Hi All,
Thanks for your ever helpful contributions that has continued to enrich our professional outputs.
I am dealing with an issue presently on my network.
I want to configure my router for a dual link to the internet so that when one link goes down the other comes up automatically and once the primary link is restored it switches to it automatically.
I know I am supposed to use different admin distances to show which is the main link and backup link but I am not very sure about how NAT will work with this and how it will affect my Vpn connection which I'm still troubleshooting. I.e. will the backup link automatically use the vpn?
My current config for primary linkis shown.
Building configuration...
Current configuration : 5673 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
no service dhcp
!
hostname
!
boot-start-marker
boot-end-marker
!
aaa new-model
!
!
aaa authentication login local_auth local
!
!
aaa session-id common
!
crypto pki trustpoint TP-self-signed-3885639516
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3885639516
revocation-check none
dot11 syslog
no ip source-route
no ip gratuitous-arps
!
!
ip cef
ip dhcp bootp ignore
!
!
no ip bootp server
no ip domain lookup
ip domain name
ip name-server 19.8.8.8
ip name-server 4.9.0.0
!
multilink bundle-name authenticated
!
!
username a
username to
!
!
crypto isakmp policy 1
encr aes
hash md5
authentication pre-share
group 2
crypto isakmp key scisc address 4.x.x.x
!
!
crypto ipsec transform-set ME-VPN esp-aes esp-md5-hmac
!
crypto map VPN-TO-PH 10 ipsec-isakmp
set peer 4.x.x.x
set transform-set ME-VPN
match address VPN-TRAFFIC
!
archive
log config
logging enable
hidekeys
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
interface Loopback0
ip address 192.1.1.1 255.255.255.255
!
interface Tunnel0
no ip address
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation hdlc
shutdown
!
interface FastEthernet0
ip address 192.168.0.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet1
ip address 41.y.y.y 255.255.255.248
ip verify unicast source reachable-via rx allow-default 101
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map VPN-TO-PH
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 4.x.x.x
ip route 192.168.1.0 255.255.255.0 FastEthernet1
!
!
ip http server
ip http access-class 20
ip http authentication local
ip http secure-server
ip nat inside source route-map LAT interface FastEthernet1 overload
!
ip access-list extended VPN-TRAFFIC
permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
!
logging trap debugging
logging facility local2
access-list 20 permit 192.168.0.111
access-list 100 remark EXCLUDE NAT
access-list 100 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 100 permit ip 192.168.0.0 0.0.0.255 any
access-list 100 remark
access-list 101 permit udp any any eq bootpc
no cdp run
!
!
!
route-map LAT permit 1
match ip address 100
!
!
!
!
control-plane
!
line con 0
exec-timeout 5 0
password
login authentication local_auth
transport output telnet
line aux 0
login authentication local_auth
transport output telnet
line vty 0 4
privilege level 1
password
login authentication local_auth
transport input telnet ssh
line vty 5 193
privilege level 1
password
login authentication local_auth
transport input telnet ssh
!
end
Any one with an idea how to achieve this?
Thanks
Tom
