Solved

how do i use redundancy between two ISPs

Posted on 2009-05-08
4
677 Views
Last Modified: 2012-08-13
I have two ISP links terminated on my ASA, currently sending traffic on both the links, would like have redundancy as well for the same setup. below is the code for the same.
global (outside) 1 202.x.x.x

global (outside) 2 203.x.x.x

nat (inside) 1 10.235.0.0 255.255.255.0

nat (inside) 1 10.235.3.0 255.255.255.0

nat (inside) 1 10.235.4.0 255.255.255.0

nat (inside) 2 10.235.9.0 255.255.255.0

nat (inside) 1 10.235.26.0 255.255.255.0

nat (inside) 1 10.235.30.0 255.255.255.0

nat (inside) 1 10.235.32.0 255.255.255.0

nat (inside) 2 10.235.46.0 255.255.255.0

nat (inside) 1 10.235.120.0 255.255.255.0

Open in new window

0
Comment
Question by:shivakumartalla
4 Comments
 
LVL 2

Accepted Solution

by:
Tim1130 earned 150 total points
ID: 24338390
I not much versed in CISCO, but at IP level technical possibilities are like this:

1) having a default route to both ISP's: (this looks like what you are doing)
This will provide the best load-balancing and implicit failover, but it will only work with standard HTTP, with everything session based (like HTTPS), this will not work, because the packets will arrive from either link (with different routing IP's). Therefore, this solution is not practical at all.

2) routing based internet:
Basically, you divide your internal address range in half, and route either one over one of the ISP's. Or, you connect the servers to one ISP, and the users to the other. And any combination in between. If your equipment is really good (allows that), you can also add failover rules to the other link.

3) a true router failover cluster:
You assign one link as primary, and the second link as a backup. All traffic will go one way, until the link fails over to the backup (and of course fails back once the primary link is up again). Usually you use the better quality link as primary, and the secondary does not need the same quality (speed=cost).
If you can burn all that cash for an unused (standby) line, then you are also well advised to buy a second physical router(w ADSL), because what good are two links if your one single router is down ? (yes, CISCO do last long, but if you have as many as I do, you will notice they also do fail sometimes).

Unfortunately, true load-balancing is only possible at the server side, and for that you need special hardware as well (not just simple routers).

HTH
0
 
LVL 3

Assisted Solution

by:sherenian
sherenian earned 50 total points
ID: 24339049
This is a reason why many servers come with Dual Ethernet so you can link to different sources (ISP's) as a failover assurance.  You can even isolate the routes on the servers so that certain traffic is sent over one ISP and critical traffic is sent over the other.

What Tim said in comment #3 is correct, the TRUE way to do this is to have routers with fail-over and load-balancing capability such as one like this    http://www.xincom.com/products/502/overview.php    there are many others.  Perhaps you can isolate your internet traffic and put in a single router with fail-over where your network meets the internet.  This will allow for ISP failover, but not for router failure within your network.
0
 
LVL 16

Assisted Solution

by:Aaron Street
Aaron Street earned 50 total points
ID: 24358847
what tim said is correct.

If you have at least two ccisco routers then you can set up redundency bertween them. HSRP is simple to set up and as well as offereing full fail over redundency, you can also set up some simple loadbalancing, and if implemented well can

by setting each router as the default route to one isp, then setting two hsrp groups each with a different router as primary.

you end up with only two ip routes out of site that you can run your load balancing aginst, while at the same time both have full physical redundency,

and by putting a few tracks on the health of indiual ISP's status, you can use hsrp to also fail over in the case of a connection down or routing error on one of the link.

so all your redundency is taken care of in a single package, leaving a simple set of interfaces interface to configer the loadbalancing on. be that router based or server based solution (most likly a mix of the two).

0
 

Author Comment

by:shivakumartalla
ID: 24359608
Thanks Guys,

Actually even i had the same second option in my mind but Cost is the factor in this.

0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

This article is a step by step guide on how to create a basic PTP link using Ubiquiti airOS devices. This guide can be used on the following Ubiquiti AirMAX devices. Nanostation, Bullets, AirBridge, Nanobeam, NanoBridge to name a few. Please review …
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now