Dynamic Routing Approach between Core-Switch and WAN-Routers

[whistleblower14]

Hi,

I`ve a design or let`s say an implementation question regarding the attached approach!

Two routers (one acting as primary and the other as backup only) are connected to core switches via different routed ports each. Both Core-Switches act as the default gateway (/ w HSRP / VRRP) for the LANs behind! So far so good...

I`d like that - if available - the primary connection is always preferred no matter which of the Core switch is active as LAN gateway! I assume that this can be done with a dynamic routing protocol (e.g. OSPF) and would like to hear from someone with experience his approach for better understanding!

thank you very much in advance for any kind of help!

[Georg Pauwen]

Hello,

without seeing the actual configs, since you are using HSRP on the core switches, you could configure an IP SLA on the core switch connected to the primary router and track that object in your HSRP interface configuration. If the SLA is down, the HSRP priority would decrement, and the other switch would become the active HSRP switch.

Post the running configs of all 4 devices, to get a better understanding of what your setup looks like.

[balaji.bandi]

That is the standard approach yes HSRP if you looking for active/standby and failover with IP SLA tracking.

In some use cases, the contract with ISP was Active / Standby you can not use both the link same time.

If you purchased 2 different ISP, you can also utilize both links by distributing the load across each other (maybe not sure is this requirement, just want to mention, so you can justify the cost of utilizing both the links)

[Jon Marshall]

If you want the primary connection to always be used no matter which core switch is HSRP active then not convinced IP SLA on the core switch(es) is the way to go especially as each core switch has connections to both routers. 

Are your WAN routers receiving routes from the ISP(s) because a lot depends on that. 

If they are you can probably pass them on while modifying the metrics to prefer the primary, if they aren't you may be able to generate your own defaults on the WAN routers again using metrics to prefer the primary and use IP SLA on the primary WAN router to track the state of that link. 

Jon

[Giuseppe Larosa]

Hello @whistleblower14 ,

I agree with @Jon Marshall if you use OSPF you can generate a default route with a lower seed metric on primary router like 50 and a default route with a seed metric of cost 500 on the secondary router.

Using O E1 type allows to add internal metrics to seed metric and it is preferred over ( O E2 the default external type).

So another possible option would be to use O E1 on primary router and O E2 on secondary router.

A route-map can be used on each router to check that a BGP route with a specified next-hop is present in the routing table this allows to check the good health of the eBGP session with ISP ( if present). Otherwise you can use on primary router an IP SLA to check its exit link is working.

the route-map should check

access-list 11 permit host <ISP-next-hop-address>

ip prefix-list DEFAULT permit 0.0.0.0/0

route-map CHECK-EBGP permit 10

match address prefix DEFAULT

match ip next-hop 11

set metric type 1

set metric 50

router ospf 10

default-information originate route-map CHECK-EBGP

under the idea of receiving an eBGP default route from host specified in ACL 11.

Hope to help

Giuseppe

[Joseph W. Doherty]

Since your routing between the L3 core switches and the routers, and have two paths (direct switch<>router link and switch<>switch<>router links) from each core switch to each router, which core switch is the active gateway doesn't really matter.  You just need to insure both paths to one router is the "better" path, cost wise, for the IGP being used.

[whistleblower14]

---

@Joseph W. Doherty wrote:

 You just need to insure both paths to one router is the "better" path, cost wise, for the IGP being used.

---

OK - that`s the point, how could this configuration look like when using e.g. OSPF?

[Joseph W. Doherty]

Assuming, in your diagram, your primary router is the left router, cost the two interfaces connecting to it (from the two L3 switches) as 1.  Cost the two interface connecting to the right router (again from the two L3 switches) as 10000.  See if that does it (whether it does, or not, will also depend on how your other interfaces are costed).

[whistleblower14]

ok, so I´ve to use for each link e.g. a /30 IP-Subnetwork as well?

How could this look like when both core switches run in an VSS with SVI`s instead of dedicated routed interfaces - should I use 2 Vlans with a larger IP-Subnet?

[Joseph W. Doherty]

If the L3 core switches are running as a VSS pair, and still assuming your links to the routers are routed ports, as noted in OP, same applies.  I.e. cost the links to the one router more than the other, so as long as you have any link to that router, OSPF will see such links as the better path.

Where VSS changes things, assuming you set both links to the same router as the same cost, OSPF would see that as ECMP, but VSS will always use a link on the current platform avoiding sending traffic across the ISL link(s).

As a routed p2p link, normally, yes, /30s might be used, or with later OSPFs, /31s, but larger network blocks would also work although a waste of address space.

Unclear, to me, how you want to use SVIs in a VSS setup.  If you both routers are in the same VLAN, you won't be able to cost them differently.  Further, if you have try to place both of the same router's links in the same VLAN/network, the router will disallow that.

[MHM Cisco World · Accepted solution]

VSS or MLS it same except some different.
1-VSS & MLS router port connect to router 
 
from VSS1 to Router1 use /30 subnet A

from VSS1 to Router2 use /30 subnet B

from VSS2 to Router1 use /30 subnet C

from VSS2 to Router2 use /30 subnet D

2- VSS & MLS use switch port connect to router
 
from VSS1 to Router1 use SVI more than 30 subnet A
from VSS2 to Router1 use SVI more than 30 subnet A 
from VSS1 to Router2 use SVI more than 30 subnet B

from VSS2 to Router2 use SVI more than 30 subnet B

key here that image than these L3 device is connect to one SW and behave like this.  
 

[MHM Cisco World]

Use dynamic protocol between core and edge router, 

make cost via primary better than secondary.

Use Static route toward the virtual ip of hsrp, make your primary path your active hsrp.

this option I am talking about config hsrp between core edge router NOT between core lan access.