{"id":1643,"date":"2019-08-10T22:30:00","date_gmt":"2019-08-10T21:30:00","guid":{"rendered":"https:\/\/www.balajibandi.com\/?p=1643"},"modified":"2024-02-06T08:10:33","modified_gmt":"2024-02-06T08:10:33","slug":"dual-isp-failover","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=1643","title":{"rendered":"Dual ISP Failover"},"content":{"rendered":"\n

This Lab to tests Dual ISP failover. <\/p>\n\n\n\n

Task :<\/p>\n\n\n\n

    \n
  1. Make sure both the ISP Links used (not Active\/Standby)<\/li>\n\n\n\n
  2. Make sure failover each ISP – so Lan Segment will not have loss of Internet.<\/li>\n<\/ol>\n\n\n\n

    This is Lab testing, some syntax may change depending on the environment and devices used. (In most cases the concept works as expected.<\/p>\n\n\n\n

    ISP to Google I have used OSPF to make it simple.<\/p>\n\n\n\n

    BB- CE (this is most cases Business Router connected to Dual ISP) – for this testing I have used static routing and PBR.<\/p>\n\n\n\n

    IP SLA – track the reachability, EEM Script to manipulate routing and NAT config. (based on the Track and event alerts)<\/p>\n\n\n\n

    High level network Diagram :<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Basic config :<\/p>\n\n\n\n

    \n
    \n
    \n
    Google<\/td>ISP-COLT<\/td>ISP-BT<\/td>BB-CE<\/td><\/tr>
    interface Loopback0
    ip address 8.8.8.8 255.255.255.255
    !
    interface Ethernet0\/0
    ip address 100.100.10.1 255.255.255.252
    ip ospf network point-to-point
    duplex auto
    !
    interface Ethernet0\/1
    ip address 100.100.20.1 255.255.255.252
    ip ospf network point-to-point
    duplex auto
    !
    router ospf 1
    passive-interface default
    no passive-interface Ethernet0\/0
    no passive-interface Ethernet0\/1
    network 8.8.8.8 0.0.0.0 area 0
    network 100.100.10.0 0.0.0.3 area 0
    network 100.100.20.0 0.0.0.3 area 0
    !<\/td>    		interface GigabitEthernet5
    ip address 172.16.10.1 255.255.255.252
    negotiation auto
    !
    interface GigabitEthernet6
    ip address 100.100.10.2 255.255.255.252
    ip ospf network point-to-point
    negotiation auto
    !
    router ospf 1
    passive-interface default
    no passive-interface GigabitEthernet6
    network 100.100.10.0 0.0.0.3 area 0
    network 172.16.10.0 0.0.0.3 area 0<\/td>    		interface GigabitEthernet6
    ip address 100.100.20.2 255.255.255.252
    ip ospf network point-to-point
    negotiation auto
    !
    interface GigabitEthernet7
    ip address 172.16.20.1 255.255.255.252
    negotiation auto
    !
    router ospf 1
    passive-interface default
    no passive-interface GigabitEthernet6
    network 100.100.20.0 0.0.0.3 area 0
    network 172.16.20.0 0.0.0.3 area 0
    !<\/td>    		interface Ethernet0\/0.1
    encapsulation dot1Q 100
    ip address 10.10.10.1 255.255.255.0
    ip nat inside
    !
    interface Ethernet0\/0.2
    encapsulation dot1Q 200
    ip address 20.20.20.1 255.255.255.0
    !
    interface Ethernet0\/1
    description ISP_COLT
    ip address 172.16.10.2 255.255.255.0
    !
    interface Ethernet0\/2
    description ISP_BT
    ip address 172.16.20.2 255.255.255.0
    !
    ip route 0.0.0.0 0.0.0.0 172.16.20.1
    ip route 0.0.0.0 0.0.0.0 172.16.10.1<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n

    LAN-SW config :<\/p>\n\n\n\n

    vlan 100, 200<\/p>\n\n\n\n

    interface GigabitEthernet0\/0
    switchport trunk allowed vlan 100,200
    switchport trunk encapsulation dot1q
    switchport mode trunk
    negotiation auto
    !
    interface GigabitEthernet0\/1
    switchport access vlan 100
    switchport mode access
    negotiation auto
    !
    interface GigabitEthernet0\/2
    switchport access vlan 200
    switchport mode access
    negotiation auto<\/p>\n\n\n\n

    Testing basic connectivity :<\/p>\n\n\n\n

    ISP to Google :<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    LAN to Router Gateway testing :<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Now the task is to send Development traffic to ISP COLT and USER traffic to ISP BT<\/p>\n\n\n\n

    Once ISP COLT Links fail, all the Traffic will be directed to ISP BT, Once ISP COLT Link UP Load-split again based on the requirement.<\/p>\n\n\n\n

    Same ISP BT Links fails, All the traffic will be directed to ISP COLT, Once the ISP BT Link comes back to Orginal requirement.<\/p>\n\n\n\n

    BB- CE config as below :<\/p>\n\n\n\n

    Access List to match the traffic :<\/strong><\/p>\n\n\n\n

    access-list 110 permit ip 10.10.10.0 0.0.0.255 any
    access-list 120 permit ip 20.20.20.0 0.0.0.255 any<\/p>\n\n\n\n

    Route map for PBR<\/strong><\/p>\n\n\n\n

    route-map ISP_COLT permit 10
    match ip address 110
    match interface Ethernet0\/1
    !
    route-map ISP_BT permit 10
    match ip address 120
    match interface Ethernet0\/2
    !
    route-map BT_PBR permit 10
    match ip address 120
    set interface Ethernet0\/2
    !
    route-map COLT_PBR permit 10
    match ip address 110
    set interface Ethernet0\/1
    !<\/p>\n\n\n\n

    NAT for respected ISP :<\/strong><\/p>\n\n\n\n

    ip nat inside source route-map ISP_BT interface Ethernet0\/2 overload
    ip nat inside source route-map ISP_COLT interface Ethernet0\/1 overload<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    IP SLA and Tracking config :<\/strong><\/p>\n\n\n\n

    ip sla 10
    icmp-echo 8.8.8.8 source-interface Ethernet0\/1
    frequency 10
    ip sla schedule 10 life forever start-time now
    ip sla 20
    icmp-echo 8.8.8.8 source-interface Ethernet0\/2
    frequency 10
    ip sla schedule 20 life forever start-time now<\/p>\n\n\n\n

    track 1 ip sla 10 reachability
    track 2 ip sla 20 reachability<\/p>\n\n\n\n

    Apply NAT config PBR on interfaces :<\/strong><\/p>\n\n\n\n

    interface Ethernet0\/0.1
    ip nat inside
    ip policy route-map COLT_PBR
    !
    interface Ethernet0\/0.2
    ip nat inside
    ip policy route-map BT_PBR<\/p>\n\n\n\n

    !<\/p>\n\n\n\n

    interface Ethernet0\/1
    description ISP_COLT
    ip nat outside
    !
    interface Ethernet0\/2
    description ISP_BT
    ip nat outside<\/p>\n\n\n\n

    EEM Script to Track the events and action :<\/strong><\/p>\n\n\n\n

    event manager applet COLT_DOWN
    event track 1 state down
    action 1.0 cli command “enable”
    action 2.0 cli command “conf t”
    action 2.1 cli command “interface Ethernet0\/0.1”
    action 2.2 cli command “no ip policy route-map COLT_PBR”
    action 2.3 cli command “exit”
    action 3.0 cli command “no access-list 120”
    action 4.0 cli command “access-list 120 permit ip 10.10.10.0 0.0.0.255 any”
    action 5.0 cli command “access-list 120 permit ip 20.20.20.0 0.0.0.255 any”
    action 6.0 cli command “no ip route 0.0.0.0 0.0.0.0 172.16.10.1”
    action 7.0 cli command “no ip nat inside source route-map ISP_COLT interface Ethernet0\/1 overload”
    action 8.0 cli command “exit”
    action 9.0 cli command “clear ip nat translation *”
    action 9.1 cli command “end”
    event manager applet COLT_UP
    event track 1 state up
    action 1.0 cli command “enable”
    action 2.0 cli command “conf t”
    action 2.1 cli command “interface Ethernet0\/0.1”
    action 2.2 cli command “ip policy route-map COLT_PBR”
    action 2.3 cli command “exit”
    action 3.0 cli command “no access-list 120”
    action 4.0 cli command “access-list 120 permit ip 20.20.20.0 0.0.0.255 any”
    action 5.0 cli command “ip route 0.0.0.0 0.0.0.0 172.16.10.1”
    action 6.0 cli command “ip nat inside source route-map ISP_COLT interface Ethernet0\/1 overload”
    action 7.0 cli command “exit”
    action 8.0 cli command “clear ip nat translation *”
    action 9.0 cli command “end”
    event manager applet BT_DOWN
    event track 2 state down
    action 1.0 cli command “enable”
    action 2.0 cli command “conf t”
    action 2.1 cli command “interface Ethernet0\/0.2”
    action 2.2 cli command “no ip policy route-map BT_PBR”
    action 2.3 cli command “exit”
    action 3.0 cli command “no access-list 110”
    action 4.0 cli command “access-list 110 permit ip 10.10.10.0 0.0.0.255 any”
    action 5.0 cli command “access-list 110 permit ip 20.20.20.0 0.0.0.255 any”
    action 6.0 cli command “no ip route 0.0.0.0 0.0.0.0 172.16.20.1”
    action 7.0 cli command “no ip nat inside source route-map ISP_BT interface Ethernet0\/2 overload”
    action 8.0 cli command “exit”
    action 9.0 cli command “clear ip nat translation *”
    action 9.1 cli command “end”
    event manager applet BT_UP
    event track 2 state up
    action 1.0 cli command “enable”
    action 2.0 cli command “conf t”
    action 2.1 cli command “interface Ethernet0\/0.2”
    action 2.2 cli command “ip policy route-map BT_PBR”
    action 2.3 cli command “exit”
    action 3.0 cli command “no access-list 110”
    action 4.0 cli command “access-list 110 permit ip 10.10.10.0 0.0.0.255 any”
    action 5.0 cli command “ip route 0.0.0.0 0.0.0.0 172.16.20.1”
    action 6.0 cli command “ip nat inside source route-map ISP_BT interface Ethernet0\/2 overload”
    action 7.0 cli command “exit”
    action 8.0 cli command “clear ip nat translation *”
    action 9.0 cli command “end”
    !<\/p>\n\n\n\n

    Testings in Normal conditions:<\/strong><\/p>\n\n\n\n

    IP SLA tracking :<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    DEV-PC reaching google.<\/p>\n\n\n\n

    \"\"
    User PC reaching google :<\/figcaption><\/figure>\n\n\n\n
    \"\"
    Test Fail over testing : COLT Link<\/figcaption><\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    4 ping drops : (dev PC) – No ping Loss observed on User Lan<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Once the Link come back :<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    In case anyone need a full config of BB-CE<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    BB-CE<\/a>Download<\/a><\/div>\n\n\n\n

    If you have Single Lan Subnet you can use below configuration <\/p>\n\n\n\n

    Dual-ISP-Single-subnet<\/a>Download<\/a><\/div>\n\n\n\n

    Happy Labbing …..!!!!!!!!!!!!!!!!<\/p>\n","protected":false},"excerpt":{"rendered":"

    This Lab to tests Dual ISP failover. Task : This is Lab testing, some syntax may change depending on the environment and devices used. (In most cases the concept works as expected. ISP to Google I have used OSPF to make it simple. BB- CE (this is most cases Business Router connected to Dual ISP) […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1643","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1643"}],"version-history":[{"count":4,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1643\/revisions"}],"predecessor-version":[{"id":2080,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1643\/revisions\/2080"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}