	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.3

Office network headache

Asked by DzemoBond in Network Design & Methodology, Miscellaneous Networking, Networking Hardware Firewalls

Tags: GLBP, VLAN, Juniper

Hello Experts,

I hope someone can help me with giving some input about configuration and possible design flaws which cause our proposed new office network to lose connectivity for a few seconds (still in testing phase with only few users). What I notice is that my outgoing VPN session goes down and then re-establishes within 2-3 seconds. My Outlook and AIM client also complain by briefly loosing contact to mail/AIM servers. However, constant ping to public IP always succeeds and sees no connectivity problems during the time VPN session goes down.

Attached is diagram of future network. Here is my design (feel free to critique):

1)      WAN consists of two cable modems that perform NATing to 192.168.11.x network and DSL modem has static IP. Three (3) Cisco 1811 routers are connected to each cable/Dsl modem. 192.168.11.x is NATed to 10.10.10.x/28 for cable modems and DSL public IP is NATed to 10.10.10.x/28 as well. I configured Cisco GLBP for load-balancing and failover to Internet. (During testing phase there is only DSL and one Cable modem in the pool). IP SLA is configured on 1811 routers and used to track reachability of WAN next hop and determine when to take a router out of GLBP pool.
2)      Juniper SSG20 inside interface is configured as Trunk routing three internal VLANs. Inside port is subinterfaced and configured as GW for all user VLANs.
3)      Cisco 3560G is configured as DHCP server for all 3 VLANs.

I realize that there are few single points of failure in the design. However, main requirement was to establish diversity and failover capability with respect to Internet connectivity.

So far, I was not able to identify reason for brief outages. I see no GLBP or physical layer issues. Is it possible that some NAT timers must be tweaked?

Any input is really appreciated.
Thanks,
Dzemo

View the Solution FREE for 30 Days

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:

           
           
             -----------RTR-CM2.SCI--------
ip sla 1
 icmp-echo 10.53.0.1
 frequency 5 
ip sla schedule 1 life forever start-time now
track 1 rtr 1 reachability
 
interface FastEthernet0
 description Link_to_DMZ-1.SCI.fe0/2
 ip address 10.10.10.3 255.255.255.240
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 ip route-cache flow
 duplex auto
 speed auto
 glbp 10 ip 10.10.10.10
 glbp 10 preempt delay minimum 60
 glbp 10 weighting 100 lower 95
 glbp 10 weighting track 1 decrement 10
!
interface FastEthernet1
 description To_CM2.TWC
 ip address dhcp
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 no ip route-cache cef
 ip route-cache flow
 duplex auto
 speed auto
 
ip route 0.0.0.0 0.0.0.0 192.168.11.1
ip route 192.168.2.0 255.255.255.0 10.10.10.1
ip route 192.168.3.0 255.255.255.0 10.10.10.1
ip route 192.168.4.0 255.255.255.0 10.10.10.1
!
!
ip http server
no ip http secure-server
ip nat pool ovrld 192.168.11.3 192.168.11.3 prefix-length 24
ip nat inside source list 1 pool ovrld overload
!
logging trap debugging
access-list 1 permit 10.10.10.0 0.0.0.255
no cdp run
 
====================================
====================================
 
 
-------RTR-DSL.SCI-------
ip sla 1
 icmp-echo 71.X.X.1
 frequency 5
ip sla schedule 1 life forever start-time now
track 1 rtr 1 reachability
 
 
interface FastEthernet0
 description Link_to_DMZ-1.SCI.fe0/3
 ip address 10.10.10.4 255.255.255.240
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 ip route-cache flow
 duplex auto
 speed auto
 glbp 10 ip 10.10.10.10
 glbp 10 weighting 100 lower 95
 glbp 10 weighting track 1 decrement 10
!
interface FastEthernet1
 description Link_to_DSL-1.Verizon_Modem
 ip address 71.X.X.69 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 no ip route-cache cef
 ip route-cache flow
 duplex auto
 speed auto
 
 
ip route 0.0.0.0 0.0.0.0 71.x.x.1
ip route 192.168.2.0 255.255.255.0 10.10.10.1
ip route 192.168.3.0 255.255.255.0 10.10.10.1
ip route 192.168.4.0 255.255.255.0 10.10.10.1
!
!
no ip http server
no ip http secure-server
ip nat pool ovrld 71.x.x.69 71.x.x.69 prefix-length 24
ip nat inside source list 1 pool ovrld overload
!
access-list 1 permit 10.10.10.0 0.0.0.255
 
 
====================================
====================================
 
 
 
-------CORE-1.SCI--------
 
ip routing
no ip domain-lookup
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.2.1 192.168.2.100
ip dhcp excluded-address 192.168.3.1 192.168.3.100
ip dhcp excluded-address 192.168.4.1 192.168.4.100
!
ip dhcp pool Users_EastWest_DHCP
   network 192.168.2.0 255.255.255.0
   default-router 192.168.2.1
   dns-server 4.2.2.2 
   lease 7
!
ip dhcp pool QA_Lab_Room_DHCP
   network 192.168.3.0 255.255.255.0
   default-router 192.168.3.1
   dns-server 4.2.2.2 
   lease 7
!
ip dhcp pool Training_Room_DHCP
   network 192.168.4.0 255.255.255.0
   default-router 192.168.4.1
   dns-server 4.2.2.2 
   lease 7
 
 
 
interface FastEthernet0/2
 description Link_to_AS-1E.SCI
 switchport access vlan 2
!
interface FastEthernet0/3
 description Link_to_AS-1W.SCI
 switchport access vlan 2
!
interface FastEthernet0/4
 description Link_to_WF-1.SCI
 switchport access vlan 2
!
interface FastEthernet0/5
 description Link_to_QA-1.SCI
 switchport access vlan 3
!
interface FastEthernet0/6
 description Link_to_TR-1.SCI
 switchport access vlan 4
!
interface FastEthernet0/7
!
interface FastEthernet0/8
 description Trunk_to_FW-1.SCI_Juniper
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/1
!
interface Vlan1
 no ip address
!
interface Vlan2
 description Users_EastWestWifi
 ip address 192.168.2.6 255.255.255.0
!
interface Vlan3
 description QA_Lab_Room
 ip address 192.168.3.6 255.255.255.0
!
interface Vlan4
 description Training_Room
 ip address 192.168.4.6 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.2.1
ip route 0.0.0.0 0.0.0.0 192.168.3.1
ip route 0.0.0.0 0.0.0.0 192.168.4.1

           
         

Attachments:

pic1.JPG (69 KB) (File Type Details)

office network diagram

Office network headache

Asked by DzemoBond in Network Design & Methodology, Miscellaneous Networking, Networking Hardware Firewalls

Tags: GLBP, VLAN, Juniper

About this solution