• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 600
  • Last Modified:

Questions about Multi-Link Multi-Homing, across multiple locations

Just in case the subject does not say what I think it says (I'm not very familiar with this particular topic).  Attached is the theoretical physical network topology.

I want to have 3 separate internet connections, one in each of my 3 facilities, all "rolled up" to provide a unified method of accessing web servers on my DMZ(s).

Each facility has a site to site link.

So, to simplify things lets assume I have 3 sites and 3 public IPs: on site 1, on site 2, on site 3.

Lets assume that I have a web server NATed on, which I want to be equally available from all 3 sites (obviously preferring the router at, which I suspect it will do automagically?).

To avoid the pitfalls of Round-Robin DNS, I have a single A record pointing www.company.com to

Now, I suspect that the following methods can be used:
1) BGP
Would likely be the best method in a perfect world, but I haven't got a /24 subnet at my disposal.

2) Static Routes + Metrics on routers
Since the links are very likely all going to be from the same ISP (lack of available alternatives) I could, in theory, just pay them money and ask them to set static routes and metrics to each of my 3 public IPs, such that the alternates (#2 and #3) would be used in the event of saturation or link-down situations.  Guessing this would be incredibly messy?

In short, how can I have a single A record reachable from three public IPs, without using BGP?
  • 2
  • 2
1 Solution
Yes, you can have a single A record with 3 different IP addresses.  However it will NOT accomplish what you want.

1) The DNS server will hand out the IP addresses in round robin fashion.  First query will get, second query will get, third query will get, fouth query will get

2) Desktops on the Internet very seldom actually query your DNS server.  They use either internal resolvers or their ISP's resolvers.  Which means if you have 30 customers that all use the same ISP, the ISP's resolver will do a single query to your DNS server, cache the results and then use that IP address for all queries until the TTL for the host expires.

3) DNS round robin does not detect link status.  If the link to site 1 goes down, the DNS server will still hand out the IP address one out of every three queries.  Anybody that has cached will still try to connect to and fail.

If all 3 links are from the same ISP, you would need to see if they can route through all 3 sites.
lunanatAuthor Commented:
Not quite what I was referring to - I'm specifically looking for ways around Round-Robin dns.. not a way to implement it without its pitfalls.

The single A record would be a single IP address.

That being said, at the end of your post you mention routing through all three sites - I had suspected this would be the main method, but I'm not very sure of the topic as I've never actually implemented any routing beyond some vlans on layer 3 switches where the routing basically just took care of itself.

It's doable, if the ISP is willing, to simply tell "the internet" (which really in this case I expect would be the ISP's routers) that there are higher-cost paths available to reach should the lowest cost path be either saturated or down?
Ops read through you post a bit quick and answered with things you already knew about.

Now you could have some problems attempting to do what you want.

Your address would need to be on each of your 3 firewalls.

Your ISP will have to configure their network to send traffic to via their their routers at their site.

Your firewalls will need to send to the appropriate internal IP address and will more than likely need to NAT the users external address to an internal address.  

The reason for NAT'ing the users outside address to an internal address is so that your site 2 layer 3 router routes the response back through the link the request came in on.  So all traffic coming from site 1 firewall will have a source address of say, all traffic coming from site 2 firewall will have a, and all traffic from site 3's firewall will have

If you don't do this, then the site 2 L3 router is going to send the response out via its default route which means you may have request come in from site1's link and try to go back out via site 2's.  The problem is that site 2's firewall did not see the inbound request and may think something is wrong and drop the response.
lunanatAuthor Commented:
Thanks, that's exactly what I was looking to read.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now