Load Balanced for Intranet & Internet over two ISPs.

[mis.network]

Hi Team, For my Remote office, I have two Routers each have separate ISP & IPSEC to my Data-center. Both Routers configured in HSRP. ACL is applied to define interesting traffic for IPSEC. I want to route IPSEC/Internet traffic over my Primary ISP/Router & Web traffic over my Secondary ISP/Router. I did try to add static routes on Secondary Active Router to send all intranet traffic to Primary Standby Router, which then go to Data-center via IPSEC but still its going over secondary ISP only. I have attached NW Diagram for Ref. Pls Suggest any hack which can be done on it.

[marce1000]

 - It's usually difficult to do this with layer2 and routing protocols (only). Better is to look into firewalls which offer more flexible solutions at the application level and or policy based routing (PBR).

 M.

[mis.network]

That has been implemented but this is small office & not have other alternative.

[Richard Burts · Accepted solution]

I do not understand clearly what you are attempting to accomplish when you say " IPSEC/Internet traffic over my Primary ISP/Router". You have vpn tunnels on both routers so it seems you would want IPSEC over both ISP. And when you say "web traffic" over second ISP does that mean all web traffic (both to internal LAN at HQ and web to Internet) or what? Can you provide clarification?

HTH

Rick

[mis.network]

Hi Richard,

Apologies for the confusions.

1. Route Intranet/IPSEC traffic over Primary ISP, No web traffic.

2. Router Web Traffic only to Secondary ISP.

[Richard Burts]

I am still confused. When you say "Route Intranet/IPSEC traffic over Primary ISP, No web traffic." Assuming that you have a web server in the LAN at HQ and a user at the remote site wants to access web pages on that server, would that traffic be treated as Intranet and routed through the first ISP or treated as web traffic and routed through the second ISP?

When you say " Router Web Traffic only to Secondary ISP." Is your reference about web traffic attempting to say all Internet traffic or does it really mean HTTP/HTTPS traffic. What about things going to Internet that are not HTTP/HTTPS (for example DNS requests)? How should they be forwarded?

HTH

Rick

[mis.network]

OK , let me go in details.

My private subnets like 192.168.XX.XX/24 & 10.64.XX.XX/24, traffic for those subnets goes via IPSEC & it has to go over ISP-1 only.

Rest of the web traffic, any request should go via ISP-2.

Hope this would help to understand the exact requirement.

[Giuseppe Larosa]

Hello mis.network,

>> My private subnets like 192.168.XX.XX/24 & 10.64.XX.XX/24, traffic for those subnets goes via IPSEC & it has to go over ISP-1 only

According to your network diagram you have internal devices in the LAN, those devices should use specific static routes or PBR to send intranet traffic directly to the IP address of the router connected to ISP1.

A default route pointing to the IP address of the second router that connects to ISP2 should make internet traffic to go to ISP2.

This however does not provide redundancy in case of failure of ISP1 link or R1 router or in case of failure of ISP2 link/R2 what you would like to do?

To provide failover you should use two different HSRP groups one where the active router is R1 with its VIP address to be used as next-hop for specific routes / or PBR (Policy Based Routing) the other HSRP group VIP2 would provide the next-hop for the default route (you need also NAT configuration ) with R2 being the active router for HSRP VIP2.

You should track the status of each WAN link on each group.

Note: all these configurations should be done on internal devices before packets enter one of the border routers, otherwise you cannot achieve the desired results because there is an order in processing so in your attempt the static routes from R2 to R1 may be ineffective because packets are processed by IPSEC VPN on R2 before attempting to route them.

This is the reason for moving the decision to internal devices that do not perform NAT or IPSEC.

Hope to help

Giuseppe

[Richard Burts]

There are some inconsistencies in what you describe and these make it hard for us to give you good advice. For example in the original post you tell us "I have two Routers each have separate ISP & IPSEC to my Data-center" But if rt02 is just forwarding Internet traffic (web traffic) then why does it need an ipsec site to site vpn?

Am I correct in understanding that your requirement really is that all traffic from your remote LAN to the HQ LAN should go through rt01 to ISP 1 using ipsec vpn to get to HQ and that all other traffic from your remote LAN should go through rt02 to ISP 2 to Internet? If so there is a reasonable simple solution for that. rt01 should have a route for the HQ LAN that sends its traffic to ISP 1 using the ipsec vpn and rt01 should have a default route for all other traffic that has rt02 inside interface as its next hop. rt02 should have a route for the HQ LAN that has rt01 inside interface as its next hop and should have a default route for all other traffic with ISP 2 as its next hop. If my understanding is not correct then please provide clarification.

HTH

Rick

[mis.network]

Rick,

You did my point.

I did work for Internet traffic but request to HQ LAN also going to RT02 as default route is set as inside IP of RT02.

[Richard Burts]

I am not clear about your recent response. If request to HQ LAN is forwarded to rt02 then I would ask you to post the output of show ip route from rt01 so that we can check whether that router has a route for the HQ LAN with next hop of ISP 1.

HTH

Rick

[mis.network]

You can use either IPSLA or any dynamic routing protocol to have the auto failover between ISP on Rotuer connected

would suggest to go with IPSLA which is simpler and easiest for the smaller network.

[mis.network]

How is that possible for IPSEC traffic & Web traffic?