No aceess to both WAN links simultaneously

[Jaaazman777]

Hello everyone!

We suffer some problems with our remote 2811, that has two WAN links (two different ISP) - we cannot get access to both of WAN at the same time.

At first, the aim was to load balance the traffic between wan links:

• at first we tried to use OER, but users complained about instable internet connection
• then we tried PBR + NAT

Generelly we have just the same scheme as https://supportforums.cisco.com/docs/DOC-8313 :

• dual WAN links
  • PPTP
  • PPPoE over ADSL
• equal static routes
• NAT using route map

The problem itself:

• When both links are up,  the 1st WAN is pingable, and the 2nd is not
• When the 1st link goes down the 2nd becomes pingable and accessible and vice versa
• When I disabled the CEF, the 1st was still pingable and the 2nd became pingable too, but very unstable

What can cause such situation?

[paolo bevilacqua]

Try  updating IOS.

[Juan Perez]

CEF will load balance using a per-destination fashion therefore packets are forwarded towards the same path to a single destination, you can try changing it to per-packet but you should consider out of order packets.

I hope this is useful.

[Jaaazman777]

Juan Perez

There is the voice trafiic travelling across the links, that's why per-packet cef balance may harm its quality.

Generally, what else can cause such kind of problem?

here is the part of the config:

interface Dialer1
description ADSL
mtu 1492
bandwidth 1000
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username <***> password <***>
crypto map vpn-out
!
interface Dialer2
mtu 1460
bandwidth 500
ip address negotiated
ip pim dense-mode
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer in-band
dialer idle-timeout 0
dialer string 123
dialer vpdn
dialer-group 2
no peer neighbor-route
no cdp enable
ppp pfc local request
ppp pfc remote apply
ppp encrypt mppe auto
ppp authentication chap callin
ppp eap refuse
ppp chap hostname <***>
ppp chap password <***>
ppp ms-chap refuse
ppp ms-chap-v2 refuse
ppp pap refuse
crypto map vpn-out
!
ip route 0.0.0.0 0.0.0.0 Dialer1 track 10
ip route 0.0.0.0 0.0.0.0 Dialer2 track 20
ip route *pptp-server-ip* *pptp-server-mask* *local-pptp-gw*
!

*track 10 and track 20 make the dicisions according to interface line-protocol
and reachability of the gateways