Cisco 2821 3 Wic

[jangydb98]

Hello,

I have a Cisco 2821 with 3 wic, 2 wic adsl and 1 wic eth. I need to configure the two adsl wics in load balancing and failover and in case of all the two adsl don't work, all the traffic must be routed on the eth wic wan.

The IOS version is 12.4

Can You help me? 

Thanks

Salve,
ho un router Cisco 2821 con 3 interfacce wic, di cui due adsl e una wan. Avrei la necessità di far lavorare le due wic adsl in load balancing e fail over e, in caso nessuna delle due linee funzioni, il traffico esca sulla wan eth.
C'è qualcuno che mi può dare la configurazione?

La versione dell'os è la 12.4.

Grazie

[Georg Pauwen]

Hello,

you would need an IP SLA that tracks both your primary interfaces (load balancing will be taken care of by two default routes and CEF). The tracked objects need to be 'connected' by a boolean 'AND' operator, which means, if both interfaces are down, the backup will be activated.

Post the config of your 2821, so we can add the necessary bits and pieces...

[jangydb98]

Hello,

This is the my configuration for the two adsl wics but when there are traffic on the two adsl the router going to reboot.

Thanks

[Georg Pauwen · Accepted solution]

Hello,

I have made some changes/additions (in bold) to your configuration. The idea is that when both ADSL connections go down, the backup connection will kick in. Since I don't know what your backup interrface is, I assumed it will be GigabitEthernet0/1. If that is not the case, change the interface to the one the backup connection is configured on.

Current configuration : 3199 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable password xxxx
!
no aaa new-model
!
dot11 syslog
ip source-route
!
ip cef
!
!
no ipv6 cef
!
multilink bundle-name authenticated
!
voice-card 0
!
archive
log config
hidekeys
!
track 1 ip sla 1 reachability
delay down 10 up 10
!
track 2 ip sla 2 reachability
delay down 10 up 10
!
interface GigabitEthernet0/0
ip address 10.0.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map WWW
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address x.x.x.x
ip nat outside
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
interface ATM0/1/0
no ip address
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 2
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp header-compression
dialer pool 2
dialer-group 2
no cdp enable
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
!
ip local policy route-map IPSLA
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0 track 1
ip route 0.0.0.0 0.0.0.0 Dialer1 track 2
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 10
ip http server
ip http access-class 10
ip http authentication aaa
no ip http secure-server
ip http max-connections 10
ip http client username user1
ip http client password 0 xxxxxx
ip http path flash:
!
ip nat inside source route-map DIAL0 interface Dialer0 overload
ip nat inside source route-map DIAL1 interface Dialer1 overload
ip nat inside source route-map BACKUP interface GigabitEthernet0/1 overload
!
ip access-list extended SLA1
permit icmp any host 8.8.8.8 echo
permit udp host x.x.x.x eq 22 any
permit tcp host x.x.x.x eq 22 any
ip access-list extended SLA2
permit icmp any host 8.8.4.4 echo
permit tcp host x.x.x.x eq 22 any
permit udp host x.x.x.x eq 22 any
!
ip sla auto discovery
ip sla 1
icmp-echo 8.8.8.8 source-interface Dialer0
threshold 500
frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 8.8.4.4 source-interface Dialer1
threshold 500
frequency 5
ip sla schedule 2 life forever start-time now
!
track 11 list boolean and
object 1
object 2
!
access-list 1 permit 10.0.1.0 0.0.0.255
access-list 20 permit 10.0.1.0 0.0.0.255
!
route-map DIAL0 permit 10
match ip address 1
match interface Dialer0
!
route-map DIAL1 permit 10
match ip address 1
match interface Dialer1
!
route-map BACKUP permit 10
match ip address 1
match interface GigabitEthernet0/1
!
route-map IPSLA permit 10
match ip address SLA1
set interface Dialer0
!
route-map IPSLA permit 20
match ip address SLA2
set interface Dialer1
!
route-map WWW permit 10
match ip address 100
set interface Dialer0
!
control-plane
!
line con 0
line aux 0
line vty 0 4
login
!
scheduler allocate 20000 1000
end

[jangydb98]

Thanks for your changes of configuration, tomorrow I will try the new configuration.

The Cisco 2821 don't finds the wic 1ENET, this wic isn't compatible with the 2821 ?

Thanks for your help

[Georg Pauwen · Accepted solution]

Hello,

the WIC-1ENET is not supported on that platform (End of Life for that card was December 2009).

Use the integrated GigabitEthernet port (0/1).

[jangydb98]

Thanks for information

[Georg Pauwen]

One thing you could try is to adjust the mtu and mss size on the dialer interfaces. In the meantime, I'll check for bugs...

interface Dialer0
ip address negotiated
ip mtu 1460
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1420
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
!
interface Dialer1
ip address negotiated
ip mtu 1460
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1420
ip tcp header-compression
dialer pool 2
dialer-group 2
no cdp enable
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
!

[jangydb98]

Hi, 

I tuned up mtu and mss, but nothing change. When the second dialer go up, the router reboot. 

Do you think that, making an upgrade to firmware 15.1, will resolve the problem?

Thanks a lot and bye.

[Georg Pauwen]

Hello,

so only that one server cannot download files through FTP ? How are your hosts connected to the router, through a switch ? If so, can you post the switch configuration ?

[jangydb98]

Hello,

only the server have problem, the PCs work normally with FTP download.

The router is connected with a gigabit switch not managed.

This is the config of the router.

Thanks

Using 4090 out of 245752 bytes
!
! Last configuration change at 16:19:22 UTC Sun May 21 2017
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname XXX
!
boot-start-marker
boot-end-marker
!
enable password XXX
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
ip domain name XXX.local
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid CISCO2821 sn *******
username admin privilege 15 secret 5 $1$F2fW$kOnPG6VAcXVW16frbqgOx/
!
redundancy
!
!
ip ssh version 2
!
track 1 ip sla 1 reachability
delay down 10 up 10
!
track 2 ip sla 2 reachability
delay down 10 up 10
!
track 11 list boolean and
object 1
object 2
!
!
!
!
!
!
!
interface GigabitEthernet0/0
ip address 10.0.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.168.1.5 255.255.255.0
ip nat outside
no ip virtual-reassembly
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 2
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
no cdp enable
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp header-compression
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
no cdp enable
!
ip local policy route-map IPSLA
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat translation timeout 420
ip nat translation tcp-timeout 120
ip nat translation pptp-timeout 420
ip nat translation udp-timeout 120
ip nat translation finrst-timeout 300
ip nat translation syn-timeout 120
ip nat translation icmp-timeout 120
ip nat translation max-entries 5000
ip nat inside source static tcp 10.0.1.191 **** interface Dialer0 9025
ip nat inside source static tcp 10.0.1.191 **** interface Dialer0 9026
ip nat inside source static tcp 10.0.1.191 **** interface Dialer0 9027
ip nat inside source route-map BACKUP interface GigabitEthernet0/1 overload
ip nat inside source route-map DIAL0 interface Dialer0 overload
ip nat inside source route-map DIAL1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 track 1
ip route 0.0.0.0 0.0.0.0 Dialer1 track 2
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 10
!
ip access-list extended SLA1
permit icmp any host 8.8.4.4 echo
permit udp host Y.Y.Y.Y eq 22 any
permit tcp host Y.Y.Y.Y eq 22 any
ip access-list extended SLA2
permit icmp any host 4.2.2.2 echo
permit udp host Z.Z.Z.Z eq 22 any
permit tcp host Z.Z.Z.Z eq 22 any
!
ip sla auto discovery
ip sla 1
icmp-echo 8.8.4.4 source-interface Dialer0
threshold 500
frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 4.2.2.2 source-interface Dialer1
threshold 500
frequency 5
ip sla schedule 2 life forever start-time now
access-list 1 permit 10.0.1.0 0.0.0.255
access-list 5 permit 10.0.1.0 0.0.0.255
access-list 8 permit 10.0.1.0 0.0.0.255
access-list 20 permit 10.0.1.0 0.0.0.255
!
!
!
route-map BACKUP permit 10
match ip address 1
match interface GigabitEthernet0/1
!
route-map DIAL0 permit 10
match ip address 1
match interface Dialer0
!
route-map DIAL1 permit 10
match ip address 1
match interface Dialer1
!
route-map IPSLA permit 10
match ip address SLA1
set interface Dialer0
!
route-map IPSLA permit 20
match ip address SLA2
set interface Dialer1
!
route-map WWW permit 10
match ip address 5
set interface Dialer0
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
access-class 8 in
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20000 1000
end

[Georg Pauwen]

Hello,

if only the server is having problems and all the other client computers work, the problem is likely not the router configuration. 

That said, try to add a static NAT entry for both passive and active FTP. I don't know what the inside IP address of your server is, but use the entries below and change the IP address to the address of your server.

ip nat inside source static tcp 10.0.1.191 20 interface Dialer0 20

ip nat inside source static tcp 10.0.1.191 21 interface Dialer0 21

[jangydb98]

Hello,

I try to set the static nat but it doesn't work, the server with another router (cisco 1801) or when I disconnect one adsl work correctly.

I try to set in GigabitEth 0/0 ip policy route-map WWW (static traffic on Dial0) and the FTP on the server work, but obviusly the dual wan don't work.

Thanks

[Georg Pauwen]

Hello,

route map WWW references access list 100, which I don't see in the configuration. Try and add it like below:

access-list 100 permit tcp any any eq www
access-list 100 permit tcp any any eq 21
access-list 100 permit tcp any any eq 20

[jangydb98]

Hello,

with the config now all the devices in the lan have problem with ftp and dns resolving.

Sometimes the dns and the ftp timing out.

The router is the DNS server of all devices.

Thank for help

The running-config

Building configuration...

Current configuration : 4024 bytes
!
! Last configuration change at 16:12:26 UTC Sat Jul 29 2017 by admin
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname aaaa
!
boot-start-marker
boot-end-marker
!
enable password xxxxx
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
ip domain name dddd.local
ip name-server 8.8.8.8
ip name-server 208.67.220.220
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid CISCO2821 sn rrrrrrrrrrrr
username admin privilege 15 secret 5ggggggggg
!
redundancy
!
!
ip ssh version 2
!
track 1 ip sla 1 reachability
delay down 10 up 10
!
track 2 ip sla 2 reachability
delay down 10 up 10
!
track 11 list boolean and
object 1
object 2
!
!
!
!
!
!
!
interface GigabitEthernet0/0
ip address 10.0.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address e.e.e.e 255.255.255.248
ip nat outside
no ip virtual-reassembly
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 2
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
no cdp enable
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp header-compression
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname @alicebiz.routed
ppp chap password 0 @alicebiz.routed
no cdp enable
!
ip local policy route-map IPSLA
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat translation timeout 420
ip nat translation tcp-timeout 120
ip nat translation pptp-timeout 420
ip nat translation udp-timeout 120
ip nat translation finrst-timeout 300
ip nat translation syn-timeout 120
ip nat translation icmp-timeout 120
ip nat translation max-entries 5000
ip nat inside source route-map BACKUP interface GigabitEthernet0/1 overload
ip nat inside source route-map DIAL0 interface Dialer0 overload
ip nat inside source route-map DIAL1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 track 1
ip route 0.0.0.0 0.0.0.0 Dialer1 track 2
ip route 0.0.0.0 0.0.0.0 188.228.143.217 10
!
ip access-list extended SLA1
permit icmp any host 8.8.4.4 echo
permit udp host t.t.t.t eq 22 any
permit tcp host t.t.t.t eq 22 any
ip access-list extended SLA2
permit icmp any host 4.2.2.2 echo
permit udp host y.y.y.y eq 22 any
permit tcp host y.y.y.y eq 22 any
!
ip sla auto discovery
ip sla 1
icmp-echo 8.8.4.4 source-interface Dialer0
threshold 500
frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 4.2.2.2 source-interface Dialer1
threshold 500
frequency 5
ip sla schedule 2 life forever start-time now
access-list 1 permit 10.0.1.0 0.0.0.255
access-list 5 permit 10.0.1.0 0.0.0.255
access-list 8 permit 10.0.1.0 0.0.0.255
access-list 15 permit 10.0.1.150
access-list 15 permit 10.0.1.191
access-list 20 permit 10.0.1.0 0.0.0.255
!
!
!
route-map BACKUP permit 10
match ip address 1
match interface GigabitEthernet0/1
!
route-map DIAL0 permit 10
match ip address 1
match interface Dialer0
!
route-map DIAL1 permit 10
match ip address 1
match interface Dialer1
!
route-map IPSLA permit 10
match ip address SLA1
set interface Dialer0
!
route-map IPSLA permit 20
match ip address SLA2
set interface Dialer1
!
route-map WWW permit 10
match ip address 100
set interface Dialer0
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
access-class 8 in
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20000 1000
end