Solved

EIGRP routing question

Posted on 2008-10-21
4
1,603 Views
Last Modified: 2012-06-27
                                                                                       
                                    192.168.40.251                     ipsec                        10.3.45.254
                                         PIX---------------------------------------------------------ASA              
SITE A                                 !                                                                                 !                SITE B
                                            !                                                                                 !
10.2.100.0                           !                            100Mb                                          !        10.3.44.0
-------------------------------3750-------------------------------------------------------2600--------------

I have the above scenario with an 100Mb connection between site A and Site B. There's also an IPsec tunnel in place using an SDSL connection. I would like to use dymanic routing to failover the 100Mb to the ipsec tunel when 100mb goes down and I would also like to route internet traffic of SITE A to SITE B whenever the ISP on SITE A drops. I have configure a port on 3750 as routing IF and enabled EIGRP for simplicity, I have then setup floating static with higher metrics to failover SITE A to B whenever 100mb drops. What I am unsure is the best method of routing the internet traffic of site A to site B whenever the 100mb line fails. Can the Cisco Firewalls partecipate in the EIGRP layout?

Below are the changes I have made on both sites, could you kindly advise the best way of doing this?

on the 3750

!
router eigrp 30
 network 10.2.100.0 0.0.0.255
 network 172.16.1.0 0.0.0.3
 auto-summary
 eigrp stub connected summary
!
ip classless
Ip route 0.0.0.0 0.0.0.0 192.168.40.251
ip route 10.3.44.0 255.255.254.0 192.168.40.251 200
!



on the 2600


!
router eigrp 30
 network 10.3.44.0 0.0.1.255
 network 172.16.1.0 0.0.0.3
 auto-summary
!
ip classless
Ip route 0.0.0.0 0.0.0.0 10.3.45.254
ip route 10.2.100.0 255.255.255.0 10.3.45.254 200
!

Expert-Case.pdf
0
Comment
Question by:Matsco
  • 2
  • 2
4 Comments
 
LVL 43

Expert Comment

by:JFrederick29
Comment Utility
The problem is you can't run EIGRP over the IPSEC VPN tunnel so you can't get end to end dynamic routing over both paths.  Your best bet is to use IP SLA and tracking on your routes.

i.e.

On the 3750, have a primary default route via the PIX which you already have but use IP SLA to ensure reachability to an Internet host via the local Internet connection.  Configure a backup default route via the 100mb.  Do the same thing for the LAN subnet but with the primary the 100mb and the PIX the backup.

On the 2600, do the same thing.  A primary default via the ASA with tracking and a backup default over the 100mb to the other site and the same for the LAN subnets.

Are you familiar with IP SLA or do you need further explanation?
0
 
LVL 1

Author Comment

by:Matsco
Comment Utility
interesting ..so for example if I would like to set it up on the SITE A side (on the 3750)

!
route 0.0.0.0 0.0.0.0 192.168.40.251 1 track 1
!
sla monitor 2
 type echo protocol ipIcmpEcho <internet object>
sla monitor schedule 2 life forever start-time now
!
track 1 rtr 2 reachability
!
Route 0.0.0.0 0.0.0.0 172.16.1.2 250    ****** floating static with higher metric ********
!

This should route my internet traffic via the 100Mb when the icmp packets to the internet object time out, correct?

By the way I just realised that Eigrp has been implemented on PIX/ASA v. 8.x, does it make any difference?

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008086ebd2.shtml

hey, thanks for you help

0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 500 total points
Comment Utility
Yeah, EIGRP is in 8 but the same problem applies (inability for multicast traffic to traverse the VPN tunnel).  You could probably get away with using OSPF and defining the network type as "non-broadcast" and manually defining the neighbor (I read a Cisco doc on this once).  I'm not sure the same applies to EIGRP but might be something to look into.  The IP SLA approach is a little simpler.

The config looks good but make sure you put a static host route to the "internet object" so it doesn't become reachable over the 100Mb.

ip route x.x.x.x 255.255.255.255 192.168.40.251

This should route my internet traffic via the 100Mb when the icmp packets to the internet object time out, correct?

Correct, you can do the same for the LAN subnets.  The IP SLA is a good measure since the interface may not actually go down in all cases so the backup routes won't ever be used plus for your Internet failover, the 3750 and 2600 have no knowledge of whether or not the local Internet connection is down and most likely the PIX/ASA will remain up so again no routes will be removed.
0
 
LVL 1

Author Closing Comment

by:Matsco
Comment Utility
Thanks Jfrederick29.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …
There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now