пятница, 24 июля 2015 г.

dual ISP static routes load-sharing with NAT( PBR and IP SLA)

I user for this lab GNS3 with c7200-adventerprisek9-mz.152-4.M8.image 

We have the network with 2 ISP, we can load share traffic on both links, ISP1 is for HTTP, HTTPS ISP2 for all other traffic.
Configure links on R1.

interface FastEthernet0/0
 ip address 10.10.10.1 255.255.255.252
 duplex auto
 speed auto
interface FastEthernet0/1
 ip address 20.20.20.1 255.255.255.252
 duplex auto
 speed auto

internal host on R1
interface Loopback0
 ip address 1.1.1.1 255.255.255.0


Configure ISP1 router R2

interface FastEthernet0/0
 ip address 10.10.10.2 255.255.255.252
 duplex auto
 speed auto
interface FastEthernet0/1
 ip address 10.10.10.5 255.255.255.252
 duplex auto
 speed auto
ip route 1.1.1.0 255.255.255.0 10.10.10.1
ip route 8.8.8.0 255.255.255.0 10.10.10.6

Configrure ISP2 router R3

interface FastEthernet0/0
 ip address 20.20.20.2 255.255.255.252
 duplex auto
 speed auto
interface FastEthernet0/1
 ip address 20.20.20.5 255.255.255.252
 duplex auto
 speed auto
ip route 1.1.1.0 255.255.255.0 20.20.20.1
ip route 8.8.8.0 255.255.255.0 20.20.20.6

Configure Internet Cloud with 8.8.8.8 ip address.

interface FastEthernet0/0
 ip address 10.10.10.6 255.255.255.252
 duplex auto
 speed auto
interface FastEthernet0/1
 ip address 20.20.20.6 255.255.255.252
 duplex auto
 speed auto
ip route 0.0.0.0 0.0.0.0 10.10.10.5
ip route 0.0.0.0 0.0.0.0 20.20.20.5

Configure IP SLA on R1 to check reachability of the ISP,s

ip sla auto discovery
ip sla 1
 icmp-echo 10.10.10.2
 threshold 400
 timeout 500
 frequency 1
ip sla schedule 1 life forever start-time now
ip sla 2
 icmp-echo 20.20.20.2
 threshold 400
 timeout 500
 frequency 1
ip sla schedule 2 life forever start-time now

create track for this sla

track 10 ip sla 1 reachability
 delay down 1 up 1
track 20 ip sla 2 reachability
 delay down 1 up 1


create static routes with this track

ip route 0.0.0.0 0.0.0.0 10.10.10.2 track 10
ip route 0.0.0.0 0.0.0.0 20.20.20.2 track 20

Create ACL for Marking web traffic

ip access-list extended permit_web
 permit tcp 1.1.1.0 0.0.0.255 any eq www
 permit tcp 1.1.1.0 0.0.0.255 any eq 443
 permit tcp 1.1.1.0 0.0.0.255 any eq 8080


ACL for Other traffuc

ip access-list extended Other
 permit ip any any

PBR to make decision about destination

route-map LOAD_SHARING permit 10
 match ip address permit_web
 set ip next-hop verify-availability 10.10.10.2 1 track 10
route-map LOAD_SHARING permit 20
 match ip address Other
 set ip next-hop verify-availability 20.20.20.2 1 track 20

ACL for NATING

access-list 1 permit 1.1.1.0 0.0.0.255

Route-map for NAT


route-map ISP2 permit 10
 match ip address 1
 match interface FastEthernet0/1
route-map ISP1 permit 10
 match ip address 1
 match interface FastEthernet0/0


nat string

ip nat inside source route-map ISP1 interface FastEthernet0/0 overload
ip nat inside source route-map ISP2 interface FastEthernet0/1 overload









Комментариев нет:

Отправить комментарий