Access List or Route Map???

[Rich davis II]

I saw this issue at work and I'm trying to duplicate it on my home lab... I'm a little confused on if I should use an access list, route map, or something else. From the point of view of Host C1 or C2, if packets going to Internet, I would want it to go thru R2. If packets are internal traffic (EIGRP 100 OR 200), I want the packets to go thru R3 (i'll be adding another internal network attached to R1).  If a link goes down and HSRP takes over, I would want the internal or external route to go thru whichever route is up. How would I accomplish this? (Thank you in advance for any help)

As of now, all traffic is going thru R3.

[Jon Marshall]

So R3 is the HSRP active router ?

If so, unless you add specific routes on the PCs,  the only way to do this is to use PBR on R3 to send the traffic back to R2. This means traffic has to enter and exit the same interface which may or may not work (i have seen both).

So you can try it. I am assuming these are actual routers because if they are L3 switches then there are certain restrictions with PBR ie.

1) you need a certain license to run PBR

2) not all PBR commands are supported

3) using things like deny lines in the acl means the packets are then software switched which is not good on a L3 switch

So to configure PBR you need to know the internal subnets and your config would look like -

access-list 101 deny ip 50.50.50.0 0.0.0.255 <internal subnet> <wildcard mask>

etc. ie you need a line for each internal subnet

access-list 101 permit ip 50.50.50.0 0.0.0.255 any

route-map PBR permit 10

match ip address 101

set ip next-hop 50.50.50.2

then on R3 on the 50.50.50.3 interface you need to apply the route map ie.

int <int/number>

ip policy route-map PBR

what the above does is when traffic goes to R3 which it will because it is HSRP active R3 should then send any traffic with a destination that is not an internal network to R2.

Note also return traffic could go either way ie. to R2 or R3. If you want it to go back to R2 then you could NAT all traffic to the 12.12.12.x address as it goes out to the internet so it is always returned to the R2 and not R3.

Note that the above is not really good design but it is the only real way to do it with the network setup you have.

Jon

[Rich davis II]

@Jon, I'm pretty limited on the equipment I have at home but what would make this a better design?

[Jon Marshall]

Just to let it route normally really.

Bear in mind all traffic might go via R3 but return traffic could go via either router.

Looking at your setup a possible alternative would be to -

1) connect SW3 to both R2 and R3 (if you have the spare interfaces)

2) run GLBP on the routers

and then just let it route naturally.

Another option may be, if possible, to have a direct connection between R2 and R3 and use PBR so at least the traffic did not have to enter and exit the same interface on R2.

Probably the most common approach would simply be to have L3 switches in place of the routers and then all access switches are then dual connected to both L3 switches. The L3 switches could be interconnected via a trunk, a stacked set of switches or for larger environments 4500/6500 running VSS.

Whatever you do the basic principle is to let things route naturally if at all possible and only use things like PBR for the exceptions. It keeps things simple which is always a good approach.

There are times however when you need to influence certain traffic flows and you may have good reasons for what you are trying to do so i'm not saying you definitely shouldnt do it, just that looking at the setup i'm not sure it is worth the added complexity.

Jon

[Rich davis II]

I see what you mean with the placement of SW3. I just placed that there to have another internal network. To accomplish what i'm looking for I will probably place it on R1 for the time being. This is definitely a work in progress.

[Jon Marshall]

If you place it on R1 then it would make sense to use GLBP assuming that R2 and R3 are actually routers and traffic would then be relatively evenly load balanced.

Just be aware that attaching it to R1 means there is an addtional single point of failure ie. R1 fails and then so does access to the 60.60.60.0/24 subnet.

So if you did have a spare interface on R2 it would be more redudant to connect SW3 to both routers (R2 and R3).

Jon