?
Solved

Cisco Dual WAN failover config on Single Router

Posted on 2005-03-22
9
Medium Priority
?
3,545 Views
Last Modified: 2008-01-09
From the answers that I have seen I am positive someone can help me with this question.

I have an IP Base Cisco 2811 Router with one HWIC-4ESW and two Internet connections from different providers. My internet connections (Wireless and T1) come in through FastEthernet0/0 and FastEthernet0/1 respectively. My LAN side attaches through VLAN1 via FastEthernet0/0/0.

We use the Wireless as our primary connection to the internet for all LAN users, and also host internet servers through NAT. I currently have NAT entries duplicated for both Internet links to the internal servers.

We have a Dynamic DNS provider that checks every 2 minutes for a failure on our Wireless IP and if detected, switches all records over to our T1.

      
Interfaces
      Wireless       FastEthernet0/0            NAT OUTSIDE
      Frac T1      FastEthernet0/1            NAT OUTSIDE
      LAN      FastEthernet0/0/0 as VLAN1      NAT INSIDE

Interface IPS (examples only)
      Wireless       1.1.1.1 Gateway to ISP
            1.1.1.(2-6) Wireless IP's
      Frac T1       2.2.2.1 Gateway to ISP
            2.2.2.(2-6) T1 IP's
      VLAN1      192.168.1.1/24

Client IP's
      192.168.1.2 - 192.168.1.254

NAT Example
      ip nat inside source list 1 interface FastEthernet0/0 overload
      ip nat inside source list 2 interface FastEthernet0/1 overload
      ip nat inside source static tcp 192.168.1.3 25 1.1.1.3 25 extendable
      ip nat inside source static tcp 192.168.1.3 25 2.2.2.3 25 extendable

Access Lists
      access-list 1 permit 192.168.1.0 0.0.0.255
      access-list 2 permit 192.168.1.0 0.0.0.255

Static Routes
      ip route 0.0.0.0 0.0.0.0 1.1.1.1
      ip route 0.0.0.0 0.0.0.0 2.2.2.1 20

What would be the configuration for the router. I have most of the pieces together, but something is just not working, besides my brain.

Thank you in advance!!!

Larry
0
Comment
Question by:larryklingaman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 2000 total points
ID: 13603707
You need to use a route-map in your overload statement to identify which interface is up.  With your configuration, even though the route may be removed from the routing table, the first NAT statement will still be used.  When using the route-map and specifying the matching output interface, the correct NAT overload statement will be used:

ip nat inside source route-map wireless interface fastethernet0/0 overload                          
ip nat inside source route-map t1 interface fastethernet0/1 overload                          

access-list 1 permit 192.168.1.0 0.0.0.255                                      
access-list 2 permit 192.168.1.0 0.0.0.255

route-map wireless permit 10
 match ip address 1
 match interface fastethernet0/0

route-map t1 permit 10
 match ip address 2
 match interface fastethernet0/1

ip route 0.0.0.0 0.0.0.0 1.1.1.1
ip route 0.0.0.0 0.0.0.0 2.2.2.1 20
0
 

Author Comment

by:larryklingaman
ID: 13604509
I have added the route-maps but have to wait until after business hours to remove the old NAT overloads and add the new ones to test.

With this configuration will the failover work if the Wireless has a problem on their routers and I still have a physical link on the interface AND if I lose my physical Link on the Wireless interface. What is the timeframe for the failover/recovery.

Thank you in advance...

Larry
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 13604695
Unfortunately it will not, a downstream failure will not be detected by your router and the route will not be removed from the routing table.  If the local interface goes down, then the backup route will come up.

You can use the following to combat that:

http://www.cisco.com/en/US/about/ac123/ac114/ac173/Q2-04/department_techtips.html

Failover/recovery should be pretty instantaneous.  You will need to wait for the current NAT translations to time out but the route will drop out of the routing table and install the backup route within a matter of seconds.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 79

Expert Comment

by:lrmoore
ID: 13604952
JFrederick29 is correct. The SAA probe example in the link provided may require an upgrade from IP Base to Enterprise Base IOS ($$), but it is about the only solution for you since the ethernet physical interface is likely to never go down..

0
 

Author Comment

by:larryklingaman
ID: 13605745
How do I determine if the Base IP version that I have; 12.3(11)T2 supports policy routing? If it does support it, what would the configuration be? Should/can I run both the route-map and policies?
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 13624532
The IP Base version will support policy routing, whether it supports SAA probes is a different question.  You can use Cisco's Feature Navigator to see if IP Base supports SAA probes.  Yes, you can use policy routing (route-maps) along with the SAA probes.
0
 

Author Comment

by:larryklingaman
ID: 13624669
What would the configuration be for the Policy Routing
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 13624712
Okay, I'm losing train of thought here, let's backup, you don't need policy routing, you are simply using a route-map in your "ip nat inside source..." statements instead of an access-list.  My first post is what you need to setup for the NAT failover.
0
 

Author Comment

by:larryklingaman
ID: 13626173
I should have been more specific. The outgoing NAT would need to failover also. What is the configuration for that and can it be done witht he IP Base IOS? Is that another question?
0

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question