• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 812
  • Last Modified:

Juniper SSG 5 Multiple wan for internet load balncing

Hi I have a ssg-5 router currently configured to do round robin internet load sharing between two adsl connections one via pppoe and the other plain dhcp. I want to add two more adsl connections to it. However when I add the 3rd connection the ssg-5 is not offering any traffic to it.
How do I get 4 connections sharing all internet traffic.

Thx
0
Bush300
Asked:
Bush300
1 Solution
 
Sanga CollinsSystems AdminCommented:
Have you tried usinfncustom virtual routers to configure additional WAN interfaces.
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
The SSGs aren't really load balancing (that is not in their feature set). You have the choices of
1. "round-robin default routes", which is probably what you have used up to now, and
2. source/destination/policy-based static routing

For 1. the default (me thinks) for same-cost routes is 2, so adding more interfaces will not allow them to be chosen for default routes unless you issue
set vrouter «vr-name» max-ecmp-routes 4

Open in new window

(with «vr-name» probably being trust-vr).
I don't know whether you are aware of it, but HTTP(s) connections and the like will have issues with this kind of "load balancing", as the multiple sessions created usually have different public IP addresses when spread over the WAN connections, and so are unrelated. Logging in to a HTTPS site will not allow to assign sessions reliably, so it is by accident if it works.

Hence 2. is the better way. You have reliable rules how traffic will flow, but you can't spread traffic for the same source or target or protocol or combination. That is, you can e.g. send all traffic from 192.168.0.0/64 to one interface, 192.168.0.64/64 to the next, aso.

You could also do a mixture of both; sensitive protocols, like HTTPS, will be restricted to a single interface by policy-based routing, other protocols are left to the round-robin.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now