2 ISP Connection ! Help me How to assign one Connection to each VLAN

[DJAHIDCISCO]

Hiii

I have two ISP Connection configured in my 2921 Router with NAT. the router is connection to 2960 switch L2

I want to assign one internet connection for each VLAN

VLAN 10 ===== 192.168.10.0

VLAN 20 ===== 192.168.20.0

ISP 1 --- Ip nat inside source list ISP1 interface Gigaethernet 0/0 Overload

ISP 2 --- Ip nat inside source list ISP2 interface Gigaethernet 0/1 Overload

Ip route 192.168.10.0 255.255.255.0 192.168.1.1 ( 192.168.1.1 ====) Modem ISP1)

Ip route 192.168.20.0 255.255.255.0 192.168.2.1 ( 192.168.2.1 ====) Modem ISP2)

Ip access list ISP 1

  Permit Ip any any

Ip access list ISP 2

Permit ip any any

Is this configuration TRUE

[Georg Pauwen]

Hello,

the routing looks odd. Post the full running configuration of your router...

[DJAHIDCISCO]

Building configuration...

Current configuration : 1949 bytes
!
! Last configuration change at 01:28:12 UTC Sun Aug 21 2022
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
no ipv6 cef
ip source-route
ip cef
!
--More--
*Aug 21 01:28:12.857: %SYS-5-CONFIG_I: Configured from console ! e
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
crypto pki token default removal timeout 0
!
!
voice-card 0
!
!
!
!
!
!
!
license udi pid CISCO2951/K9 sn FTX1539AKBF
license boot module c2951 technology-package uck9
!
!
!
redundancy
!
!
!
!
!
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/0.10
description "SUB-INTERFACE VLAN 10"
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/0.20
description "SUB-INTERFACE VLAN 20"
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1
description "INTERFACE CONNECT TO MOEDEM ISP1"
ip address 192.168.1.254 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/2
description "INTERFACE CONNECT TO MODEM ISP2"
ip address 192.168.2.254 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list ISP1 interface GigabitEthernet0/1 overload
ip nat inside source list ISP2 interface GigabitEthernet0/2 overload
ip route 192.168.10.0 255.255.255.0 192.168.1.1
ip route 192.168.20.0 255.255.255.0 192.168.2.0
!
ip access-list extended ISP1
permit ip any any
ip access-list extended ISP2
permit ip any any
!
!
nls resp-timeout 1
cpd cr-id 1
!
!
control-plane
!
!

[Richard Burts]

Thanks for posting the configuration. There are multiple things that need discussion. Let me start with this:

1) If you want vlan 10 to use one ISP and vlan 20 to use the other ISP then you need to configure Policy Based Routing. PBR uses access lists and route maps. The access list identifies which addresses are the source and the route map can set the next hop address for the particular source addresses.

2) your configuration of nat like this

ip nat inside source list ISP1 interface GigabitEthernet0/1 overload

is appropriate when there is a single outbound interface. When there are 2 outbound interfaces the best practice is to use a route map in the ip nat statement. The route map can match the outbound interface as well as matching an access list to identify the traffic to be translated.

3) the access lists you use for nat (ISP1 and ISP2) permit any any. One access list should permit vlan 10 and the other access list should permit vlan 20.

4) I am not clear what you think these static routes are doing

ip route 192.168.10.0 255.255.255.0 192.168.1.1
ip route 192.168.20.0 255.255.255.0 192.168.2.0

A static route implies that the first address specified is some remote network. But in this case both static routes the first network is locally connected. These static routes will not work and should be removed.

5) If G0/0 is shut down then the subinterfaces will not work. The main interface needs no shutdown.

[DJAHIDCISCO]

Thank for your replay

ok can you tell me the exact ip route in this scenario

and please can you give me an exemple of configuration with the method   you mentionned

Policy based Routing and route map in the ip nat statement for this scenario

Thank you for correcting this configuration

[Richard Burts]

To be able to provide examples of configuration there is something we need to understand about your situation. You describe 2 vlans in the inside network and 2 ISP. You want vlan 10 to use the first ISP and vlan 20 to use the other ISP. But what happens if one of the ISP has a problem? If ISP1 is not working is vlan 10 not getting Internet access? Or do you want failover to the other ISP? It makes a difference in how we would configure PBR and makes a difference in how we would configure nat.

[DJAHIDCISCO]

I want to start with the configuration of the first scenario

even if the ISP1 connexion has a problem ans Vlan1 can't access internet

It's not a problem for me

Thank's for your help

[Richard Burts]

Thank you for the additional information. Based on that I am making these assumptions in my suggestions. If any of them are not correct then please provide clarification:

- vlans 10 and 20 need to be able to communicate with each other. 

- PBR will always send vlan 10 traffic for Internet to ISP1

- PBR will always send vlan 20 traffic for Internet to ISP2

- nat for addresses in vlan 10 will be done only on the interface for ISP1.

- nat for addresses in vlan 20 will be done only on the interface for ISP2.

Let us start with configuring PBR. I will describe the steps for configuring vlan 10. You will use very similar steps for vlan 20.

1) configure an access list to identify traffic to be forwarded by PBR. I suggest using acl 110 but you can choose a different number (or name) if you wish. This acl will have 2 statements.

- the first statement will deny traffic with source addresses in 192.168.10.0 and destination addresses in 192.168.20.0.

- the second statement will permit traffic with source addresses in 192.168.10.0 and destination address any

2) configure a route map to use with PBR for vlan 10. I suggest the route map name be PBR10 but you can use a different name if you wish.

- the first statement in the route map will match the acl that you configured for vlan 10 (110 or whatever name you chose).

- the second statement in the route map will set the ip next-hop as the ISP1 modem IP address.

3) On the vlan subinterface G0/0.10 assign the PBR route map to perform PBR for vlan 10.

That is it for PBR. These would be the steps for configuring nat. I will describe the steps for configuring vlan 10. You will use very similar steps for vlan 20.
1) configure an access list to identify traffic to be translated. For this we will use a standard access list and not an extended access list. I suggest using acl 10 but you could use a different number (or name) if you choose.

- the acl will have a single statement to permit 192.168.10.0 0.0.0.255

2) configure a route map for nat.  I suggest the route map name be nat10 but you can use a different name if you wish.

- the first statement in the route map will match the acl that you configured for vlan 10 (10 or whatever name you chose).
- the second statement in the route map will match the interface for ISP1 G0/1

3) you will configure an ip nat statement to process translation for vlan 10 using the route map and the ISP1 interface.

[DJAHIDCISCO]

the router configuration are atteched to the replay message

 my cisco router is a DHCP

My modem address

  ISP1 : 192.168.1.1

  ISP2 : 192.168.2.1

[MHM Cisco World]

https://blog.pierky.com/dual-wan-connection-on-cisco-with-policy-based-routing-pbr/

use this link as ref. 
there are many command need to change or delete 

[DJAHIDCISCO]

i have to internet connexion ISP1 and ISP 2

i want each vlan have her proper ISP connection

not LOAD BALANCING

[MHM Cisco World]

Make each vlan route via specific ISP is load balance.

[MHM Cisco World]

friend it not so hard I will share with you steps 
1- config the ACL 
ip access-list extended 100 
permit ip <VLAN1 subnet > any 
!
ip access-list extended 101
permit ip <VLAN2 subnet> any 
2-PBR 
route-map VLAN1 permit 10
match ip address 100
set ip interface <ISP1 interface>
!
route-map VLAN2 permit 10
match ip address 101
set ip interface <ISP2 interface>
!
interface VLAN1 
ip policy route-map VLAN1
!
interface VLAN2
ip policy route-map VLAN2
3-NAT with route-map 
route-map VLAN1 permit 10
match ip add 100
!
ip nat inside source route-map VLAN1 interface <ISP1> overload 
!
route-map VLAN2 permit 10
match ip add 101
!
ip nat inside source route-map VLAN2 interface <ISP2>overload 

4-static route for failover
ip route 0.0.0.0 0.0.0.0 interface <ISP1>
ip route 0.0.0.0 0.0.0.0 interface <ISP2>

that it