Dual WAN - Configuration reccomendations???

[ksm2552]

I'm current looking at adding another WAN link for load balancing on our internet connection. We currently have 1-T1 and I'm considering adding a DSL or Cable connection as well. I'm looking for suggestions as to what would be the best way to do this? I've looked at OER and that looks promising, but I know I'll need to update the 1721 to support it. I can replace the hardware if neccasary, we are no longer using the VPN capability on the PIX. Should I be looking at an ASA or possibly 1800 series router? I would prefer to keep everything Cisco. Thanks.

Current Topology
Internet(T1) -> Cisco 1721 -> Pix 506 -> Switches

Current Config of 1721 and Pix
Current configuration : 882 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname <REMOVED>
!
boot-start-marker
boot-end-marker
!
enable secret 5 <REMOVED>
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no aaa new-model
ip subnet-zero
ip cef
!
!
!
no ftp-server write-enable
!
!
!
!
interface FastEthernet0
ip address xxx.xxx.xxx.241 255.255.255.248
speed auto
!
interface Serial0
no ip address
encapsulation frame-relay
no fair-queue
service-module t1 timeslots 1-24
frame-relay lmi-type ansi
!
interface Serial0.1 point-to-point
ip address yyy.yyy.yyy.10 255.255.255.252
frame-relay interface-dlci 374 IETF
!
ip classless
ip route 0.0.0.0 0.0.0.0 yyy.yyy.yyy.149
no ip http server
!


PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password <REMOVED> encrypted
passwd <REMOVED> encrypted
hostname <REMOVED>
domain-name <REMOVED>
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list NONATACL permit ip 10.0.0.0 255.0.0.0 192.168.10.0 255.255.255.0
access-list NONATACL permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list TTLSPLITACL permit ip 10.1.0.0 255.255.0.0 any
access-list TTLSPLITACL permit ip 192.168.1.0 255.255.255.0 any
access-list OUTSIDEACL permit icmp any any
access-list OUTSIDEACL permit tcp any host xxx.xxx.xxx.243 eq smtp
access-list OUTSIDEACL permit tcp any host xxx.xxx.xxx.243 eq pop3
access-list OUTSIDEACL permit tcp any host xxx.xxx.xxx.243 eq www
access-list OUTSIDEACL permit tcp any host xxx.xxx.xxx.243 eq 8000
access-list OUTSIDEACL permit tcp any host xxx.xxx.xxx.243 eq 9010
access-list OUTSIDEACL permit tcp any host xxx.xxx.xxx.244 eq https
access-list OUTSIDEACL permit tcp any host xxx.xxx.xxx.245 eq https
pager lines 24
logging on
mtu outside 100
mtu inside 100
ip address outside xxx.xxx.xxx.242 255.255.255.248
ip address inside 10.1.3.254 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNPOOL 192.168.10.1-192.168.10.254
arp timeout 14400
global (outside) 1 xxx.xxx.xxx.246
nat (inside) 0 access-list NONATACL
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) xxx.xxx.xxx.243 10.1.2.50 netmask 255.255.255.255 0 0
static (inside,outside) xxx.xxx.xxx.245 10.1.1.10 netmask 255.255.255.255 0 0
static (inside,outside) xxx.xxx.xxx.244 10.7.0.0 netmask 255.255.255.255 0 0
access-group OUTSIDEACL in interface outside
route outside 0.0.0.0 0.0.0.0 72.240.52.241 1
route inside 10.7.0.0 255.255.0.0 10.1.3.1 1
route inside 192.168.1.0 255.255.255.0 10.1.3.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host 10.1.2.3 cisco timeout 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 10.1.0.0 255.255.0.0 inside
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESPDESSHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP3DESSHA esp-3des esp-sha-hmac
crypto dynamic-map VPNCLIENT 10 set transform-set ESP3DESSHA
crypto map VPNMAP 10 ipsec-isakmp dynamic VPNCLIENT
crypto map VPNMAP client configuration address initiate
crypto map VPNMAP interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 15 authentication pre-share
isakmp policy 15 encryption 3des
isakmp policy 15 hash sha
isakmp policy 15 group 2
isakmp policy 15 lifetime 86400
vpngroup TTLSPLIT address-pool VPNPOOL
vpngroup TTLSPLIT dns-server 10.1.1.21 10.1.2.50
vpngroup TTLSPLIT wins-server 10.1.1.21 10.1.2.50
vpngroup TTLSPLIT split-tunnel TTLSPLITACL
vpngroup TTLSPLIT idle-time 1800
vpngroup TTLSPLIT password ********
telnet 192.168.10.0 255.255.255.0 outside
telnet 10.1.0.0 255.255.0.0 inside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 10
management-access inside
console timeout 3

 

[jneiberger]

What problem are you trying to solve by adding a new connection?

 

[ksm2552]

Basically, I'm looking to give my users some increased bandwidth beyond the current T1. I really don't want to get another T1 due to the high cost.

 

[jneiberger]

Getting another T1 from the same provider is the way to go. It is far less complicated than trying to deal with load-sharing over dissimilar media and separate providers. See if you can get a deal on a new T1. If not, check around with other providers and see if they'll give you a great deal on two T1s and then just switch.

You might also see if you can find a metro ethernet offering. Those are usually scalable, so you could buy a 3 Mbps pipe for now and go bigger later if you need to. Those are typically more expensive, but you might luck out and find someone offering it for cheap.

Another option would be to dump the T1 and go some flavor of high speed synchronous DSL. That would work well as long as you're pretty close to the nearest central office.