Two gateways of last resort

[britdecker]

Hello all,

My question revolves around having two gateways of last resort to the internet in my network core. We are getting ready to test our new firewall infrastructure (Cisco 5540's) and I need to be able to send test groups to the new firewalls selectively. Is there a way to use PBR to shove selected subnets to a different gateway of last resort without effecting my current gateway of last resort (to our production firewalls)that is used company wide? My core consist of two 4506's and we are running EIGRP as a protocol.

Thanks in advance!

[Giuseppe Larosa]

Hello Brit,

generally speaking PBR would be the right tool for this and would leave the EIGRP default route unaffected.

to be noted that PBR support on C4506 depends on supervisor type and IOS image.

Hope to help

Giuseppe

[britdecker]

Gluseppe,

Thanks for the quick response! Our cores have SUP V's so I think we should be ok to run PBR. So my current default route is static:

ip route 0.0.0.0 0.0.0.0 x.x.x.A

Will I need to create a second default route and the use PRB to point to it?

ip route 0.0.0.0 0.0.0.0 x.x.x.b

access-list 101 permit ip 10.1.1.0 255.0.0.0 any <-- what do I use here? "any" will stomp on my local routes. How do I define "only if you don't have a local route'?

route-map LOCAL_MAP permit 10

match ip address 101

set ip next-hop x.x.x.b

ip local policy route-map LOCAL_MAP

Sorry for all the questions.

[Giuseppe Larosa]

Hello Brit,

I think PBR should be used applying the route map to interface(s) that receives the traffic to be diverted.

>> How do I define "only if you don't have a local route'?

use

set ip default next-hop x.x.x.b

in this way the routing table is consulted first if no entry exists the route-map set next-hop is applied

be aware that using two static routes in this way will case outbound load balancing

Hope to help

Giuseppe

[britdecker]

Gluseppe,

I don't want to load balance so will placing a higher metric on the second default route rule out load balancing?

[Giuseppe Larosa · Accepted solution]

Hello Brit,

I was in doubt about this ...

the number you place at the end of a static route is not a metric but an AD administrative distance

but the answer is yes use:

ip route 0.0.0.0 0.0.0.0 x.x.x.b 201

so this will be a backup static route used only if first one fails

Hope to help

Giuseppe

[britdecker]

Gluseppe,

That answers it, thanks for your help!