Re: How to configure a second ISP with spécific trafic

belemdavidarmand · ‎04-09-2023

Hello,

I want to add a second isp on my router 4300 which will be use for only office365 traffic.

how can i do this ?

thanks

Flavio Miranda · ‎04-09-2023

Hi

You need to look at Application Aware Routing.

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/application-aware-routing.html

Georg Pauwen · ‎04-09-2023

Hello,

using PBR could be another option. Putting together a list of matching IP addresses can be tedious. If you look at the document linked below, which apps are actually in use in your organization ?

https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#skype-for-business-online-and-microsoft-teams

belemdavidarmand · ‎04-09-2023

Wo use Microsoft office 365 standard.

what exemple of configuration on the routeur will permit the office 365 traffic to pass through the 2nd ISP ?

Kanan Huseynli · ‎04-09-2023

Hi,

classification+PBR should work Here is interesting method:

https://community.cisco.com/t5/routing/pbr-with-nbar/td-p/1523023

For classification enable NBAR2 and match office365. Use latest protocol pack for nbar2, here is example for 4331 ISR router.

https://software.cisco.com/download/home/285018115/type/284509011/release/65.0.0?catid=268437899

HTH,
Please rate and mark as an accepted solution if you have found any of the information provided useful.

Joseph W. Doherty · ‎04-09-2023

There are a couple of ways to do outbound, as already described by the others, but inbound might be an issue.

Another possible issue might be, what do you want to happen if either ISP fails?

balaji.bandi · ‎04-10-2023

I want to add a second isp on my router 4300 which will be use for only office365 traffic.

adding other posters, are you peering with BGP with 2ISP ?

What is your network diagram look like? and you do NATiing?

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

belemdavidarmand · ‎04-10-2023

Hello,

my current config on cisco router is:

!
! Last configuration change at 13:02:41 UTC Sun Apr 2 2023 by lyaka
! NVRAM config last updated at 13:02:46 UTC Sun Apr 2 2023 by lyaka
!
version 17.3
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service call-home
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname RTR_EDGE
!
boot-start-marker
boot system flash:/isr4300-universalk9.17.03.03.SPA.bin
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
! card type command needed for slot/bay 0/1
logging console informational
enable secret 9 $9$LT8A27Y2OYaPYU$MVntHDVKCBK/csDeuDo3fUr0iDLjN0IuSu6yKZDmczQ
!
aaa new-model
!
!
aaa authentication fail-message c Connexion Echouee.Priere essayer a nouveau
aaa authentication login default local
!
!
!
!
!
!
aaa session-id common
!
!
!
!
!
!
!
ip domain name badf.bf
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
multilink bundle-name authenticated
no device-tracking logging theft
!
password encryption aes
!
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
!
!
crypto pki certificate chain SLA-TrustPoint
certificate ca 01
30820321 30820209 A0030201 02020101 300D0609 2A864886 F70D0101 0B050030
32310E30 0C060355 040A1305 43697363 6F312030 1E060355 04031317 43697363
6F204C69 63656E73 696E6720 526F6F74 20434130 1E170D31 33303533 30313934
3834375A 170D3338 30353330 31393438 34375A30 32310E30 0C060355 040A1305
43697363 6F312030 1E060355 04031317 43697363 6F204C69 63656E73 696E6720
526F6F74 20434130 82012230 0D06092A 864886F7 0D010101 05000382 010F0030
82010A02 82010100 A6BCBD96 131E05F7 145EA72C 2CD686E6 17222EA1 F1EFF64D
CBB4C798 212AA147 C655D8D7 9471380D 8711441E 1AAF071A 9CAE6388 8A38E520
1C394D78 462EF239 C659F715 B98C0A59 5BBB5CBD 0CFEBEA3 700A8BF7 D8F256EE
4AA4E80D DB6FD1C9 60B1FD18 FFC69C96 6FA68957 A2617DE7 104FDC5F EA2956AC
7390A3EB 2B5436AD C847A2C5 DAB553EB 69A9A535 58E9F3E3 C0BD23CF 58BD7188
68E69491 20F320E7 948E71D7 AE3BCC84 F10684C7 4BC8E00F 539BA42B 42C68BB7
C7479096 B4CB2D62 EA2F505D C7B062A4 6811D95B E8250FC4 5D5D5FB8 8F27D191
C55F0D76 61F9A4CD 3D992327 A8BB03BD 4E6D7069 7CBADF8B DF5F4368 95135E44
DFC7C6CF 04DD7FD1 02030100 01A34230 40300E06 03551D0F 0101FF04 04030201
06300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 1449DC85
4B3D31E5 1B3E6A17 606AF333 3D3B4C73 E8300D06 092A8648 86F70D01 010B0500
03820101 00507F24 D3932A66 86025D9F E838AE5C 6D4DF6B0 49631C78 240DA905
604EDCDE FF4FED2B 77FC460E CD636FDB DD44681E 3A5673AB 9093D3B1 6C9E3D8B
D98987BF E40CBD9E 1AECA0C2 2189BB5C 8FA85686 CD98B646 5575B146 8DFC66A8
467A3DF4 4D565700 6ADF0F0D CF835015 3C04FF7C 21E878AC 11BA9CD2 55A9232C
7CA7B7E6 C1AF74F6 152E99B7 B1FCF9BB E973DE7F 5BDDEB86 C71E3B49 1765308B
5FB0DA06 B92AFE7F 494E8A9E 07B85737 F3A58BE1 1A48A229 C37C1E69 39F08678
80DDCD16 D6BACECA EEBC7CF9 8428787B 35202CDC 60E4616A B623CDBD 230E3AFB
418616A9 4093E049 4D10AB75 27E86F73 932E35B5 8862FDAE 0275156F 719BB2F0
D697DF7F 28
quit
!
!
no license feature hseck9
license udi pid ISR4331/K9 sn FDO22510V5B
memory free low-watermark processor 69085
!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
redundancy
mode none
!
crypto ikev2 proposal BADF_PROPOSAL
encryption aes-cbc-256
integrity sha256
group 5
!
crypto ikev2 policy BADF_POLICY
match address local 154.66.x.x
proposal BADF_PROPOSAL
!
crypto ikev2 keyring BADF-ORANGE-KEYS
peer 197.239.x.x
address 197.239.x.x
pre-shared-key xS0nC8cyn0@mhk#B8z
!
!
crypto ikev2 keyring BADF-moov-KEYS
peer 196.2x.2x.x
address 196.2x.2x.x
pre-shared-key vjt9fUEcxtjE
!
!
crypto ikev2 keyring BADF-DATAPROTECT-KEYS
peer 197.2x.1x.x
address 197.2x.1x.x
pre-shared-key kjhlioisdl@
!
!
!
crypto ikev2 profile BADF-ORANGE-PROFILE
match identity remote address 197.2x.x.x 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local BADF-ORANGE-KEYS
!
crypto ikev2 profile BADF-MOOV-PROFILE
match identity remote address 196.2x.2x.x 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local BADF-moov-KEYS
!
crypto ikev2 profile BADF-DATAPROTECT-PROFILE
match identity remote address 197.2x.1x.x 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local BADF-DATAPROTECT-KEYS
!
!
!
vlan internal allocation policy ascending
no cdp run
!
!
!
!
!
!
!
crypto isakmp policy 11
encryption aes 256
authentication pre-share
group 5
crypto isakmp key xxxxxxx address 197.2x.x.x
crypto isakmp key xxxxxx address 196.28.2x.x
crypto isakmp key xxxxxx address 197.2x.x.x
crypto isakmp key xxxxxxxx address 41.x.2x.x
crypto isakmp key xxxxxx address 105.x.x.x
crypto isakmp keepalive 60 3
!
!
crypto ipsec transform-set Algo_combo6 esp-aes 256 esp-sha-hmac
mode tunnel
crypto ipsec transform-set BADF_transformSet esp-aes 256 esp-sha256-hmac
mode tunnel
!
!
!
crypto map BADF-IKEV2-VPN-CRYPTO-MAP 10 ipsec-isakmp
set peer 197.2x.x.x
set security-association lifetime seconds 86400
set transform-set BADF_transformSet
set pfs group5
set ikev2-profile BADF-ORANGE-PROFILE
match address BADF_ORANGE_acl
crypto map BADF-IKEV2-VPN-CRYPTO-MAP 11 ipsec-isakmp
description ##### VPN_GIM_BADF_SS_SB_ISAKMP ####
set peer 41.x.x.x
set peer 1x.x.x.x
set security-association lifetime seconds 28800
set transform-set Algo_combo6
set pfs group5
match address FOR_VPN_GIM_BADF_SS_SB
crypto map BADF-IKEV2-VPN-CRYPTO-MAP 20 ipsec-isakmp
set peer 19x.2x.x.x
set security-association lifetime seconds 86400
set transform-set BADF_transformSet
set pfs group5
set ikev2-profile BADF-MOOV-PROFILE
match address BADF_MOOV_acl
crypto map BADF-IKEV2-VPN-CRYPTO-MAP 30 ipsec-isakmp
set peer 197.2x.1x.x
set security-association lifetime seconds 28800
set transform-set BADF_transformSet
set pfs group5
set ikev2-profile BADF-DATAPROTECT-PROFILE
match address BADF_DATAPROTECT_acl
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
description LIEN WAN_ONATEL
ip address 154.x.x.x 255.255.255.252
no ip redirects
ip nat outside
negotiation auto
no cdp enable
crypto map BADF-IKEV2-VPN-CRYPTO-MAP
!
interface GigabitEthernet0/0/1
description LIEN LAN_BADF
ip address 41.1x.x.x 255.255.255.248
no ip redirects
negotiation auto
no cdp enable
!
interface GigabitEthernet0/0/2
description LAN-PRIVATE-BDF
no ip address
media-type sfp
negotiation auto
!
interface GigabitEthernet0/0/2.100
description LINK-TO-JUNIPER-SWIFT
encapsulation dot1Q 100
ip address 10.x.x.x 255.255.255.248
ip nat inside
!
interface GigabitEthernet0/0/2.117
description LAN-VPN
encapsulation dot1Q 117
ip address 10.10.x.x 255.255.255.248
ip nat inside
!
interface GigabitEthernet0/2/0
!
interface GigabitEthernet0/2/1
!
interface GigabitEthernet0/2/2
!
interface GigabitEthernet0/2/3
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
negotiation auto
!
interface Vlan1
no ip address
shutdown
!
ip default-gateway 154.x.1x.x
no ip http server
no ip http secure-server
ip forward-protocol nd
ip nat inside source static 10.10.x.x 172.18.x.x
ip nat inside source static 10.10.x.x 172.19.x.x
ip nat inside source static 10.10.x1.x 172.19.x.x
ip nat inside source static 10.10.2x.x 172.19.x.x
ip nat inside source static 10.10.2x.x 172.19.x.x
ip nat inside source static 10.10.2x.x 172.19.x.x
ip nat inside source static 10.10.x.x 172.26.x.x
ip nat inside source static 10.10.x.2 172.x.x.x
ip nat inside source static 10.10.x.x 172.26.x.x
ip nat inside source static 10.10.x.x 172.26.x.x
ip nat inside source static 10.10.x.x 172.26.2.x
ip nat inside source static 10.10.x.x 172.26.x.x
ip nat inside source static 10.10.x.x 172.26.2.x
ip nat inside source static 10.10.x.11 172.27.2.x
ip nat inside source static 10.10.0.35 172.27.2.x
ip nat inside source static 10.10.x.144 172.27.2.x
ip nat inside source static 10.10.2xx.100 172.27.2.x
ip nat inside source list 100 interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 154.66.169.45

ip route 10.10.201.4 255.255.255.255 10.10.251.34
ip route 10.10.201.5 255.255.255.255 10.10.251.34
ip route 10.10.201.9 255.255.255.255 10.10.251.34
ip route 10.10.201.13 255.255.255.255 10.10.251.34
ip route 10.10.201.14 255.255.255.255 10.10.251.34
ip route 10.10.201.15 255.255.255.255 10.10.251.34
ip route 10.10.201.16 255.255.255.255 10.10.251.34
ip route 10.10.250.10 255.255.255.255 10.10.251.26
ip route 10.10.250.36 255.255.255.255 10.10.251.34
ip route 10.10.250.37 255.255.255.255 10.10.251.34
ip route 10.10.250.51 255.255.255.255 10.10.251.34
ip route 10.10.251.10 255.255.255.255 10.10.251.34
ip route 10.10.251.18 255.255.255.255 10.10.251.34
ip route 10.10.251.26 255.255.255.255 10.10.251.34
ip route 10.10.252.3 255.255.255.255 10.10.251.34
ip route 10.10.253.100 255.255.255.255 10.10.251.26
ip route 23.105.131.228 255.255.255.255 Null0 name RANSON_IP
ip route 38.123.140.82 255.255.255.255 Null0 name ESA_SMTP_USA
ip route 51.195.53.221 255.255.255.255 Null0 name RANSON_IP
ip route 60.217.75.70 255.255.255.255 Null0 name CHINE_ESA
ip route 61.95.179.221 255.255.255.255 Null0 name MAIL_SMTP
ip route 80.67.18.16 255.255.255.255 Null0 name EMAIL_ESA
ip route 104.206.128.66 255.255.255.255 Null0 name EMAIL_SMPT
ip route 104.218.164.12 255.255.255.255 Null0 name EMAIL_SMPT
ip route 104.223.143.132 255.255.255.255 Null0 name RANSON_IP
ip route 107.182.129.190 255.255.255.255 Null0 name EBK_ESA
ip route 119.96.175.9 255.255.255.255 Null0 name EBANKING
ip route 121.229.45.222 255.255.255.255 Null0 name EMAIL_ESA_CHINA
ip route 122.160.0.0 255.255.0.0 Null0 name EMAIL_ESA_INDIA
ip route 122.160.72.223 255.255.255.255 Null0 name MAIL_ESA
ip route 134.119.228.97 255.255.255.255 Null0 name EMAIL_ESA
ip route 141.0.0.0 255.0.0.0 Null0 name EBANKING
ip route 152.32.255.215 255.255.255.255 Null0 name EMAIL_ESA_CHINA
ip route 152.89.0.0 255.255.0.0 Null0 name EBK_WEBMAIL
ip route 152.89.196.23 255.255.255.255 Null0 name EMAIL_SMPT
ip route 152.89.196.62 255.255.255.255 Null0 name WEBMAIL
ip route 152.89.196.211 255.255.255.255 Null0 name WEBMAIL_EBK_RUSSIE
ip route 162.247.74.204 255.255.255.255 Null0 name EBANKING
ip route 172.25.1.143 255.255.255.255 154.66.169.45
ip route 180.76.179.193 255.255.255.255 Null0 name SMTP_CHINA
ip route 185.220.101.157 255.255.255.255 Null0 name ESA_SMTP
ip route 185.220.101.161 255.255.255.255 Null0 name EBK_ESA
ip route 185.220.101.172 255.255.255.255 Null0 name MAIL_ESA
ip route 185.220.101.174 255.255.255.255 Null0 name EBANKING
ip route 186.239.167.154 255.255.255.255 Null0 name MAIL_ESA
ip route 192.168.254.0 255.255.255.252 10.10.251.14
ip route 192.168.254.0 255.255.255.252 10.10.251.26
ip route 192.241.0.0 255.255.0.0 Null0 name EBANKING
ip route 193.46.0.0 255.255.0.0 Null0 name EBANKING
ip route 196.1.215.230 255.255.255.255 Null0 name EMAIL_ESA_SOUDAN
ip route 198.199.0.0 255.255.0.0 Null0 name EBANKING
ip route 205.185.117.89 255.255.255.255 Null0 name EBANKING
ip route 207.46.0.0 255.255.0.0 Null0 name EBANKING
ip route 208.100.0.0 255.255.0.0 Null0 name EBANKING
ip ssh time-out 60
ip ssh authentication-retries 4
ip ssh version 2
!
!
ip access-list extended BADF_DATAPROTECT_acl
10 permit ip host 172.x.36.2 10.254.60.0 0.0.0.255
20 permit ip host 172.x.36.3 10.254.60.0 0.0.0.255
30 permit ip host 172.x.36.4 10.254.60.0 0.0.0.255
40 permit ip host 172.x.36.5 10.254.60.0 0.0.0.255
ip access-list extended BADF_MOOV_acl
10 permit ip host 172.x.6.1 host 10.1x.0.84
20 permit ip host 172.x.6.6 host 10.1x.0.84
30 permit ip host 172.x.6.1 host 10.1x.0.126
40 permit ip host 10.10.x.37 host 10.1x.0.84
ip access-list extended BADF_ORANGE_acl
10 permit ip 10.10.x.32 0.0.0.7 host 172.x.2.8
20 permit ip 10.10.x.32 0.0.0.7 host 172.x.1.143
30 permit ip 10.10.x.32 0.0.0.7 host 172.x.23.39
40 permit ip 10.10.x.32 0.0.0.7 host 172.x.23.40
50 permit ip 10.10.x.32 0.0.0.7 host 172.x.23.43
60 permit ip 10.10.x.32 0.0.0.7 host 172.x.1.134
70 permit ip 10.10.x.32 0.0.0.7 host 172.x.1.228
80 permit ip 10.10.x.32 0.0.0.7 host 172.x.1.46
90 permit ip 10.10.x.32 0.0.0.7 host 172.x.3.46
100 permit ip 10.10.x.32 0.0.0.7 host 172.x.1.50
110 permit ip 10.10.x.32 0.0.0.7 host 172.x.0.160
120 permit ip 10.10.x.32 0.0.0.7 host 172.x.23.50
130 permit ip 10.10.x.32 0.0.0.7 host 172.x.60.104
140 permit ip 10.10.x.32 0.0.0.7 host 172.x.60.108
150 permit ip 10.10.x.32 0.0.0.7 host 172.x.60.109
160 permit ip 10.10.x.32 0.0.0.7 host 172.x.60.112
ip access-list extended FOR_VPN_GIM_BADF_SS_SB
10 permit ip 172.x.x.112 0.0.0.15 172.16.x.0 0.0.0.255
20 permit ip 172.x.x.112 0.0.0.15 172.16.x.0 0.0.0.255
30 permit ip 172.x.x.112 0.0.0.15 172.18.x.0 0.0.0.255
40 permit ip 172.x.x.112 0.0.0.15 172.18.x.0 0.0.0.255

!
logging facility syslog
logging source-interface GigabitEthernet0/0/2.117
logging host 10.10.201.15 transport udp port 9002

!
!
!
control-plane
!
privilege exec level 3 more
privilege exec level 3 show startup-config
privilege exec level 3 show running-config view full
privilege exec level 3 show running-config view
privilege exec level 3 show running-config all
privilege exec level 3 show running-config
privilege exec level 3 show configuration
privilege exec level 3 show
!
line con 0
exec-timeout 5 0
logging synchronous
transport output none
stopbits 1
line aux 0
exec-timeout 0 1
no exec
stopbits 1
line vty 0 4
access-class 10 in
exec-timeout 5 0
timeout login response 60
transport input ssh
line vty 5 15
access-class 10 in
exec-timeout 5 0
timeout login response 60
transport input ssh
!
scheduler interval 300
call-home
! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
profile "CiscoTAC-1"
active
destination transport-method http
ntp source GigabitEthernet0/0/2.117
ntp server 194.0.5.123 minpoll 10
ntp server 10.10.2.11
ntp server 194.0.5.123exi
!
!
!
!
!
!
end

my outbound and inbound office365 traffic must be through the secondary ISP.

Thanks

Joseph W. Doherty · ‎04-10-2023

Ah, it looks like you have a public IP from each ISP. In that case, whatever flows out to one ISP must return through the same IP. I.e. The avoids the first potential issue.

As to the second possible issue, what do you want to happen if either ISP link/path fails, you've haven't addressed. It's an important question as it impacts how you might need/desire to configure your router.

belemdavidarmand · ‎04-10-2023

Every ISP have an Public IP.If Secondary ISP failed i want office365 traffic redirect through the 1rst ISP.so , in first time i want that only office 365 traffic passed through the secondary ISP.

Thanks

MHM Cisco World · ‎04-10-2023

Easy'

Config ISP and config NATing'

NATing to ISP2 sure make traffic return to ISP2 since it have public ip.

So did you config pbr ? If yes then add NAT overload with route-map match interface ISP1 or ISP2

That it

Thanks

MHM

belemdavidarmand · ‎04-10-2023

Can i have a methodology or sequentially commands to do this? im ok to have an example if it possible.

Thanks

MHM Cisco World · ‎04-10-2023

ip nat inside source route-map mhm10nat interface Serial1/0 overload <<- NAT with route-map
ip nat inside source route-map mhm20nat interface Serial1/1 overload <<- NAT with route-map
ip route 0.0.0.0 0.0.0.0 Serial1/1 track 1 <<- ISP1
ip route 0.0.0.0 0.0.0.0 Serial1/0 100 <<- ISP2
ip route 110.0.0.3 255.255.255.255 Serial1/1 permanent <<- this for track ISP1
!
ip sla 1
icmp-echo 110.0.0.3 source-interface Serial1/1
ip sla schedule 1 life forever start-time now
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 20.0.0.0 0.0.0.255
access-list 100 permit ip 10.0.0.0 0.0.0.255 any <<- traffic want to shift to ISP2
no cdp log mismatch duplex
!
!
!
!
route-map mhm20nat permit 10
match interface Serial1/1
!
route-map mhm10nat permit 10
match interface Serial1/0
!
route-map mhm10 permit 10
match ip address 100
set interface Serial1/0
!
route-map mhm20 permit 10
set default interface Serial1/0 <<- for other traffic is the default via ISP1 is down then use ISP2

belemdavidarmand · ‎04-17-2023

Hello @MHM Cisco World ;

Sorry for the late. I want to know about this command:

ip nat inside source route-map mhm10nat interface Serial1/0 overload <<- NAT with route-map
ip nat inside source route-map mhm20nat interface Serial1/1 overload <<- NAT with route-map
ip route 0.0.0.0 0.0.0.0 Serial1/1 track 1 <<- ISP1
ip route 0.0.0.0 0.0.0.0 Serial1/0 100 <<- ISP2
ip route 110.0.0.3 255.255.255.255 Serial1/1 permanent <<- this for track ISP1
!
ip sla 1
icmp-echo 110.0.0.3 source-interface Serial1/1
ip sla schedule 1 life forever start-time now
access-list 1 permit 10.0.0.0 0.0.0.255 <<- this for??
access-list 1 permit 20.0.0.0 0.0.0.255<<- this for??
access-list 100 permit ip 10.0.0.0 0.0.0.255 any <<- traffic want to shift to ISP2 (office ip address list replace the "any"?
no cdp log mismatch duplex
!
!
!
!
route-map mhm20nat permit 10
match interface Serial1/1
!
route-map mhm10nat permit 10
match interface Serial1/0
!
route-map mhm10 permit 10<<-where this route is been used??
match ip address 100
set interface Serial1/0
!
route-map mhm20 permit 10<<-where this route map is bee used ??
set default interface Serial1/0 <<- for other traffic is the default via ISP1 is down then use ISP2

MHM Cisco World · ‎04-17-2023

sorry can you make your Q with red colour I confuse
thanks
MHM