Dual Wan 2921 Router

[Justin Kroll]

I have a 2921 router with dual wan, single lan. I have a single subnet on the lan and two different ISPs with different speeds. I host a few servers internally and would like to have all outbound internet traffic use ISP1 and anything internal, such as email or web traffic to use ISP2. Currently, I have both default routes configured for each ISP gateway, with one having a higher metric. The issue is, the ISP with the higher metric will not work for incoming connections. I have NAT properly configured and each work as the lower metric, but neither will work when configured with a higher metric.

I have tried searching for a solution, but cannot find anything. If someone could point me in the right direction, that would be great.

Thanks in advance.

[skarthic]

Is it possible for u to attach the running config.

[Richard Burts]

While I agree that seeing the complete config will give us better information and would confirm what the problem is. I believe that we already have enough information to identify the primary problem.

First, let us start with a brief review: when you configure two default routes and one has a higher metric, then we call this a floating static route. The main characteristic of a floating static route is that the floating static route (the one with the higher metric) will not be used at all if the route with the lower metric is in the IP routing table.

The original post says that both static routes work ok if they are configured with a lower metric. From this I believe that we can conclude that both static routes are configured correctly and that Network Address Translation is correctly configured for each connection.

The original post says that the problem is that a route does not work when configured with the higher metric. But from the brief review we now understand that the higher metric route should not work when the lower metric route is still in the routing table. So the fundamental problem is that the wrong solution is being implemented.

If the requirement is that certain traffic should use one ISP and that certain other traffic should use the second ISP, then the usual solution for this is to configure Policy Based Routing. PBR uses a route map to identify certain types of traffic and to specify a different routing decision for that traffic. This is much more likely to achieve a successful solution than configuring routes with a higher metric.

HTH

Rick

[Justin Kroll]

Thanks for the quick reply. Are you talking about something like this:

http://pierky.wordpress.com/2009/03/28/dual-wan-connection-on-cisco-with-policy-based-routing-pbr/

I did run into that in my searching, but I can not figure out how to implement it for a single internal LAN, rather than two internal subnets like it is configured. Maybe I'm looking at this the wrong way, but it seems like the right direction. I'd just like to reiterate my setup: I have two ISPs with separate external ip addresses and one internal lan subnet. I'd like all internally initiated traffic to route through ISP1, and any externally initiated traffic, such as incoming email or web traffic to use ISP2.

Could you please let me know if I should be looking at the setup in the above link, or a different PBR variation.

Thanks again.

I have also attached the configuration.

[tanveer2005]

Thank to every one. Please see the attached to understend.

I can Ping to webserver by both public ips at same time ,but i can browes by using only
first default route bublic IP from outside internet. Can some one solved my problem or any change
required.
My goel is to access inside Server from outside with two public IP from 2 ISPs at same time. by static Nat or PBR.
Please help me.

This is runn conf.

interface FastEthernet0/0.1
encapsulation dot1Q 9-----------LAN
ip address 10.10.5.70 255.255.255.0
ip nat inside
!
interface FastEthernet0/0.3
encapsulation dot1Q 3---------- ISP-1
ip address 82.128.161.50 255.255.255.224
ip nat outside
!
interface FastEthernet0/0.4
encapsulation dot1Q 4--------------ISP-2
ip address 77.192.187.250 255.255.255.248
ip nat outside
!
ip nat inside source static 10.10.5.60 82.128.161.51 route-map isp1
ip nat inside source static 10.10.5.60 77.192.187.251 route-map isp2
ip classless
ip route 0.0.0.0 0.0.0.0 77.192.187.254
ip route 0.0.0.0 0.0.0.0 82.128.161.33 20
no ip http server
!
route-map isp2 permit 10
match interface FastEthernet0/0.4
!
route-map isp1 permit 10
match interface FastEthernet0/0.3

http://karachi-fm-live.blogspot.com/2011/07/gujranwala-schools.html

[Justin Kroll]

*Bump*

Any more help, please?

[Richard Burts]

The config that you posted is quite complex and I have looked at it only briefly, so there are many details that I have not yet seen. I do not see any Policy Based Routing in it. I believe that PBR is the best alternative to achieve what you want. In a previous post you told us this:

I'd just like to reiterate my setup: I have two ISPs with separate external ip addresses and one internal lan subnet. I'd like all internally initiated traffic to route through ISP1, and any externally initiated traffic, such as incoming email or web traffic to use ISP2.

To achieve this I would suggest the following approach:

- set up routing to have the default route prefer to use ISP1. This takes care of your first requirement - traffic initiated internally will use ISP1.

- configure PBR to recognize the other traffic (email or web or whatever) and to send it through ISP2.

** these are the approximate steps to achieve this

** configure an extended access list which will permit this traffic

** configure a route map for PBR which will use the access list in a match statement and will have a set statement to use ISP2 as the next hop.

** the route map is referenced in an ip policy statement which goes on the LAN interface.

HTH

Rick

[chad patterson]

Hello,

I think you should implement Service Level Agreement tracking combined with route maps. It will track the state of you WAN interfaces, either up or down, and load balance through the up WAN interfaces. It would look something like this:

ip sla 1 

icmp-echo W.A.N.x source-interface Dialer1

timeout 1000

threshold 40

frequency 3

ip sla schedule 1 life forever start-time now

ip sla 2 

icmp-echo W.A.N.y source-interface Dialer2

timeout 1000

threshold 40

frequency 3

ip sla schedule 2 life forever start-time now

!

!

track timer interface 5

!        

track 100 interface Dialer1 ip routing

delay down 15 up 10

!        

track 200 interface Dialer2 ip routing

delay down 15 up 10

!

!

no ip classless

ip route 0.0.0.0 0.0.0.0 Dialer1 track 100

ip route 0.0.0.0 0.0.0.0 Dialer2 track 200

!

!

route-map dialer2 permit 10

match ip address 100

match interface Dialer2

!        

route-map dialer1 permit 10

match ip address 100

match interface Dialer1

Ther'es not not much more to it than that. Just use the ol' NAT inside/outside configuration for all interfaces. Of course you can throw some OER/PfR in for added complexity.