the event the primary inernet connection goes down.

How do I route internet traffic to this new pix, in the event that only our internet connection goes down at headquarters and not our point to point connection? Is this even possible?

Any advice would be appreciated..

[mvalentine]

how are you routing, static or dynamic? If you are running a dynamic routing protocol you can redistribute a static default route on both your HQ and local sites routers that connect to the internet, just make sure the local sites defaults route metric is higher than the HQ sites metric.

for example:

on HQ

ip route 0.0.0.0 0.0.0.0 z.x.c.v

router xxxx 100

redistribute static metric 1

on remote site

ip route 0.0.0.0 0.0.0.0 w.x.y.z

router xxxx 100

redistribute static metric 500

[smif101]

I don't think that would work mvalentine. Because you are redistributing the static route at HQ back to the remote site it will always be in the routing table at the remote site. The HQ router won't monitor if z.x.c.v went down or not and if it did it wouldn't take it out of the routing updates because it is a static route. I think the only way this could be done is to ensure a dynamic routing protocol is used with the ISP, along with a ip default-network so you get updates when they go down and then the remote site can then use the ip route command with a higher metric at that point. I guess it really all comes done to what routing protocol you are using and all the different ways there is to implement a solution. Let me know what you think, mvalentine.

Jason Smith

www.smif101.com

[rais]

Should the HQ internet interface goes down, this static route will be removed from the routing table and hence not redistributed. There is no 'permanent' keyword being used with this static route.

However, if the HQ internet interface remains up and that ISP has some other connectivity issues, like routing problems, then both sites will experience Internet down.

Thanks.

[jamey]

To account for problems within your primary ISP, you might look into Policy Based Routing with Tracking Options:

http://www.cisco.com/en/US/tech/tk364/tk871/technologies_configuration_example09186a0080211f5c.shtml

-HTH

[jamey]

Along these same lines, here's a recent article in Packet...

http://www.cisco.com/en/US/about/ac123/ac114/ac173/Q2-04/department_techtips.html

[decore]

Thanks for the replies.. routing protocol used is eigrp. The HQ site is a 10.6.0.0/16 network and the route for 0.0.0.0 0.0.0.0 is our checkpoint firewall at 10.6.0.5. The serial links between the sites are on a 10.99.1.x/24 network. The route for 0.0.0.0 0.0.0.0 is our router at HQ 10.99.1.1 which then forwards traffic to our firewall.They also need this route so their local subnet at 10.1.0.0/16 can access our network. So both 0.0.0.0 0.0.0.0 routes need to work. Or should I add a new route 0.0.0.0 0.0.0.0 for the remote site, only for port 80 or http traffic? Am I making sense?

[rais]

I dont know how to add route for port 80 traffic.

In order for you to detect downed interface on your HQ Internet router you will require some dynamic routing through the firewall. If dynamic routing is not traversig your firewall you will never be able to detect interface down.

I can only think of BGP as it should be quite easy to let BGP through your checkpoint. BGP need be run only on inside and outside router. You can redistribute the default to EIGRP.

HTH.

[ruwhite]

You can also use EIGRP through the firewall to learn the default--you have to punch a hole in the firewall for EIGRP, and you'll also have to set up static EIGRP neighbors, but I've seen it working in the field, so....

:-)

Russ.W

[decore]

Could I just add the following routes?

0.0.0.0 0.0.0.0 10.99.1.1 > access throught HQ

0.0.0.0 0.0.0.0 10.1.7.9 250> local gateway

10.0.0.0 255.0.0.0 10.99.1.1 > HQ Subnet