Load Sharing When Dual-Homed to One ISP with 2x 2821 and 2x Pix 515e

[mismtk2007]

We are in the process of setting up eBGP and iBGP between our datacenter and Verizon internet services. We will have 4x T1s (2x 3.0mbit) two connected to VZ in Dallas and two connected to VZ in KC. This gives us diverse paths to the internet so if VZ has an issue we aren't dead in the water (has happened before). VZ is handling everything on their side and will setup our IP block to be available from either side but we want to load share and need complete failover. What we plan to do is split our IP block in half xxx.xxx.xxx.1-126 going to Dallas and xxx.xxx.xxx.128-254 going to KC.

I've reviewed this page: http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml and it looks exactly like what we want to do except it doesn't go beyond our routers to what our firewall portion should look like. That is where I need some help. We currently have two Pix 515e firewalls running in a Active/Standby failover pair (running 7.2) that have to NAT traffic from outside IPs to internal hosts. Right now it is configured with a simple 0.0.0.0/0.0.0.0 default gateway that points to one of our two 2821 routers but that will all change with the new BGP stuff. How can I do this? All help is greatly apprecaited.

[msdesai]

Hi,

You will need to configure HSRP between two 2821 router (tracking the WAN interface).

Please refer to below link

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094e8c.shtml

PIX will have the default route pointing to the HSRP virtual IP address.

HTH

MD

[mismtk2007]

Would HSRP in that case allow both routers to send traffic at the same time (load sharing)? I thought it only worked where primary router passes all traffic until its link is down then the other router kicks in. If I'm wrong I think that's a good solution but my understanding was HSRP didn't accomplish load balancing/sharing.

[msdesai]

Hi

You are right, HSRP provides fault-tolerant. I assumed that you were going to run the ibgp between two 2821 routers which will provide the load sharing between two internet connection.

HSRP help you simplfiy the configuration for PIX since you will only need one default route pointing to the virtual IP address and by running ibgp between two routers (shareing the routing information) you will be able to Achieve the load sharing between two internet connection.

HTH

MD

[mismtk2007]

I'm not opposed to running HSRP on the routers, and yes I believe the plan is to run iBGP between the two 2821s. I was under the impression that the HSRP link would always point traffic to R1 and then if R1 failed always point traffic to R2.

If I understand what you're saying then that wouldn't matter because even if it is pointing all the traffic to R1, R1 and R2 have iBGP load sharing that will send the traffic where it needs to go regardless of which router it came to originally?

[msdesai · Accepted solution]

Hi

If I understand what you're saying then that wouldn't matter because even if it is pointing all the traffic to R1, R1 and R2 have iBGP load sharing that will send the traffic where it needs to go regardless of which router it came to originally?

Yes, that?s correct.

As you mention previously that you are reviewing the below document (which will take care of load sharing)

Load Sharing When Dual-Homed to One ISP through Multiple Local Routers

http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml

HTH

MD

[mismtk2007]

Thanks for your replies! Would I want to do this:

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094e8c.shtml

plus this:

http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml

Thanks again!

[msdesai]

Hi

You are welcome.

??Would I want to do this? http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094e8c.shtml

My recommendation would be to use the standby preempt and standby track unless you don't have any preference on which router becomes primary and secondary. Also it helps in case when R1 is primary and WAN (Internet) connection on R1 goes down, all traffic will go through R1--- >R2--- >Internet but if you were using standby tracking on R1 as soon as WAN goes down, R2 will become primary and all traffic will flow R2--- >Internet.

??http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml :Load Sharing When Dual-Homed to One ISP Through Multiple Local Routers

With AS-path prepend you will have more control over inbound traffic (inbound policy) and load sharing between two internet connection.

HTH

MD

[mismtk2007]

Our ISP has raised the question about load balancing with failover on the HSRP portion I'm going to copy/paste the question from them:

"Will the default routes learned via iBGP be as attractive (different admin distances) as those learned via eBGP, if not then they may not get installed in the routing table for the purpose of load sharing. They'll provide failover, but they may not work for load sharing.

Wouldn't you have to manually load share by splitting the address space, setting up two HSRP groups on the Internet edge routers, track on the MLFR interfaces, and making each FW the failover for the other?"