Two Different ISP Load Balancing - Active/Active

[seongmin]

Hi.
We want to build a network like an example.

I have 2 different ISPs, 2 C9300-24T-A L3 switches and 2 firewalls at the bottom.

By the way, the customer wants to connect two L3 switches to the ISP and have an active/active configuration.

But I don't want the way I use BGP because I have to pay for the AS number and get it allocated.

I want to do load balancing in an active way, is there any way?

Please give me a good idea.

And I'd appreciate it if you could give me an example config.

I'm searching for several protocols such as GLBP and IP SLAs, but it's too hard to know how to configure them.

[M02@rt37]

Hello @seongmin 

You can leverage GLBP and IP SLA on your C9300 L3 switches.

By configuring GLBP on both switches, you ensure that internal traffic is distributed evenly, and in case one link fails, the other can take over seamlessly. Additionally, IP SLA can be used to monitor the status of each ISP link. This setup allows the network to dynamically adjust the routing based on the availability and reachability of the links, ensuring continuous service without the need for a dedicated AS number and BGP configuration.

The configuration involves setting up GLBP on both switches to manage the gateway IP address and distribute the traffic. You also configure IP SLA to perform periodic checks (such as ICMP echo requests...) to external IP addresses, ensuring that each ISP link is operational. Tracking objects linked to these IP SLA operations allow you to adjust the GLBP weighting dynamically, ensuring that traffic is routed through the optimal path.

This approach provides a cost-effective and efficient way to achieve load balancing and redundancy, meeting the customer's requirement for an active/active configuration without the complexity and expense of BGP. 

Example:

Switch 1:
interface Vlan10
ip address 192.168.1.2 255.255.255.0
glbp 1 ip 192.168.1.1
glbp 1 priority 110
glbp 1 preempt
glbp 1 load-balancing weighted
glbp 1 weighting 100
glbp 1 weighting track 1 decrement 20
track 1 ip sla 1 reachability
!
ip sla 1
icmp-echo 8.8.8.8 source-interface Vlan10
frequency 10
!
ip sla schedule 1 life forever start-time now
track 1 ip sla 1 reachability
ip route 0.0.0.0 0.0.0.0 192.168.1.2 track 1
ip route 0.0.0.0 0.0.0.0 192.168.1.3 5

Switch 2:
interface Vlan10
ip address 192.168.1.3 255.255.255.0
glbp 1 ip 192.168.1.1
glbp 1 priority 100
glbp 1 preempt
glbp 1 load-balancing weighted
glbp 1 weighting 100
glbp 1 weighting track 1 decrement 20
track 1 ip sla 2 reachability
!
ip sla 2
icmp-echo 8.8.4.4 source-interface Vlan10
frequency 10
!
ip sla schedule 2 life forever start-time now
track 1 ip sla 2 reachability
ip route 0.0.0.0 0.0.0.0 192.168.1.3 track 1
ip route 0.0.0.0 0.0.0.0 192.168.1.2 5

[seongmin]

Thanks your help.

I try it.

[seongmin]

Do I need a nat setting when I set it to this configuration?

[M02@rt37]

@seongmin 

Since you go through ISP, yes you need NAT. Check with ISP the prerequisites.

[seongmin]

Thank you.
Let me set up Nat on isp interface and internal interface.

[MHM Cisco World]

we start from GW of Host in build the network 
are FW run HA or it standalone ?

MHM

[seongmin]

HA

fw engineer said 

ACTIVE ACTIVE MODE

[MHM Cisco World]

active active mode in ASA it called multi context i.e. you can have multi default route run in same FW HA
this for traffic from FW to ISP the return traffic need also two static route toward FW one static route with high AD 
I prefer hrsp to eliminate the asymmetric routing 

[MHM Cisco World]

[seongmin]

Oh, thank you for the detailed explanation

[Giuseppe Larosa]

Hello @seongmin ,

if your switches are the internet edge devices that connect to the two ISPs , GLBP is not helpful as the only "clients " are the two firewalls.

GLBP is effective on internal switches on user facing VLANs because GLBP load balancing is simply answering to ARP requests for the default gateway with a different virtual MAC address and this means it works only where there are many clients.

The configuration provided by M02@rt37  can be used on internal switches that are downstream the Firewalls.

Between the L3 switches and the FWs you can use HSRP groups as  suggested by @MHM Cisco World 

Hope to help

Giuseppe