Search This Blog

Monday, April 15, 2013

Multiple ISP's and NAT load-balance



This lab I will show how we can load-balance traffic based on protocols between two ISP’s while using each ISP provided IP.

Device
Role
R1
Customer router
R2
ISP1
R3
ISP2
R4
Internet
R5
Emulate customer node on LAN

The customer requirements are:
1.  All HTTP and telnet traffic will go through ISP2
2. All other traffic will go through ISP1
3. In case of failure in one of the ISP’s all traffic will go through the other one

This is the network topology:



After configuring all interfaces with the correct IP’s we need to configure default route:

ip route 0.0.0.0 0.0.0.0 10.1.12.2 name PRIMARY
ip route 0.0.0.0 0.0.0.0 10.1.13.3 150 name BACKUP

Here I configured a default route to ISP1 as primary while configuring floating static route with AD of 150 to ISP2.

Next configuring ACL which will capture the appropriate traffic:

ip access-list extended ACL_HTTP
 permit tcp 192.168.15.0 0.0.0.255 any eq telnet
 permit tcp 192.168.15.0 0.0.0.255 any eq www
 deny   ip any any

This ACL will capture all HTTP and telnet traffic from network 192.168.15.0/24.

And configuring track object for ISP2 interface:

track 3 interface FastEthernet0/1 ip routing

Next configuring PBR (Policy-Based Route) with attached track object:

Route-map RM_HTTP_PBR permit 10
 match ip address ACL_HTTP
 set ip next-hop verify-availability 10.1.13.3 10 track 3
!
route-map RM_HTTP_PBR deny 20
!

In case of failure in ISP2 link the PBR won’t take in affect.

Now attach this PBR to interface Fa1/0 which connected to customer’s LAN:

interface FastEthernet1/0
 ip address 192.168.15.1 255.255.255.0
 ip virtual-reassembly
 ip policy route-map RM_HTTP_PBR
 speed 100
 full-duplex
!

Now for the NAT part, configuring two route-maps, one for each ISP with the corresponding interface:

route-map RM_ISP1 permit 10
 match interface FastEthernet0/0
!
route-map RM_ISP2 permit 10
 match interface FastEthernet0/1
!

And last configuring the NAT statements:

ip nat inside source route-map RM_ISP1 interface FastEthernet0/0 overload
ip nat inside source route-map RM_ISP2 interface FastEthernet0/1 overload


The NAT statement will take place only if the interface, which I configured on the route-map, is matched else it will be ignored.



Summary
R1 will use IP 10.1.13.1 for NAT to all HTTP and telnet traffic from R5 and IP 10.1.12.1 for NAT to all traffic from R5 except HTTP and telnet.
In case of failure of ISP2, the PBR won’t work and R1 will use NAT IP 10.1.12.1 for all traffic. In case of failure of ISP1, the static route to ISP2 will take over and R1 will use NAT IP 10.1.13.1 for all traffic.

Verification

In case of both links are up, Ping from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#ping 192.168.41.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.41.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 52/76/112 ms

Result:



Telnet from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#telne           
R5#telnet 192.168.41.1
Trying 192.168.41.1 ... Open


User Access Verification

Username:

Result:


Note the source IP on each capture.

Now shutting down interface Fa0/1 on R1 and testing again, Ping from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#ping 192.168.41.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.41.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 52/76/112 ms

Result:


Telnet from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#telne           
R5#telnet 192.168.41.1
Trying 192.168.41.1 ... Open


User Access Verification

Username:

Result:


On the captures both source IP's are 10.1.12.1.

Now bring back interface Fa0/1 and shut down interface Fa0/0 on R1 and testing again, Ping from R5 (192.168.15.5) to R4 (192.168.41.1):
 
R5#ping 192.168.41.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.41.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 52/76/112 ms


Result:



Telnet from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#telne           
R5#telnet 192.168.41.1
Trying 192.168.41.1 ... Open


User Access Verification

Username:

Result: