I've managed to do the same on a cisco 876 router. The router is connected to a single provider via 2 aDSL lines. One line is connected to the atm0 interface and the other to a baudtec router which I have configured to work in bridge mode. I then connected the baudtec router to a fastethernet interface of the c876. I configured pppoe client on the vlan1 interface and monitor both lines by tracking the line status of the dialer interfaces (I could track the reachability via sla icmp-echo requests to the ip addresses of the BRASs or IP DSLAMs but since I connect to a single ISP the ip address is the same). I use policy based routing to load share all traffic except the vpns. Until now everything works perfectly. I use the advance enterprise 12.4(24)T3 ios image.
Just for everyone's reference, here is my configuration:
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ****
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable password ****
!
aaa new-model
!
!
aaa authentication login vpncllogin local
aaa authorization network vpnclautho local
!
!
aaa session-id common
!
crypto pki trustpoint TP-self-signed-****
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-****
revocation-check none
rsakeypair TP-self-signed-****
!
!
crypto pki certificate chain TP-self-signed-****
certificate self-signed 01
****
quit
dot11 syslog
ip source-route
!
!
!
!
ip cef
ip name-server 195.170.0.1
ip name-server 195.170.2.2
no ipv6 cef
!
multilink bundle-name authenticated
!
isdn switch-type basic-net3
!
!
username **** password ****
username **** password ****
username **** password ****
username **** password ****
username **** password ****
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
!
crypto isakmp policy 20
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group ****
key ****
dns 195.170.0.2 195.170.2.2
pool vpnclientspool
acl ACLVPN
save-password
include-local-lan
crypto isakmp profile vpnclientprf
match identity group ****
client authentication list vpncllogin
isakmp authorization list vpnclautho
client configuration address respond
!
!
crypto ipsec transform-set ENCRYPTION esp-des esp-md5-hmac
!
crypto dynamic-map DynMap 20
set transform-set ENCRYPTION
set isakmp-profile vpnclientprf
reverse-route
!
!
crypto map VPN 1 ipsec-isakmp dynamic DynMap
!
archive
log config
hidekeys
!
!
!
track 1 interface Dialer0 line-protocol
!
track 2 interface Dialer1 line-protocol
!
!
bba-group pppoe 2ndWAN
!
!
interface Null0
no ip unreachables
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
encapsulation ppp
dialer pool-member 1
isdn switch-type basic-net3
isdn tei-negotiation preserve
isdn point-to-point-setup
!
interface ATM0
bandwidth 732
backup delay 3 3
backup interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
atm vc-per-vp 64
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
description *** INSIDE ***
ip address 192.168.1.1 255.255.255.0
ip access-group LAN_Inbound in
ip nat inside
ip virtual-reassembly
ip policy route-map PBR
pppoe enable group 2ndWAN
pppoe-client dial-pool-number 2
!
interface Dialer0
description *** OUTSIDE ***
ip address negotiated
ip access-group WAN_Inbound in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip flow ingress
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer idle-timeout 270
dialer string ****
dialer-group 1
keepalive 5 2
ppp chap hostname ****
ppp chap password ****
ppp pap sent-username **** password ****
crypto map VPN
!
interface Dialer1
description *** OUTSIDE ***
ip address negotiated
ip access-group WAN_Inbound in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip flow ingress
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 2
dialer idle-timeout 270
dialer-group 1
keepalive 5 2
ppp chap hostname ****
ppp chap password ****
ppp pap sent-username **** password ****
!
ip local pool vpnclientspool 192.168.2.1 192.168.2.254
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0 track 1
ip route 192.168.2.0 255.255.255.0 Dialer0 track 1
ip route 0.0.0.0 0.0.0.0 Dialer1 track 2
no ip http server
ip http access-class 23
ip http secure-server
ip http secure-port ****
!
!
ip dns server
ip nat inside source static tcp 192.168.1.10 25 interface Dialer0 25
ip nat inside source static tcp 192.168.1.10 443 interface Dialer0 443
ip nat inside source static tcp 192.168.1.10 465 interface Dialer0 465
ip nat inside source static tcp 192.168.1.10 563 interface Dialer0 563
ip nat inside source static tcp 192.168.1.10 636 interface Dialer0 636
ip nat inside source static tcp 192.168.1.10 993 interface Dialer0 993
ip nat inside source static tcp 192.168.1.10 995 interface Dialer0 995
ip nat inside source route-map Dialer0PAT interface Dialer0 overload
ip nat inside source route-map Dialer1PAT interface Dialer1 overload
!
ip access-list extended ACLVPN
remark --- VPN IPSec traffic to permit to VPN clients
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip any any
remark ---------------------------------------------------------------
ip access-list extended LAN_Inbound
deny ip 127.0.0.0 0.255.255.255 any
deny ip 192.0.2.0 0.0.0.255 any
deny ip 224.0.0.0 31.255.255.255 any
deny ip host 255.255.255.255 any
deny ip host 0.0.0.0 any
deny tcp any any range 137 139
deny udp any any range netbios-ns netbios-ss
permit icmp 192.168.1.0 0.0.0.255 any
deny icmp any any
permit ip 192.168.1.0 0.0.0.255 any
deny ip any any
remark ---------------------------------------------------------------
ip access-list extended PAT
remark --- NAT overload
deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 any
deny ip any any
remark ---------------------------------------------------------------
ip access-list extended Servers_to_Internet
permit ip host 192.168.1.2 any
permit ip host 192.168.1.4 any
permit ip host 192.168.1.10 any
deny ip any any
remark ---------------------------------------------------------------
ip access-list extended Users_to_Internet
deny ip host 192.168.1.2 any
deny ip host 192.168.1.4 any
deny ip host 192.168.1.10 any
permit ip 192.168.1.0 0.0.0.255 any
deny ip any any
remark ---------------------------------------------------------------
ip access-list extended WAN_Inbound
remark --- Phase 1 . Add anti-spoofing entries.
remark --- Deny special-use address sources.
remark --- See RFC 3330 for additional special-use addresses.
deny ip 127.0.0.0 0.255.255.255 any
deny ip 192.0.2.0 0.0.0.255 any
deny ip 224.0.0.0 31.255.255.255 any
deny ip host 255.255.255.255 any
deny ip host 0.0.0.0 any
remark --- Filter RFC 1918 space.
deny ip 10.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
remark --- Deny your space as source (as noted in RFC 2827).
deny ip 192.168.1.0 0.0.0.255 any
remark --- Phase 2 . Explicitly permit return traffic.
remark --- Allow specific ICMP types.
permit icmp any any echo-reply
permit icmp any any unreachable
permit icmp any any time-exceeded
deny icmp any any
remark --- These are outgoing DNS queries.
permit udp any eq domain host dialer_0_ip_address gt 1023
permit udp any eq domain host dialer_1_ip_address gt 1023
remark --- Permit older DNS queries and replies to primary DNS server.
permit udp any eq domain host dialer_0_ip_address eq domain
permit udp any eq domain host dialer_1_ip_address eq domain
remark --- Permit legitimate business traffic.
permit tcp any host dialer_0_ip_address established
permit udp any range 1 1023 host dialer_0_ip_address gt 1023
permit tcp any host dialer_1_ip_address established
permit udp any range 1 1023 host dialer_1_ip_address gt 1023
remark --- Explicitly permit externally sourced traffic.
remark --- These are incoming DNS queries.
permit udp any gt 1023 host dialer_0_ip_address eq domain
remark --- These are zone transfer DNS queries to primary DNS server.
permit tcp host 195.170.0.1 gt 1023 host dialer_0_ip_address eq domain
permit tcp host 195.170.2.2 gt 1023 host dialer_0_ip_address eq domain
remark --- Permit older DNS zone transfers.
permit tcp host 195.170.0.1 eq domain host dialer_0_ip_address eq domain
permit tcp host 195.170.2.2 eq domain host dialer_0_ip_address eq domain
remark --- Deny all other DNS traffic.
deny udp any any eq domain
deny tcp any any eq domain
remark --- Allow IPSec VPN traffic.
permit udp any host dialer_0_ip_address eq isakmp
permit udp any host dialer_0_ip_address eq non500-isakmp
permit esp any host dialer_0_ip_address
permit ahp any host dialer_0_ip_address
remark --- These are Internet-sourced connections to
remark --- publicly accessible servers.
permit tcp any host dialer_0_ip_address eq smtp
permit tcp any host dialer_0_ip_address eq 443
permit tcp any host dialer_0_ip_address eq 465
permit tcp any host dialer_0_ip_address eq 563
permit tcp any host dialer_0_ip_address eq 636
permit tcp any host dialer_0_ip_address eq 993
permit tcp any host dialer_0_ip_address eq 995
remark --- Explicitly deny all other traffic.
deny ip any any
remark ---------------------------------------------------------------
!
access-list 23 remark >>> HTTP and LINE VTY Access-class list <<<
access-list 23 permit 192.168.1.0 0.0.0.255
access-list 23 permit 192.168.2.0 0.0.0.255
access-list 23 deny any
access-list 23 remark ----------
dialer-list 1 protocol ip permit
no cdp run
!
!
!
!
route-map PBR permit 10
match ip address Servers_to_Internet
set ip next-hop verify-availability 80.106.108.152 10 track 1
set ip next-hop verify-availability 80.106.108.152 20 track 2
!
route-map PBR permit 20
match ip address Users_to_Internet
set ip next-hop verify-availability 80.106.108.152 10 track 2
set ip next-hop verify-availability 80.106.108.152 20 track 1
!
route-map Dialer0PAT permit 10
match ip address PAT
match interface Dialer0
!
route-map Dialer1PAT permit 10
match ip address PAT
match interface Dialer1
!
!
control-plane
!
!
line con 0
exec-timeout 120 0
login authentication vpncllogin
no modem enable
stopbits 1
line aux 0
line vty 0 4
access-class 23 in
exec-timeout 120 0
login authentication vpncllogin
!
scheduler max-task-time 5000
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
And here is my routing table
sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
80.0.0.0/32 is subnetted, 1 subnets
C 80.106.108.152 is directly connected, Dialer1
is directly connected, Dialer0
83.0.0.0/32 is subnetted, 1 subnets
C dialer_1_ip_address is directly connected, Dialer1
79.0.0.0/32 is subnetted, 1 subnets
C dialer_0_ip_address is directly connected, Dialer0
C 192.168.1.0/24 is directly connected, Vlan1
S 192.168.2.0/24 is directly connected, Dialer0
S* 0.0.0.0/0 is directly connected, Dialer1
is directly connected, Dialer0
I have noted in bold the ip address I use as next-hop for the PBR route-map.
Yours Sincerely,
Michael Antonakis
