Link to home
Start Free TrialLog in
Avatar of bidgadget
bidgadgetFlag for United States of America

asked on

Two default gateways on Windows 2016 network

I have a network with two different ISP's on two different firewalls.  I want to create an internet failover on my network and figure if I use two different default gateways in my Windows 2016 DHCP server I can accomplish this.  Is there any reason I should not do this and if so do you have any recommendations.


Avatar of Paul MacDonald
Paul MacDonald
Flag of United States of America image

BGP was in fashion last time I had to deal with this.  Just giving your clients two default gateways won't accomplish what you want.  You might get close by setting two different routing metrics.

Ultimately what you want is one default gateway that connects to both ISPs, even if that one default gateway is an active/passive or active/active cluster of routers.


You cannot have two default gateways. Trying to configure that leads to all kind of failures. Best solution, if you can make sure the hardware still works and you can change configuration of the ISP facing routers, is to use one of them as default gateway, and let it manage the actual route to the internet (by adding a fall-back route to the other router with a higher "cost"). As soon as the ISP interface will fail, the fall-back route will be used.
You can't have two different default gateways. There can be only 1. If you have two routes if equal cost, how do you pick the correct one, and how do you know if a route has failed?

What type of networking equipment that you have? Switches, firewalls, and routers are all important here.

Many firewalls accept multiple WAN connections and can failover between them. That is probably easiest.

If you have a L3 switch or internal router, you can potentially setup dynamic routing with the firewalls or reliable static routing, but it all depends on the gear you have or can get.

It is also useful to know if you are trying to protect against equipment failure in addition to circuit/ISP failure.
As has been stated, you can't have more than one DEFAULT gateway.  You can have two routers (typically same brand, often same model) that both support multiple WAN links and ALSO support failover with something like VRRP (Virtual Router Redundancy Protocol). I use Untangle.  The free version doesn't support this, but the paid version does.  And there are other products that support it as well.

Details on the Untangle implementation:
https://support.untangle.com/hc/en-us/articles/115013112587-Requirements-to-run-VRRP-on-Untangle
To handle what you are after, you have to use a single point through which your lan traffic flows and the device will then route the traffic out the ISP connection based on your choices.
I.e. ISP1 is primary, in its absence, ISP2 will be the ..

You say you have two firewalls, make and model.
What type of connection each ISP connection is using?

You can use a dual-wan router.

Paul's suggestion presumes you own your own IP block.

You might be able to setup routing protocols between your two firewalls though the complexity is such that one has to be the primary
ISP1 is your preferred out
ISP1.                    ISP2
FIrewall1<==>.  Firewall2
LAN
Systems

The connection between Firewall1 and firewall2 has two handling the LAN of Firewall1 is nated and can be passed out the Firewall2 out via ISP2

What are your LAN resource demand, number of users, systems?
You could look at sonicwall, Cisco Asa, Juniper firewalls, fortinet's fortigate, etc.
Avatar of bidgadget

ASKER

thank you all.  I am using two different checkpoint 1570 firewalls.  I can set them up with dual WANS and achieve this but I need both of the internet connections for different things so I was hoping I can achieve this using my windows DHCP.  I also have a Cisco router on the network and I guess I can use that as well.
DHCP, if it worked, would give you the least amount of control. Your firewalls should be able to be put into a dual WAN configuration. You should also be able to setup the firewalls in a HA setup (I haven't checked your specific firewalls). Finally, the firewalls should be able to set primary and secondary paths for different kinds of traffic, based upon source IP, destination IP, application, port, etc.
Please detail your needs?
You can Look at having the two as a pair, define IPs from each ?ISP mapped to ..
you could setup routing rules, access to a specific destination over isp1.interface
...
.
I'm not sure about CheckPoint, but we have plenty of SonicWALL setups that have dual WAN with failover plus inbound rules for various services that are set up for each individual WAN port/subnet.

It's not that difficult to do if the device is capable of it which it should be if it has dual WAN capabilities. 
I have contacted checkpoint.  My options are to create a cluster but then I would need to put a firewall in an inactive state so that is not an option.  I could also use 2 ISP's on same firewall but that is what I was trying to avoid.  I also have a Cisco router on my my network which I can use as a gateway.  Does anyone know if there is a way I can configure the Cisco router to auto switch if a particular ISP goes down?
ASKER CERTIFIED SOLUTION
Avatar of kevinhsieh
kevinhsieh
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Not sure I understand your dilemma,
Clustering the two would provide redundancy, should one fail, the other will continue to function without impact on users/services.


Which Cisco router do you have?
There are tests you can runon the router to oit or the presence of a connection.
If the connection is not there, to exclude that as a path for routing.

https://www.cisco.com/c/en/us/support/docs/ip/ip-routing/200785-ISP-Failover-with-default-routes-using-I.html
All very helpful. I am going to use the Cisco static route solution and an SLA to ping the interface. 
IMHO, IP SLA needs to check an IP through your ISP to the Internet for best results. For example, I would put a static route for 4.1.1.1 to ISP A, and another static route to 4.1.1.2 to ISP B. That way, I knew if the entire path from me, through the ISP to the Internet was good. You can't just ping the equipment, or even an IP owned by the ISP or you may not detect problems further upstream.