04-18-2017 03:18 PM - edited 03-05-2019 08:22 AM
Hello,
(Topology diagram attached)
I have five sites all connected via a Layer-2 Metro-E solution. Each site has a Cisco 3750 Layer-3 switch that terminates the connection to the Metro-E and provides the local LAN at each site. All of the 3750s are configured to run OSPF. All of the interfaces facing the Metro-E are on a 10.100.100.x/24 scheme and configured for OSPF Area 0. The LAN facing interfaces are all configured for OSPF and their respective Area numbers (ie, Site 1 - Area 1, Site 2 - Area 2, etc.) All of this has been configured for a while now and has been working without any issues.
In addition to the Layer-3 3750s attached to the Metro-E, we also have two sites that have Internet connections from the same ISP but using different routeable IP blocks. Each Internet connection is protected by a SonicWall NSA appliance and the SonicWalls have been configured to participate in the OSPF routing scheme. Because the SonicWalls have a static default route and since they can intelligently detect whether or not the Internet connection is up, I have the SonicWalls configured for OSPF Default Information Originate. Thus far, I have configured the SonicWalls in an Active/Passive setup by weighting the default route in Site 2 higher than Site 1. So currently, under normal conditions, all sites access the Internet via the SonicWall in Site 1 and if that connection fails, all sites intelligently fail over to the Internet/SonicWall in Site 2. When Site 1 Internet is restored, all sites revert back to the Internet/SonicWall in Site 1.
At this point, we want to explore the possibility of using both Internet/SonicWalls simultaneously. For example, we would probably want Sites 1, 3, and 5 to all use the Internet/SonicWall in Site 1 while Sites 2 and 4 use the Internet/SonicWall in Site 2. And then if one Internet connection should fail, we would want all sites to use the remaining Internet connection the way we currently have things configured. The organization does host some internal resources that are reachable from the Internet via Site 1 but for this solution, we aren't worried about trying to have that inbound traffic fail over to Site 2. We are strictly interested in utilizing both Internet connections simultaneously for outbound traffic.
Since I have the network successfully using one Internet connection or the other, I feel like I am close to being able to use both connections simultaneously but I am unsure how to accomplish it. If I have both SonicWalls do default information originate with equal weighting, I'm thinking Site 2 would start using the Site 2 Internet connection but I don't think Site 4 would automatically know to use that one over Site 1.
Thank you very much for reading this post!
Daniel
04-19-2017 01:01 AM
Hi
it depends on what way site 4 is seeing the routes for site 1 or 2 , if there equal it will try an push out both as its ospf default it wont chose one or the other , if the metrics are not exact it will only chose 1 anyway , you could always manipulate the traffic using cost in site 4 or user pbr with ip sla and set the next hop verify reachability and get it to change its path say if either ISP link failed to bounce out the other ISP
04-19-2017 03:07 AM
You can try the below after removing the Cost in default routes.
default-information originate always route-map Route_Bal
route-map Route_Bal permit 10
match ip address prefix-list <list of site 1,4,5 subnets>
set ip next-hop <isp1_gateway>
match ip address prefix-list <list of site 2 and 3 subnets>
set ip next-hop <isp2_gateway>
Please let me know if it works.
Regards
Shankar
04-20-2017 10:28 PM
We can also try all 1,4,5 ABR the below , here isp 1 is prefeered and if it goes will try isp2 if both are down it will stop injecting default route.
default-information originate always route-map Route_Bal
route-map Route_Bal permit 10
match ip address prefix-list <isp1_gateway>
match ip address prefix-list <isp2_gateway>
and on all all 2,3 ABR the below. Here isp2 is preffered, and if it goes down isp1 and if both are down it will stop injecting default route.
default-information originate always route-map Route_Bal
route-map Route_Bal permit 10
match ip address prefix-list <isp2_gateway>
match ip address prefix-list <isp1_gateway>
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide