POLICY BASE ROUTING
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-09-2012 05:07 AM - edited 03-07-2019 08:14 AM
Hi experts,
- •1) I have configured 4 VLANS on my L3 switch.
- •2) I have one router which has connected 2 ISP link
- •3) L3 switch & router has connected each other through L3 link.(which has different subnet)
- •4) VLANS on L3 switch ( vlan10 , vlan20, vlan30, vlan40 ) each vlan has 24bit subnet
- •5) I want to pass vlan 10 , 20 through ISP1 & vlan 30, 40 through ISP2
- •6) If anyone ISP link fail all VLANS should be carried through remaining backup link
- •7) Please find the topology below
Please Assist..
- Labels:
-
Other Switching
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-09-2012 06:32 AM
You must use IP SLA and route map.
You need check availability and chenge next-hop
As example, in route map:
set ip next-hop verify-availabilityset ip next-hop verify-availability10 track XXX 20 track YYY
And add route map on interface or SVI
Helping seriously ill children, all together. All information about this, is posted on my blog
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-09-2012 11:22 AM
Dear Oleg,
I have done that all things which have you mentioned. but my question is what access-list should be created for vlans to send them L3 switch to router. Otherwise how could be the router send vlan 10, 20 through ISP1 & vlan 30, 40 through ISP2...
Regards
Suhas
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-09-2012 12:47 PM
Example:
We have two VLAN at catalyst:
one - 192.168.1.0/24
two - 192.168.2.0/24
Outside interfaces
(in my example, it is two subinterfaces)
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
interface GigabitEthernet0/0.1
encapsulation dot1Q 1 native
ip address 172.16.4.112 255.255.255.0
ip nat outside
ip virtual-reassembly
no snmp trap link-status
Gateway for this interface is 172.16.4.1
interface GigabitEthernet0/0.2
encapsulation dot1Q 2
ip address 192.168.55.210 255.255.255.0
ip nat outside
ip virtual-reassembly
no snmp trap link-status
Gateway for this interface is 192.168.55.1
interface GigabitEthernet0/1
ip address 192.168.33.1 255.255.255.252
ip nat inside
ip virtual-reassembly
ip policy route-map VLANWEB
duplex auto
speed auto
It is interface to catalyst
route-map NATR1 permit 10
match ip address NATACL
match interface GigabitEthernet0/0.1
route-map NATR2 permit 10
match ip address NATACL
match interface GigabitEthernet0/0.2
route-map VLANWEB permit 10
match ip address VLAN1ACL
set ip next-hop 192.168.55.1
route-map VLANWEB permit 20
match ip address VLAN2ACL
set ip next-hop 172.16.4.1
ip access-list extended NATACL
permit ip 192.168.1.0 0.0.0.255 any
permit ip 192.168.2.0 0.0.0.255 any
ip access-list extended VLAN1ACL
permit ip 192.168.1.0 0.0.0.255 any
ip access-list extended VLAN2ACL
permit ip 192.168.2.0 0.0.0.255 any
ip nat inside source route-map NATR1 interface GigabitEthernet0/0.1 overload
ip nat inside source route-map NATR2 interface GigabitEthernet0/0.2 overload
ip route 192.168.1.0 255.255.255.0 192.168.33.2
ip route 192.168.2.0 255.255.255.0 192.168.33.2
Example debug out
*Aug 9 20:51:27.439: NAT*: s=192.168.2.18->172.16.4.112, d=8.8.8.8 [3643]
*Aug 9 20:53:21.899: NAT*: s=192.168.1.18->192.168.55.210, d=8.8.8.8 [4135]
But You need added in this example IP SLA tracker
And well be good if You, done this, public Your config in this forum
Thanks!
Helping seriously ill children, all together. All information about this, is posted on my blog
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-10-2012 02:17 AM
I modify config for support backup ISP
interface GigabitEthernet0/1
ip address 192.168.33.1 255.255.255.252
ip nat inside
ip policy route-map VLANWEB
interface GigabitEthernet0/0.1
encapsulation dot1Q 1 native
ip address 172.16.4.112 255.255.255.0
ip nat outside
ip virtual-reassembly in
interface GigabitEthernet0/0.2
encapsulation dot1Q 2
ip address 192.168.55.210 255.255.255.0
ip nat outside
ip virtual-reassembly in
ip sla 1
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0.1
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0.2
ip sla schedule 2 life forever start-time now
track 123 ip sla 1 reachability
track 124 ip sla 2 reachability
ip access-list extended ISP1_SLA
permit icmp host 172.16.4.112 any
ip access-list extended ISP2_SLA
permit icmp host 192.168.55.210 any
route-map RMAP_SLA permit 10
match ip address ISP2_SLA
set ip next-hop 192.168.55.1
route-map RMAP_SLA permit 20
match ip address ISP1_SLA
set ip next-hop 172.16.4.1
ip local policy route-map RMAP_SLA
ip access-list extended VLAN1ACL
permit ip 192.168.1.0 0.0.0.255 any
ip access-list extended VLAN2ACL
permit ip 192.168.2.0 0.0.0.255 any
route-map VLANWEB permit 10
match ip address VLAN1ACL
set ip next-hop verify-availability 192.168.55.1 10 track 124
set ip next-hop verify-availability 172.16.4.1 20 track 123
route-map VLANWEB permit 20
match ip address VLAN2ACL
set ip next-hop verify-availability 172.16.4.1 10 track 123
set ip next-hop verify-availability 192.168.55.1 20 track 124
ip access-list extended NATACL
permit ip 192.168.1.0 0.0.0.255 any
permit ip 192.168.2.0 0.0.0.255 any
route-map NATR1 permit 10
match ip address NATACL
match interface GigabitEthernet0/0.1
route-map NATR2 permit 10
match ip address NATACL
match interface GigabitEthernet0/0.2
ip nat inside source route-map NATR1 interface GigabitEthernet0/0.1 overload
ip nat inside source route-map NATR2 interface GigabitEthernet0/0.2 overload
ip route 0.0.0.0 0.0.0.0 172.16.4.1 20 track 123
ip route 0.0.0.0 0.0.0.0 192.168.55.1 10 track 124
event manager applet ISPSW
event track 123 state any
action 1 cli command "enable"
action 2 cli command "clear ip nat trans forced"
event manager applet ISPSW2
event track 124 state any
action 1 cli command "enable"
action 2 cli command "clear ip nat trans forced"
Helping seriously ill children, all together. All information about this, is posted on my blog
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-11-2012 12:46 AM
Hi Oleg,
What configuration should be done at L3 switch.
Regards
Suhas
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-11-2012 12:58 AM
HI Suhas,
You can use this simple concept:
Regards
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-12-2012 08:55 AM
At L3 switch You must have two SVI interfaces for each VLAN (IP ddress at this interfaces should be use as gateway for PC in this VLAN).
And You must set default route to Your router (ip route 0.0.0.0 0.0.0.0 xx.xx.xx.xx or ip default-gateway xx.xx.xx.xx (where xx.xx.xx.xx IP address of Your router)) and enable ip routing.
At L3 switch You must have two SVI interfaces for each VLAN (IP ddress at this interfaces should be use as gateway for PC in this VLAN).
And You must set default route to Your router (ip route 0.0.0.0 0.0.0.0 xx.xx.xx.xx or ip default-gateway xx.xx.xx.xx (where xx.xx.xx.xx IP address of Your router)) and enable ip routing.
Helping seriously ill children, all together. All information about this, is posted on my blog
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-12-2012 08:56 AM
Dear Sandeep, in Your example, You do not use backup route patch for each VLAN
Helping seriously ill children, all together. All information about this, is posted on my blog
