No Internet access from second provider ISP

[reynosoalmonte]

Hello,

I have 3 days in this and I need some help of you.

I have 2 layer 3 switch doing standby. This is working. But, I have a second ISP for Internet. I have done all the static route but it doesn't working when I down the interface of my principal isp for Internet; it must enter the second layer 3 switch by standby protocol as active to start using the Internet of my second ISP2.

I put a static route in the layer 3 switch connect with the router of my ISP-2. The speed is sum together. But no Internet access if I down the interface of my principal ISP-1.

Router of my second ISP-2 is a ZTE. But router of my principal ISP-1 is a Cisco 800, both layer 3 switch are Cisco 3760.

[reynosoalmonte]

Do I need to put hsrp in SW-Principal or in SW-ISP-1? Because on switch-Principal I have all the interface vlan.

[Georg Pauwen]

You need to copy the setup you have used for Vlan 100. That means you need to configure it in SW-1 and SW-2.

[Georg Pauwen]

Why is Vlan 100 on SW-1 and not on Principal ? Is that by design ?

Didn't you say that the other switch was an SG-200 ?

[reynosoalmonte]

I putted vlan 100 on SW-1 to separate hsrp from the others vlan in SW-PRINCIPAL.

SG-200 not, SG-300. This is the SW-CONTAB

SW-PRINCIPAL is Cisco 4948

SW-ISP-1 is Cisco 3750

SW-ISP-2 is CIsco 3750

On the SW-PRINCIPAL I have all the interface vlan, a mean, vlan 206, 208, 215, etc., on SW-ISP-1 I have just vlan100 with hsrp.

So, Do I need to move all my interface vlan from SW-PRINCIPAL to SW-ISP-1 to make hsrp work?

[Georg Pauwen]

The SG300 can't do HSRP. So your only option is to move all HSRP configs for all Vlans to SW-1 and SW-2...

[reynosoalmonte]

Ok, here is what I don't why is not working if I change the vlan, ex., vlan 208 I change to SW-ISP-1 and did hsrp. The same in SW-ISP-2.

Now, what wrong?

this is the hsrp for vlan 208:

SW-ISP-1

interface Vlan208
description Vlan Internet-Personal
ip address 190.191.208.2 255.255.255.240
standby 2 ip 190.191.208.1
standby 2 priority 150
standby 2 preempt delay minimum 240 reload 300
standby 2 track 1 decrement 50
!

SW-ISP-2

interface Vlan208
description Vlan Internet-Personal
ip address 190.191.208.5 255.255.255.240
standby 2 ip 190.191.208.1
standby 2 priority 110
standby 2 preempt
!

When I down interface for isp-1, I just ping 8.8.8.8 success from vlan 208, but not Internet.

[Georg Pauwen]

Did you delete interface Vlan208 from SW-PRINCIPAL ?

[reynosoalmonte]

Yes, I have deleted it.

It seems standby for vlan 208 is fine:

SW-ISP-1:

Vlan208 - Group 2
State is Active
22 state changes, last state change 00:14:04
Virtual IP address is 190.191.208.1
Active virtual MAC address is 0000.0c07.ac02
Local virtual MAC address is 0000.0c07.ac02 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.416 secs
Preemption enabled, delay min 240 secs, reload 300 secs
Active router is local
Standby router is 190.191.208.5, priority 110 (expires in 11.024 sec)
Priority 150 (configured 150)
Track object 1 state Up decrement 50
Group name is "hsrp-Vl208-2" (default)

SW-ISP-2:

Vlan208 - Group 2
State is Standby
20 state changes, last state change 00:14:29
Virtual IP address is 190.191.208.1
Active virtual MAC address is 0000.0c07.ac02
Local virtual MAC address is 0000.0c07.ac02 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.208 secs
Preemption enabled
Active router is 190.191.208.2, priority 150 (expires in 9.984 sec)
Standby router is local
Priority 110 (configured 110)
Group name is "hsrp-Vl208-2" (default)

[Georg Pauwen]

Hello,

do you have access to the ISP router ? It might be a case of having to clear the existing NAT translations on the ISP-1 router...

[Georg Pauwen]

How do your Vlan 100 clients get their IP addresses ? When you delete Vlan 208 on SW-PRINCIPAL, your clients don't get a default gateway anymore, so you will have to define the DHCP pool on SW-1 as well as on SW-2. You need to split the pool in order to avoid DHCP overlapping address conflicts.

That said, is this a live network ? If so, I would go back to the drawing board first. The SG300 is a small business device and not really meant in a larger network. What are the other devices ? It would be a lot easier to configure the network with just two switches, run HSRP for each VLAN between just those two switches...

[reynosoalmonte]

Yes, I put the DHCP in SW-1 too and I am doing ip dhcp except.

Now, explain me. Now vlan 208 works with hsrp. What I do? I just change the DNS 200.88.127.22 200.88.127.23 for DNS 8.8.8.8 and it works. ISP-1 is down and traffic was going thought SW-2. It works now.

Why is not working with the dns 200.88.127.22 ... etc.,

[paul driver]

Hello
Just to confirm -

1) two external paths to the internet via two isp connections ( are these different providers)

2) static routing and ip sla towards each isp

3) eigrp with hrsp running internally between the l3 core/distribution

Just glancing over this it seems most probable reason why your losing internet connectivity is that when the connection to ISP1 is lost even though ip sla tracking initiates and hrsp failsover ,Eigrp isn't aware of this change and is blackholing the traffic.

It doesn't seem your statics are being conditionally advertised in eigrp?

[reynosoalmonte]

Hi Paul,

1) Yes, there are different isp

2) Yes

3) eigrp is running in both layer 3 switch, also in the sw where is connect servers and others switches as cisco sg300, cisco sf300, etc.

[Georg Pauwen]

Hello,

Paul has a good point: the SG300 doesn't support EIGRP (or any dynamic routing protocol), just static routes. 32 is the maximum. It is going to be extremely difficult to configure a mix of EIGRP, static routes, HSRP, and IP SLA failover. That is why I asked if you can get rid of the SG300 and use a device similar to the one you use as SW-PRINCIPAL.