cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1500
Views
0
Helpful
14
Replies

Gateway loss sometimes when apply PBR on LAN interface

csawest.dc
Level 3
Level 3

Dear Experts,

Gateway loss sometimes when apply PBR on LAN interface

We are facing the problem when PBR apply on LAN Interface for manage outbound traffic.


We are using Multiple ISP bandwith with BGP Routing in Single 3845 Router Ok

LAN IP Pools (not real mention)

101.205.62.0/24
101.205.63.0/24
101.205.64.0/24
101.205.65.0/24


We need 1st two IP Pools ( 101.205.62.0/24 & 101.205.63.0/24) outbound traffic going via ISP-A and  other two IP Pools ( 101.205.64.0/24 & 101.205.65.0/24) outbound traffic via ISP-B

Please see bellow route-map config with match ACL

ip access-list extended ISP-A
permit ip 101.205.62.0 0.0.0.255 any
permit ip 101.205.63.0 0.0.0.255 any


ip access-list extended ISP-B
permit ip 101.205.64.0 0.0.0.255 any
permit ip 101.205.65.0 0.0.0.255 any


route-map PBR permit 10
match ip address ISP-A
set ip next-hop 125.241.119.122  ( WAN ISP-A end)


route-map PBR permit 20
match ip address ISP-B
set ip next-hop 62.145.190.22 (WAN ISP-B end)

route-map PBR permit 30


But when i apply on LAN interface ( gi0/1.2) of this PBR we are getting loss sometimes our gateway then i remove this PBR policy from this LAN interface it;s working fine wihout any loss.

so what is the issue and how to resolve this.

Thanks in ADV,

1 Accepted Solution

Accepted Solutions

Hi,

Depending on your agreement with provider, you can manage outbound traffic with BGP.

You have 4 subnets in LAN, and 2 providers (so, 2 eBGP connections from WAN router). With the help of route-maps and BGP attributes (let's say local-preference) you announce 2 subnets with a higher priority to the 1st provider and wit lower priority to the 2nd ISP. For the other 2 subnets left, you announce them with higher priority to the 2nd provider and lower priority to the 1st ISP

Just a raw overview of how you should do this:

ip access-list standard FIRST_2_SUBNETS

permit "primary subnet"

permit "secondary subnet"

ip access-list standard LAST_2_SUBNETS

permit "third subnet"

permit "forth subnet"

route-map TO_1ST_ISP permit 10

match ip address FIRST_2_SUBNETS

set local-preference 100

route-map TO_1ST_ISP permit 20

match ip address LAST_2_SUBNETS

set loca-preference 90

route-map TO_2ND_ISP permit 10

match ip address LAST_2_SUBNETS

set local-preference 100

route-map TO_2ND_ISP permit 20

match ip address FIRST_2_SUBNETS

set local-preference 90

router bgp AS_NUMBER

!

neighbor 1ST_ISP_IP remote-as AS_NUMBER_ISP_1

neighbor 1ST_ISP_IP route-map TO_1ST_ISP in

!

neighbor 2ND_ISPF_IP remote-as AS_NUMBER_ISP_2

neighbor 2ND_ISP_IP route-map TO_2ND_ISP in

Some notes here:


-basic concept, you'll have to figure it out the IP addresses and subnets

-you need to have a BGP peering with your ISP providers, or to be able to request one

-this configuration will influence the outbound traffic

-you can also influence inbound traffic (e.g. using as-path prepending) but due to nature of Internet, this may not work as expected

-by default local-preference value is already 100; I just added here to understand this example

I hope you understand my example!

Cheers,

Calin

View solution in original post

14 Replies 14

Calin C.
Level 5
Level 5

Hi,

The structure of your PBR looks fine. Do you have temporary packet loss, while applying the PBR or you get a permanent packet loss after applying the policy?

If it's just temporary, check the your router resources (CPU, MEM). If they are high, applying the PBR will increase the resource utilization as the router has to do some additional operation and may have problems to process all packets.

Second, is not very clear for me, from where you encounter packet loss after PBR is applied? From WAN router, or from a LAN location?

Cheers,

Calin

Dear Calin,

Thanks for your support.

We are getting from LAN location encounter packet loss after applied PBR on LAN interface.

We are observe it's happen at pick time,

So how can i manage outbound traffic without PBR apply on LAN interface .

I must manage outbound traffic So please give me some solution without face this issue and also without apply PBR on LAN interface.

Can i manage our outbound traffic via bgp ??

Thanks in ADV,

Hi,

Depending on your agreement with provider, you can manage outbound traffic with BGP.

You have 4 subnets in LAN, and 2 providers (so, 2 eBGP connections from WAN router). With the help of route-maps and BGP attributes (let's say local-preference) you announce 2 subnets with a higher priority to the 1st provider and wit lower priority to the 2nd ISP. For the other 2 subnets left, you announce them with higher priority to the 2nd provider and lower priority to the 1st ISP

Just a raw overview of how you should do this:

ip access-list standard FIRST_2_SUBNETS

permit "primary subnet"

permit "secondary subnet"

ip access-list standard LAST_2_SUBNETS

permit "third subnet"

permit "forth subnet"

route-map TO_1ST_ISP permit 10

match ip address FIRST_2_SUBNETS

set local-preference 100

route-map TO_1ST_ISP permit 20

match ip address LAST_2_SUBNETS

set loca-preference 90

route-map TO_2ND_ISP permit 10

match ip address LAST_2_SUBNETS

set local-preference 100

route-map TO_2ND_ISP permit 20

match ip address FIRST_2_SUBNETS

set local-preference 90

router bgp AS_NUMBER

!

neighbor 1ST_ISP_IP remote-as AS_NUMBER_ISP_1

neighbor 1ST_ISP_IP route-map TO_1ST_ISP in

!

neighbor 2ND_ISPF_IP remote-as AS_NUMBER_ISP_2

neighbor 2ND_ISP_IP route-map TO_2ND_ISP in

Some notes here:


-basic concept, you'll have to figure it out the IP addresses and subnets

-you need to have a BGP peering with your ISP providers, or to be able to request one

-this configuration will influence the outbound traffic

-you can also influence inbound traffic (e.g. using as-path prepending) but due to nature of Internet, this may not work as expected

-by default local-preference value is already 100; I just added here to understand this example

I hope you understand my example!

Cheers,

Calin

Dear Calin,

Thank you very much for your great  explanation

I wll try to do this and then get back to you.

Thanks once again!!!

Just get back to me if you have problems and I'll try to help

Thanks for vote!

Calin

Calin,

I have some questions about your config. Is Local Preference not supposed assign the preference that you receive from your peers.

For example, you are receiving a route with same exact AS-PATH through 2 different entry points, you can assign local preference to one [Like the route-map you mentioned] and force your traffic out of your AS?

So, IMO the configuration is right but a little change is required. In the access-list, mentioning the networks in the destination portion would be appropriate.

Like this.

ip access-list extended ISP-A
permit ip 101 any 205.62.0 0.0.0.255
permit ip 101 any 205.63.0 0.0.0.255


ip access-list extended ISP-B
permit ip any 101.205.64.0 0.0.0.255
permit ip any 101.205.65.0 0.0.0.255

This will assign a local preference to all traffic going to those subnets accordingly. Is it not?

Also, if the BGP sessions are on the same device, you can use "Administrative Weight" instead of Local Preference. Can't we?

Calin : Please correct me if I am wrong !!

Thanks.

I said this because, I have experience manipulating outbound traffic with AS_PATH and LOCAL_PREF but not ACL and LOCAL_PREF.

Hello again,

There might be a little bit of confusion here. My BGP response was to this question:

Can i manage our outbound traffic via bgp ??

And I put together a little example. But I never said that this example will work on a source - destination base.

As you can see that route-map are applied "in", so the local-preference will be setup for some prefixes coming in from outside (I took 4 prefixes of them and name them 1st to 4th).

The ACL will work (as well an ip prefix-list) but you cannot have an extended ACL. I mean you can have it, no problem, BGP will not complain about this, but the inbound rule (route-map in) will not match any traffic.

More, with Internet scenario this is almost impossible to follow if you get the full BGP table from the 2 providers.

Next, if you get only a default-route from your providers, through BGP, then my scenario will not work again.

Going back to the original problem with PBR, my question is what you want to achieve? If you want to load balance the traffic over the 2 links from your providers, this can be done, depending on your configuration. (bgp maximum-path increase to two or more, bgp dmzlink-bw if you have different unequal bandwidth on the provider lines....) Some solution exist always, but without having some more details it's hard to say which will work for sure.

If you really want that traffic from one source (internal subnet) to be push always to one provider, then PBR is your answer. If you want load-balancing over BGP, as I already said, there are more solutions to choose from depending on your network particularities.

If you come with more details, I'll try to put together a working scenario for your.

Cheers,

Calin

Dear Calin,

I dont know i i have to do should i config my outbound traffic manage via BGP as per your templates ??

The problem is getting loss from LAN enviarment to Gateway when i apply PBR on LAN interface in pick time, So I need manage outbound traffic via BGP

I have configure as-path prepend for inbound traffic manage.

So what i have to do should i continue with your template for ourbound traffic ??

Thanks in ADV,

Dear Calin,

outbound traffic via bgp not working i dont know what is wrong but when i apply PBR on LAN interface then it will work but not work via bgp and i must manage outbout traffic  via BGP because very high utilization CPU proc when i apply PBR on LAN interfae please see

CPU utilization for five seconds: 80%/30%; one minute: 76%; five minutes: 76%
PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process


  90   832274980   374811401       2220 30.88% 37.57% 38.63%   0 IP Input  

Please see my config for outbound traffic manage via bgp with local pref.

ip access-list extended ISP-1
permit ip 101.205.65.128 0.0.0.127 any
permit ip 101.205.63.0 0.0.0.255 any
permit ip 101.205.64.0 0.0.0.255 any


ip access-list extended ISP-2
permit ip host 101.205.62.18 any
permit ip host 101.205.62.22 any
permit ip 101.205.62.64 0.0.0.63 any
permit ip 101.205.62.128 0.0.0.127 any
permit ip 101.205.65.64 0.0.0.63 any


route-map ISP-1permit 10
match ip address ISP-1
set local-preference 100
!
route-map ISP-1 permit 20
match ip address ISP-2
set local-preference 90

route-map ISP-2 permit 10
match ip address ISP-2
set local-preference 100
!
route-map ISP-2 permit 20
match ip address ISP-1
set local-preference 90


neighbour ISP-1 WAN IP remote-as asn(isp-1)
neighbour ISP-1 WAN IP route-map ISP-1 in


neighbour ISP-2 WAN IP remote-as asn(isp-2)
neighbour ISP-2 WAN IP route-map ISP-2 in


then clear ip bgp ISP-1 WAN soft in and out
        clear ip bgp ISP-2 WAN soft in and out

but it's not work my outbound traffic not increase but when i apply PBR on LAN interface then only it''s work.

So please give me some solution my outbound traffci manage via BGP and i need to remove PBR because my CPU proc very high when apply PBR on LAN interface that's why i must do it.

Thansk in ADV,

Hi,

You are using extended ACLs so it won't work just do standard ACLs or prefix-list permitting the remote prefixes you want to apply Local_Pref on.

And don't forget in your route-map to do a permit clause with no match otherwise the implicit deny all will filter the other routes.

Regards.

Alain.

Don't forget to rate helpful posts.

The ACL will work (as well an ip prefix-list) but you cannot have an  extended ACL.

My advice was not to use extended ACL, just standard ones. Also cadealain suggested this approach.

Second:

CPU utilization for five seconds: 80%/30%; one minute: 76%;  five minutes: 76%
PID Runtime(ms)     Invoked      uSecs   5Sec    1Min   5Min TTY Process


90   832274980    374811401       2220 30.88% 37.57% 38.63%   0 IP Input

This may be the cause why your PBR is not working fine. I see that the CPU utilization is very high due to process "IP Input". This means that you have a lot of IP traffic that is process-switched causing bad behavior.

Here:

http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00801c2af3.shtml

There are some step-by-step what to check to fix this issue. If you manage to throttle down your CPU utilization, then PBR will work fine.

Let me know if you manage to fix your CPU utilization issue.

Hi Calin,

Normaly since IOS 12.0 PBR is cef-switched if CEF is enabled so we can presume he hasn't got cef enabled and that policy routed traffic is process switched but maybe just enabling fast switching for PBR( ip route-cache policy interface command) would solve the issue without using CEF which is better of course.

Regards.

Alain.

Don't forget to rate helpful posts.

Dear Calin  & Cadetalain,

1st of all i have applied PBR on my Subinterface (gi0/1.2) >> it's my LAN Interface to connect cisco 3750.

ip route-cache policy interface  ( command successfuly applied but dont display when i saw this interface) and also ip route-cache same-interface on this interface but dont display when saw this interace.

should i match standerd list with route map to manage outbound traffic ??

Thanks in ADV,