Questions about Multi-Link Multi-Homing, across multiple locations

Just in case the subject does not say what I think it says (I'm not very familiar with this particular topic).  Attached is the theoretical physical network topology.

I want to have 3 separate internet connections, one in each of my 3 facilities, all "rolled up" to provide a unified method of accessing web servers on my DMZ(s).

Each facility has a site to site link.

So, to simplify things lets assume I have 3 sites and 3 public IPs: on site 1, on site 2, on site 3.

Lets assume that I have a web server NATed on, which I want to be equally available from all 3 sites (obviously preferring the router at, which I suspect it will do automagically?).

To avoid the pitfalls of Round-Robin DNS, I have a single A record pointing to

Now, I suspect that the following methods can be used:
1) BGP
Would likely be the best method in a perfect world, but I haven't got a /24 subnet at my disposal.

2) Static Routes + Metrics on routers
Since the links are very likely all going to be from the same ISP (lack of available alternatives) I could, in theory, just pay them money and ask them to set static routes and metrics to each of my 3 public IPs, such that the alternates (#2 and #3) would be used in the event of saturation or link-down situations.  Guessing this would be incredibly messy?

In short, how can I have a single A record reachable from three public IPs, without using BGP?
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Yes, you can have a single A record with 3 different IP addresses.  However it will NOT accomplish what you want.

1) The DNS server will hand out the IP addresses in round robin fashion.  First query will get, second query will get, third query will get, fouth query will get

2) Desktops on the Internet very seldom actually query your DNS server.  They use either internal resolvers or their ISP's resolvers.  Which means if you have 30 customers that all use the same ISP, the ISP's resolver will do a single query to your DNS server, cache the results and then use that IP address for all queries until the TTL for the host expires.

3) DNS round robin does not detect link status.  If the link to site 1 goes down, the DNS server will still hand out the IP address one out of every three queries.  Anybody that has cached will still try to connect to and fail.

If all 3 links are from the same ISP, you would need to see if they can route through all 3 sites.
lunanatAuthor Commented:
Not quite what I was referring to - I'm specifically looking for ways around Round-Robin dns.. not a way to implement it without its pitfalls.

The single A record would be a single IP address.

That being said, at the end of your post you mention routing through all three sites - I had suspected this would be the main method, but I'm not very sure of the topic as I've never actually implemented any routing beyond some vlans on layer 3 switches where the routing basically just took care of itself.

It's doable, if the ISP is willing, to simply tell "the internet" (which really in this case I expect would be the ISP's routers) that there are higher-cost paths available to reach should the lowest cost path be either saturated or down?
Ops read through you post a bit quick and answered with things you already knew about.

Now you could have some problems attempting to do what you want.

Your address would need to be on each of your 3 firewalls.

Your ISP will have to configure their network to send traffic to via their their routers at their site.

Your firewalls will need to send to the appropriate internal IP address and will more than likely need to NAT the users external address to an internal address.  

The reason for NAT'ing the users outside address to an internal address is so that your site 2 layer 3 router routes the response back through the link the request came in on.  So all traffic coming from site 1 firewall will have a source address of say, all traffic coming from site 2 firewall will have a, and all traffic from site 3's firewall will have

If you don't do this, then the site 2 L3 router is going to send the response out via its default route which means you may have request come in from site1's link and try to go back out via site 2's.  The problem is that site 2's firewall did not see the inbound request and may think something is wrong and drop the response.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
lunanatAuthor Commented:
Thanks, that's exactly what I was looking to read.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Architecture

From novice to tech pro — start learning today.