QoS question on Cisco Router 891-K9

[keith-mk-li]

Dear All, 

           I have a question would like to ask regarding on the QoS on the Cisco router model 881-SEC-K9, we have 2 circuits in the office, primary circuit connect to Cisco router 891-K9 and backup circuit connecting to backup router 881-SEC-K9, QoS has been configured on both router if traffic towards apple server for apples devices for IOS update, and we found that apple server already changes their IP, and traffic for IOS update will switch back to the primary circuit, just wonder if there is any method to prevent traffic toward apple server to the primary circuit ? any help would be appreicated 

Keith 

[Joseph W. Doherty]

Assuming you've been matching against Apple server's IP, if you can identify the same traffic using other attributes, that would address your problem.  Can you?  I don't know, but it's a possiblity I suspect.

[keith-mk-li]

since apple doesn't provide specific IP addresses for doing the IOS update, i can not point the specific destination IP to switch to the backup circuit, as i know this router doesn't have the application feature, it has to use ip addresses, just wonder if there is a better method to achieve ? 

[Giuseppe Larosa]

Hello @keith-mk-li ,

the Apple service is likely in cloud and load balancing may be performed using DNS. If you know the URL of the update server you can try to make several nslookup of the URL to find out multiple public IP addresses.

However, the list of IP addresses can change over time so you would need to make DNS queries and to update your ACLs used in PBR configuration.

Hope to help

Giuseppe

[Joseph W. Doherty]

So, no way to identify this traffic by protocol and/or port numbers?

How do you identify this traffic now?

How do you, now, direct this traffic to a secondary path?

BTW, how important is separating traffic to different paths vs. using QoS to manage bandwidth on one or both paths?  (Also BTW, without QoS, what happens if either path fails?)

[paul driver]

Hello
currently how are you performing this traffic manipulation as based on the rtr model these are BB rtrs connected to internet facing isp circuits-if so it suggests your rtrs receiving dynamic ip allocation from the isps 

are you performing any network translation?