Solved

EIGRP routing question

Posted on 2008-10-21
4
1,609 Views
Last Modified: 2012-06-27
                                                                                       
                                    192.168.40.251                     ipsec                        10.3.45.254
                                         PIX---------------------------------------------------------ASA              
SITE A                                 !                                                                                 !                SITE B
                                            !                                                                                 !
10.2.100.0                           !                            100Mb                                          !        10.3.44.0
-------------------------------3750-------------------------------------------------------2600--------------

I have the above scenario with an 100Mb connection between site A and Site B. There's also an IPsec tunnel in place using an SDSL connection. I would like to use dymanic routing to failover the 100Mb to the ipsec tunel when 100mb goes down and I would also like to route internet traffic of SITE A to SITE B whenever the ISP on SITE A drops. I have configure a port on 3750 as routing IF and enabled EIGRP for simplicity, I have then setup floating static with higher metrics to failover SITE A to B whenever 100mb drops. What I am unsure is the best method of routing the internet traffic of site A to site B whenever the 100mb line fails. Can the Cisco Firewalls partecipate in the EIGRP layout?

Below are the changes I have made on both sites, could you kindly advise the best way of doing this?

on the 3750

!
router eigrp 30
 network 10.2.100.0 0.0.0.255
 network 172.16.1.0 0.0.0.3
 auto-summary
 eigrp stub connected summary
!
ip classless
Ip route 0.0.0.0 0.0.0.0 192.168.40.251
ip route 10.3.44.0 255.255.254.0 192.168.40.251 200
!



on the 2600


!
router eigrp 30
 network 10.3.44.0 0.0.1.255
 network 172.16.1.0 0.0.0.3
 auto-summary
!
ip classless
Ip route 0.0.0.0 0.0.0.0 10.3.45.254
ip route 10.2.100.0 255.255.255.0 10.3.45.254 200
!

Expert-Case.pdf
0
Comment
Question by:Matsco
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 43

Expert Comment

by:JFrederick29
ID: 22768928
The problem is you can't run EIGRP over the IPSEC VPN tunnel so you can't get end to end dynamic routing over both paths.  Your best bet is to use IP SLA and tracking on your routes.

i.e.

On the 3750, have a primary default route via the PIX which you already have but use IP SLA to ensure reachability to an Internet host via the local Internet connection.  Configure a backup default route via the 100mb.  Do the same thing for the LAN subnet but with the primary the 100mb and the PIX the backup.

On the 2600, do the same thing.  A primary default via the ASA with tracking and a backup default over the 100mb to the other site and the same for the LAN subnets.

Are you familiar with IP SLA or do you need further explanation?
0
 
LVL 1

Author Comment

by:Matsco
ID: 22769164
interesting ..so for example if I would like to set it up on the SITE A side (on the 3750)

!
route 0.0.0.0 0.0.0.0 192.168.40.251 1 track 1
!
sla monitor 2
 type echo protocol ipIcmpEcho <internet object>
sla monitor schedule 2 life forever start-time now
!
track 1 rtr 2 reachability
!
Route 0.0.0.0 0.0.0.0 172.16.1.2 250    ****** floating static with higher metric ********
!

This should route my internet traffic via the 100Mb when the icmp packets to the internet object time out, correct?

By the way I just realised that Eigrp has been implemented on PIX/ASA v. 8.x, does it make any difference?

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008086ebd2.shtml

hey, thanks for you help

0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 500 total points
ID: 22769243
Yeah, EIGRP is in 8 but the same problem applies (inability for multicast traffic to traverse the VPN tunnel).  You could probably get away with using OSPF and defining the network type as "non-broadcast" and manually defining the neighbor (I read a Cisco doc on this once).  I'm not sure the same applies to EIGRP but might be something to look into.  The IP SLA approach is a little simpler.

The config looks good but make sure you put a static host route to the "internet object" so it doesn't become reachable over the 100Mb.

ip route x.x.x.x 255.255.255.255 192.168.40.251

This should route my internet traffic via the 100Mb when the icmp packets to the internet object time out, correct?

Correct, you can do the same for the LAN subnets.  The IP SLA is a good measure since the interface may not actually go down in all cases so the backup routes won't ever be used plus for your Internet failover, the 3750 and 2600 have no knowledge of whether or not the local Internet connection is down and most likely the PIX/ASA will remain up so again no routes will be removed.
0
 
LVL 1

Author Closing Comment

by:Matsco
ID: 31508235
Thanks Jfrederick29.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question