Internet resiliance, multihomed network

[aacole]

I'm looking for design hints on how to provide resiliance for smtp and http traffic in a network that has multiple connections to the Internet. Networks rely on default routes for non-internal destinations, pointing out to firewalls. Most connection failures occur on the WAN access circuits. The Internal routers generating the default route dont see the link failure as the links are not directly connected to the internal router . The internal routers are seperated from the access circuit via a firewall and Internet facing router.

I want to somehow influence the external routing based on which access circuit fails, but cannot come up with an easy solution to this.

Has anyone any thoughts on the best way to solve this problem.

[Gilles Dufour]

you could do BGP between your internet router and the one generating the default route.

The default would be sent by the internet router using bgp and it will be propagated by the internal router with the IGP.

[james.feger]

To further that....he could use a route-map on the default-originate that pointed to a prefix list looking for specific blocks to exist. THis way if a certain route goes away chances are the uplink's went away, thus stopping the default route from propogating.

Just a thought.

[ryan.benner]

You may also want to look at using HSRP with interface tracking. You would configure HSRP on the ethernet interfaces of your internet routers and use the standby track command to track the serial interfaces. All of your internal default routes could then point to the virtual IP address. For a more detailed explanation, check the following links:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/cs009.htm

http://www.cisco.com/warp/public/459/hsrp_bgp.html

http://www.cisco.com/warp/public/619/6.html

[tmoreo]

I depends on what type of resilience you want. Outbound is one thing inbound is another.

Are your two ISP's going to different locations or one location?

Are there two internet routers or one?

Inbound Mail Ex.

If ISP 1 is 11.11.11.X

and

ISP 2 is 12.12.12.X

and your MX record for mail is 12.12.12.12.

With everything being a standard config and ISP goes down, your down.

This is where BGP comes in handy. You "own" the IP range and both ISP's advertise it. You can also have a weighted MX record.

I would start with what type of resilience do you want and separate inbound and outbound services. Then draw out several designs and go through a "failure senario" If this device fails what happens. In the end you should have your specific best design.

[tmoreo]

If you are looking purely for ideas on Outbound failover:

Here is one solution from Cisco.

http://www.cisco.com/warp/public/459/BGP-PIX.pdf

If you are not doing BGP you can redistribute your default gateways in through the firewall.

If you want inbound:You can simply weight your MX records and make no infrastructure changes.

Again it depends on your entire design, what you want to accomplish, how much cash you have to spend, security policies.........................................

In addition it is rumored that with the next version of PIX code there will be IP failover. With that you could potentially have the Firewalls in different cities and have stateful failover providing some additional internet edge tweeking.

Your issue is the same as eveyone with multiple default gateways to the internet. Most of the time, after going through the excercise, clients have settled on a policy of manual failover. For the others, the solutions have been system specific based on the needs of the failover.

[datnguyen]

The problem you are having is that the external routers do not exchange routing tables with all internal devices. Therefore, if one of the Internet connection goes down, the affected external router is aware that the default route is no longer exist, but they cannot communicate with the internal devices so that the internal devices can select another default route to get out to the Internet. I have done shell scripting to take care of this problem in the past, but it depends on what firewall you are running.

[tmoreo]

.