cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
2465
Views
0
Helpful
1
Replies
Highlighted
Beginner

Problem: IP SLA - WAN Auto Failover - Single router with three Interfaces ( LAN, WAN1, WAN2)

I have a problem with my IP sla on a router with two ISPs (ISP A and ISP B). A= boradband, B= T1. I have tested the failover in the past by disabling the primary interface and it worked. Yesterday ISP A went down partially and the failover to T1 didin't happened. Maybe because the tracking was done on ISP A gateway and that IP was reachable even though the ISP A was down.

I have made some modification to my config to see if I can fix this, but it looks like unless I specify a static default route with no tracking option to my ISP A, the traffic keep going through T1.  In my current config, I have added an "P local Policy Route-MAP" and I also changed the IP being tracked to my ISP's DNS address.

Someone please review my attached config and advise what is wrong with my config. Thanks,

Shuja

############################################################

term len 0

TQI-WN-RT2911#sh run

Building configuration...

Current configuration : 7720 bytes

!

! Last configuration change at 20:54:18 UTC Sun Oct 28 2012 by admin

! NVRAM config last updated at 20:54:18 UTC Sun Oct 28 2012 by admin

! NVRAM config last updated at 20:54:18 UTC Sun Oct 28 2012 by admin

version 15.1

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

!

hostname TQI-WN-RT2911

!

boot-start-marker

boot-end-marker

!

!

logging buffered 51200 warnings

!

aaa new-model

!

!

aaa authentication login default local

aaa authorization exec default local

aaa authorization network default local

!

!

!

!

!

aaa session-id common

!

!

no ipv6 cef

ip source-route

ip cef

!

!

!

ip dhcp remember

!

!

ip domain name TQI.com

!

multilink bundle-name authenticated

!

!

crypto pki token default removal timeout 0

!

crypto pki trustpoint TP-self-signed-2562258950

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-2562258950

revocation-check none

rsakeypair TP-self-signed-2562258950

!

!

crypto pki certificate chain TP-self-signed-2562258950

certificate self-signed 01

  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030

!

!

username admin privilege 15 password 7 141F13050806sdfds25242F

!

redundancy

!

!

!

!

!

track 1 ip sla 1 reachability

delay down 10 up 20

!

!

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

crypto isakmp key ############ address 173.161.255.241 255.255.255.240

!

crypto isakmp client configuration group EASY_VPN

key $#############

dns 10.10.0.241 10.0.0.241

domain ttqi.com

pool EZVPN-POOL

acl VPN+ENVYPTED_TRAFFIC

save-password

max-users 50

max-logins 10

netmask 255.255.255.0

crypto isakmp profile EASY_VPN_IKE_PROFILE1

   match identity group EASY_VPN

   client authentication list default

   isakmp authorization list default

   client configuration address respond

   virtual-template 1

!

!

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

!

crypto ipsec profile EASY_VPN_IPSec_PROFILE1

set security-association idle-time 86400

set transform-set ESP-3DES-SHA

set isakmp-profile EASY_VPN_IKE_PROFILE1

!

!

crypto map VPN_TUNNEL 10 ipsec-isakmp

description ***TUNNEL-TO-FAIRFIELD***

set peer 173.161.255.241

set transform-set ESP-3DES-SHA

match address 105

!

!

!

!

!

interface Loopback1

ip address 10.10.30.1 255.255.255.0

!

interface Tunnel1

ip address 172.16.0.2 255.255.255.0

ip mtu 1420

tunnel source GigabitEthernet0/0

tunnel destination 173.161.255.241

tunnel path-mtu-discovery

!

interface Embedded-Service-Engine0/0

no ip address

shutdown

!

interface GigabitEthernet0/0

description Optonline  WAN secondary

ip address 108.58.179.205 255.255.255.248 secondary

ip address 108.58.179.202 255.255.255.248

ip nat outside

ip virtual-reassembly in

duplex auto

speed auto

crypto map VPN_TUNNEL

!

interface GigabitEthernet0/1

description T1 WAN Link

ip address 64.7.17.100 255.255.255.240

ip nat outside

ip virtual-reassembly in

duplex auto

speed auto

!

interface GigabitEthernet0/2

description LAN

ip address 10.10.0.1 255.255.255.0 secondary

ip address 10.10.0.3 255.255.255.0

ip nat inside

ip virtual-reassembly in

duplex auto

speed auto

!

interface Virtual-Template1 type tunnel

ip unnumbered Loopback1

tunnel mode ipsec ipv4

tunnel protection ipsec profile EASY_VPN_IPSec_PROFILE1

!

!

router eigrp 1

network 10.10.0.0 0.0.0.255

network 10.10.30.0 0.0.0.255

network 172.16.0.0 0.0.0.255

!

router odr

!

router bgp 100

bgp log-neighbor-changes

!

ip local policy route-map IP-SLA-ROUTE-POLICY

ip local pool EZVPN-POOL 10.10.30.51 10.10.30.199 recycle delay 65535

ip forward-protocol nd

!

ip http server

ip http access-class 23

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

ip nat inside source route-map OPTIMUM-ISP interface GigabitEthernet0/0 overload

ip nat inside source route-map T1-ISP interface GigabitEthernet0/1 overload

ip nat inside source static tcp 10.10.0.220 3389 64.7.17.100 3389 extendable

ip nat inside source static tcp 10.10.0.243 25 108.58.179.202 25 extendable

ip nat inside source static tcp 10.10.0.243 80 108.58.179.202 80 extendable

ip nat inside source static tcp 10.10.0.243 443 108.58.179.202 443 extendable

ip nat inside source static tcp 10.10.0.220 3389 108.58.179.202 3389 extendable

ip nat inside source static tcp 10.10.0.17 12000 108.58.179.202 12000 extendable

ip nat inside source static tcp 10.10.0.16 80 108.58.179.205 80 extendable

ip nat inside source static tcp 10.10.0.16 443 108.58.179.205 443 extendable

ip nat inside source static tcp 10.10.0.16 3389 108.58.179.205 3389 extendable

ip route 0.0.0.0 0.0.0.0 108.58.179.201 track 1

ip route 0.0.0.0 0.0.0.0 64.7.17.97 100

!

ip access-list extended VPN+ENVYPTED_TRAFFIC

permit ip 10.10.0.0 0.0.0.255 any

permit ip 10.0.0.0 0.0.0.255 any

permit ip 10.10.30.0 0.0.0.255 any

!

ip sla 1

icmp-echo 167.206.112.138 source-interface GigabitEthernet0/0

threshold 100

timeout 200

frequency 3

ip sla schedule 1 life forever start-time now

access-list 1 permit 10.10.0.0 0.0.0.255

access-list 2 permit 10.10.0.0 0.0.0.255

access-list 100 permit ip 10.10.0.0 0.0.0.255 any

access-list 101 permit icmp any host 167.206.112.138 echo

access-list 105 remark ***GRE-TRAFFIC TO FAIRFIELD***

access-list 105 permit gre host 108.58.179.202 host 173.161.255.241

!

!

!

!

route-map T1-ISP permit 10

match ip address 100

match interface GigabitEthernet0/1

!

route-map OPTIMUM-ISP permit 10

match ip address 100

match interface GigabitEthernet0/0

!

route-map IP-SLA-ROUTE-POLICY permit 10

match ip address 101

set ip next-hop 108.58.179.201

set interface Null0

!

!

!

!

!

control-plane

!

!

!

line con 0

line aux 0

line 2

no activation-character

no exec

transport preferred none

transport input all

transport output pad telnet rlogin lapb-ta mop udptn v120 ssh

stopbits 1

line vty 0 4

privilege level 15

transport input telnet ssh

line vty 5 15

privilege level 15

transport input telnet ssh

!

scheduler allocate 20000 1000

end

TQI-WN-RT2911#

######################################################################

1 REPLY 1
Advisor

Problem: IP SLA - WAN Auto Failover - Single router with three I

Hi,

1)of course you need a secondary floating static route to switch traffic out to when primary goes down

2)

route-map IP-SLA-ROUTE-POLICY permit 10

match ip address 101

set ip next-hop 108.58.179.201

set interface Null0

With this config you are dropping your IP SLA probes so your track object will always be down ,so the primary route will never get installed and you will always use the secondary route even if ISPA is functional.

In your IP SLA you should ping an external address not the gateway from ISPA because the Gateway may be UP but it doesn't mean that it can forward your traffic to destination if there is a problem upstream.

With the source-interface configured in your IP SLA config you shouldn't need this local PBR anyway and you can also configure a static host route going through Primary for the external address you are monitoring if you want to replace the PBR too.

Regards.

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards