Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Routing with 2 WANs - Load Balancing? 1

Status
Not open for further replies.
crocks

crocks

Programmer
Jan 3, 2008
14
CA
I have a Cisco 1811 Router, which I configured for 2 WAN and 1 LAN.

1 WAN is a Static IP (FastEthernet1) and the other is a DSL Connection (FastEthernet0).

If I set up an IP Route for 1 of the WANs I can get out to the Internet.
ip route 0.0.0.0 0.0.0.0 208.124.xxx.73

If I add a second route for the DSL WAN, the internet is exteremely slow.
ip route 0.0.0.0 0.0.0.0 Dialer0/FastEthernet0

If I remove the Static WAN Route the internet is quick again.

My question is how do I set up this router to enable Load Balancing for these 2 WAN Connections?

Below is my Current Config File:
!This is the running config of the router: 192.168.1.1
!----------------------------------------------------------------------------
!version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname IBCL1811
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 10 log
security passwords min-length 6
logging buffered 4096 debugging
logging console critical
enable secret 5 yyyyyyyyyyyyyyyyy
enable password 7 xxxxxxxxxxxxxxx
!
aaa new-model
!
!
aaa authentication login local_auth local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authentication login sdm_vpn_xauth_ml_2 local
aaa authorization network sdm_vpn_group_ml_1 local
aaa authorization network sdm_vpn_group_ml_2 local
!
aaa session-id common
!
resource policy
!
clock timezone NewYork -5
clock summer-time NewYork date Apr 6 2003 2:00 Oct 26 2003 2:00
no ip source-route
no ip gratuitous-arps
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1 192.168.1.29
ip dhcp excluded-address 192.168.1.101 192.168.1.254
!
ip dhcp pool IBCL-LAN
import all
network 192.168.1.0 255.255.255.0
dns-server 192.168.1.25
default-router 192.168.1.1
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name ibcl.domain
ip name-server 24.153.23.114
ip name-server 192.168.1.25
ip name-server 207.164.234.193
ip ssh time-out 60
ip ssh authentication-retries 2
ip inspect log drop-pkt
ip inspect name SDM_MEDIUM appfw SDM_MEDIUM
ip inspect name SDM_MEDIUM cuseeme
ip inspect name SDM_MEDIUM dns
ip inspect name SDM_MEDIUM ftp
ip inspect name SDM_MEDIUM h323
ip inspect name SDM_MEDIUM https
ip inspect name SDM_MEDIUM icmp
ip inspect name SDM_MEDIUM imap reset
ip inspect name SDM_MEDIUM pop3 reset
ip inspect name SDM_MEDIUM netshow
ip inspect name SDM_MEDIUM rcmd
ip inspect name SDM_MEDIUM realaudio
ip inspect name SDM_MEDIUM rtsp
ip inspect name SDM_MEDIUM esmtp
ip inspect name SDM_MEDIUM sqlnet
ip inspect name SDM_MEDIUM streamworks
ip inspect name SDM_MEDIUM tftp
ip inspect name SDM_MEDIUM tcp
ip inspect name SDM_MEDIUM udp
ip inspect name SDM_MEDIUM vdolive
login block-for 32767 attempts 5 within 5
!
appfw policy-name SDM_MEDIUM
application im aol
service default action allow alarm
service text-chat action allow alarm
server permit name login.oscar.aol.com
server permit name toc.oscar.aol.com
server permit name oam-d09a.blue.aol.com
audit-trail on
application im msn
service default action allow alarm
service text-chat action allow alarm
server permit name messenger.hotmail.com
server permit name gateway.messenger.hotmail.com
server permit name webmessenger.msn.com
audit-trail on
application http
strict-http action allow alarm
port-misuse im action reset alarm
port-misuse p2p action reset alarm
port-misuse tunneling action allow alarm
application im yahoo
service default action allow alarm
service text-chat action allow alarm
server permit name scs.msg.yahoo.com
server permit name scsa.msg.yahoo.com
server permit name scsb.msg.yahoo.com
server permit name scsc.msg.yahoo.com
server permit name scsd.msg.yahoo.com
server permit name cs16.msg.dcn.yahoo.com
server permit name cs19.msg.dcn.yahoo.com
server permit name cs42.msg.dcn.yahoo.com
server permit name cs53.msg.dcn.yahoo.com
server permit name cs54.msg.dcn.yahoo.com
server permit name ads1.vip.scd.yahoo.com
server permit name radio1.launch.vip.dal.yahoo.com
server permit name in1.msg.vip.re2.yahoo.com
server permit name data1.my.vip.sc5.yahoo.com
server permit name address1.pim.vip.mud.yahoo.com
server permit name edit.messenger.yahoo.com
server permit name messenger.yahoo.com
server permit name http.pager.yahoo.com
server permit name privacy.yahoo.com
server permit name csa.yahoo.com
server permit name csb.yahoo.com
server permit name csc.yahoo.com
audit-trail on
!
!
crypto pki trustpoint TP-self-signed-3156700699
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3156700699
revocation-check none
rsakeypair TP-self-signed-3156700699
!
!
username Derek view SDM_EasyVPN_Remote secret 5 tttttttttttt
username cheryl view SDM_EasyVPN_Remote secret 5 ttttttttttttt
username paul view SDM_EasyVPN_Remote secret 5 tttttt
username dale view SDM_EasyVPN_Remote secret 5 ttttttttttttt
username IBCL privilege 15 password 7 ttttttttttttttt
username DCrocker privilege 15 secret 5 $tttttttttttttttttttt
!
!
class-map match-any sdm_p2p_kazaa
match protocol fasttrack
match protocol kazaa2
class-map match-any sdm_p2p_edonkey
match protocol edonkey
class-map match-any sdm_p2p_gnutella
match protocol gnutella
class-map match-any sdm_p2p_bittorrent
match protocol bittorrent
!
!
policy-map sdmappfwp2p_SDM_MEDIUM
class sdm_p2p_edonkey
class sdm_p2p_gnutella
class sdm_p2p_kazaa
class sdm_p2p_bittorrent
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group IBCLremoteGroup
key ibclibcl1
dns 192.168.1.25 24.153.23.114
pool SDM_POOL_1
max-users 10
netmask 255.255.255.0
crypto isakmp profile sdm-ike-profile-1
match identity group IBCLremoteGroup
client authentication list sdm_vpn_xauth_ml_2
isakmp authorization list sdm_vpn_group_ml_2
client configuration address respond
virtual-template 1
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto ipsec profile SDM_Profile1
set transform-set ESP-3DES-SHA
set isakmp-profile sdm-ike-profile-1
!
!
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
description Sympatico WAN$ETH-WAN$
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface FastEthernet1
description Rogers WAN$ETH-WAN$$FW_OUTSIDE$
ip address 208.124.xxx.74 255.255.255.248
ip access-group 102 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip inspect SDM_MEDIUM out
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
service-policy input sdmappfwp2p_SDM_MEDIUM
service-policy output sdmappfwp2p_SDM_MEDIUM
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Virtual-Template1 type tunnel
ip unnumbered FastEthernet1
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
tunnel mode ipsec ipv4
tunnel protection ipsec profile SDM_Profile1
!
interface Vlan1
description $FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
ip access-group 100 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1412
!
interface Async1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation slip
!
interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1452
ip inspect SDM_MEDIUM out
encapsulation ppp
ip route-cache flow
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname b1maap36
ppp chap password 7 002A1C1410530E145E
ppp pap sent-username b1maap36 password 7 132B18001F0401387A
service-policy input sdmappfwp2p_SDM_MEDIUM
service-policy output sdmappfwp2p_SDM_MEDIUM
!
ip local pool SDM_POOL_1 192.168.2.1 192.168.2.25
ip route 0.0.0.0 0.0.0.0 208.124.xxx.73
!
!
ip http server
ip http access-class 2
ip http secure-server
ip nat inside source list 1 interface FastEthernet1 overload
!
!
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 2 remark HTTP Access-class list
access-list 2 remark SDM_ACL Category=1
access-list 2 permit 192.168.1.0 0.0.0.255
access-list 2 deny any
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip 208.124.xxx.72 0.0.0.7 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 deny ip 192.168.1.0 0.0.0.255 any
access-list 101 deny ip 208.124.xxx.72 0.0.0.7 any
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any log
access-list 102 remark auto generated by SDM firewall configuration
access-list 102 remark SDM_ACL Category=1
access-list 102 permit udp host 207.164.234.193 eq domain host 208.124.xxx.74
access-list 102 permit udp host 24.153.23.114 eq domain host 208.124.xxx.74
access-list 102 permit udp any host 208.124.xxx.74 eq non500-isakmp
access-list 102 permit udp any host 208.124.xxx.74 eq isakmp
access-list 102 permit esp any host 208.124.xxx.74
access-list 102 permit ahp any host 208.124.xxx.74
access-list 102 deny ip 192.168.1.0 0.0.0.255 any
access-list 102 permit icmp any host 208.124.xxx.74 echo-reply
access-list 102 permit icmp any host 208.124.xxx.74 time-exceeded
access-list 102 permit icmp any host 208.124.xxx.74 unreachable
access-list 102 deny ip 10.0.0.0 0.255.255.255 any
access-list 102 deny ip 172.16.0.0 0.15.255.255 any
access-list 102 deny ip 192.168.0.0 0.0.255.255 any
access-list 102 deny ip 127.0.0.0 0.255.255.255 any
access-list 102 deny ip host 255.255.255.255 any
access-list 102 deny ip host 0.0.0.0 any
access-list 102 deny ip any any log
access-list 103 remark VTY Access-class list
access-list 103 remark SDM_ACL Category=1
access-list 103 permit ip 192.168.1.0 0.0.0.255 any
access-list 103 deny ip any any
dialer-list 1 protocol ip permit
no cdp run
!
!
!
!
!
!
control-plane
!
banner login ^CRestricted Access Only^C
!
line con 0
transport output telnet
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
transport output telnet
line vty 0 4
access-class 103 in
password 7 011D09164F03031D2F
transport input telnet ssh
!
scheduler allocate 4000 1000
scheduler interval 500
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end


 
Sort by date Sort by votes
You can only load balance outgoing traffic unless you have provider who will run BGP over a DSL connection.

You set two equally-preferred routes for outgoing traffic:
ip route 0.0.0.0 0.0.0.0 208.124.xxx.73
ip route 0.0.0.0 0.0.0.0 Dialer0/FastEthernet0

The router will alternate packets sent out these interfaces.
I would assume the DSL connection upstream speed is considerably less than the FastEthernet connection.

You might consider a fail-over, just put a higher metric on the DSL connection to take over in case the Static connection fails.

--jeff
 
Upvote 0 Downvote
Jeff, Thx for your input. Yes the DSL Connection is slower than the Static ISP.

How would I go about setting up BGP?

OR what about using OER? (Cisco Document ID: 99427)
Their Example uses a DSL Connection and DHCP ISP.
Could I not do the same thing with my DSL Connection and Static ISP?
 
Upvote 0 Downvote
You would have to get your provider to run BGP with you and with DSL I highly doubt it. You can use OER, but it doesn't load balance exactly, its more of a failover.

Basically based on the criteria you select, it determines which connection is better to use.
 
Upvote 0 Downvote
So in my current situation, there really is no way to do Load Balancing, only option I have is to do a Fail-Over?

In the Cisco Document ID: 99427

On the OER Tracking they have

ip sla 1
icmp-echo 172.16.108.1 source-interface Dialer0
timeout 1000
threshold 40
frequency 3

Where did they get the IP 172.16.108.1 from?
I understand the rest of the document except for this portion. Should I change that IP Address to something else, if so what should I change it to?

Thanks
 
Upvote 0 Downvote
You change it to a public ip address, such as 4.2.2.2 which is a core dns server cluster on the internet backbone.
 
Upvote 0 Downvote
An easier way to do failover is just add a higher metric to the default route on the adsl line...

ip route 0.0.0.0 0.0.0.0 di0 50

and keep the second static route the way it is. I would recommend this, though...

ip route 0.0.0.0 0.0.0.0 fa1 208.124.xxx.73

That way it won't have to do the ARP thing...

Also, basshead---this has nothing to do with HSRP---that is failover for routers, like if one shoots craps, the other one picks up seamlessly.

Burt
 
Upvote 0 Downvote
<quote>So in my current situation, there really is no way to do Load Balancing, only option I have is to do a Fail-Over?</quote>

Pretty much. As you have seen, trying to load-balance per-packet across non-parallel links isn't usually a good idea because the packets can arrive out of order and the source IP will match your outgoing interface, which often causes another set of problems with applications that authenticate the user and also track their session IP address, which is quite common.

Without any routing protocols to populate your routing table with interesting destination routes, the router can't do any useful per-destination load-balancing either. Your routing table basically consists of connected and default routes.

You can try to utilize the DSL connection a little, along with fail-over capability, by entering some static routes to known destinations that you often send/receive traffic.

--jeff
 
Upvote 0 Downvote
it's not possible to use a protocol like EIGRP then??
 
Upvote 0 Downvote
No exterior routing protocol can help you. Providers announce their routes and their connected customer routes via BGP.

BGPv4- smallest subnet advertised is /24 (255.255.255.0)

You have a /29 (255.255.255.248), BGP won't accept a network statement with your mask.

EIGRP- no ISP support AFAIK

Even if your ISPs did support EIGRP, you're trying to advertise IP addresses from one provider to the other, but they can't understand, because ISPs route exterior using BPG exclusively (/24, which is way more IPs that you have).

Even if you got them to increase your /29 to a /24, there is no gaurantee your route advertisements will be accepted. Actually, you are virtually garuanteed to be ignored, because ISPs typically filter out IP block advertisements smaller than /21 (255.255.248.0).


--jeff
 
Upvote 0 Downvote
Don't know much about BGP, but could there be a redistrubution router, which includes EIGRP & BGP?

Where by they can have the same AS numbers??
 
Upvote 0 Downvote
The point has been lost. Unless his ISPs say yes to BGP over his connection, AND he gets at least a /24 block, AND he gets an Autonomous System Number, AND unless he can get his other ISP (the one not re-assigning his IP block) to accept his Advertisements, and his ISP who provides the IP block agrees to announce his more specific route..... Fuggetaboutit. It is a waste of time to talk about BGP.

--jeff
 
Upvote 0 Downvote
i agree, i still say just run HSRP. Very simple to set up, and will provide immediate fail over.
 
Upvote 0 Downvote
I don't think he wants redundant routers, but redundant links. Actually he wanted aggregated links, but...

Burt
 
Upvote 0 Downvote
ok, i'm done posting on this thread.

"I have a Cisco 1811 Router, which I configured for 2 WAN and 1 LAN. "

1 ROUTER, 2 WAN links.....sorry burtsbees.

CCNA, Network+
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Pankaj88
  • Locked
  • Question
BGP Routing Clarification
Replies
0
Views
129
Pankaj88
Pankaj88
WinstonCH
  • Locked
  • Helpful tip
What is wrong with the diagram, there are people who will help to fix it? How do i do the configurat 1
Replies
1
Views
403
BIS
BIS
inlsp05
  • Locked
  • Question
2811 ios start with cf
Replies
0
Views
92
inlsp05
inlsp05
inlsp05
  • Locked
  • Question
2811&amp;2960 48 volts wiring diagram
Replies
1
Views
154
BOKA
BOKA
khashyar2021
  • Locked
  • Question
Problem with cisco switch after upgrading
Replies
1
Views
134
Geraldine Souza
Geraldine Souza

Part and Inventory Search

Sponsor

Back
Top