Load Balancing feature can possible between ISP and Tunnels on ASA?

Answered Question
Jul 21st, 2008

Hi,


I have some idea which may be useful in the term of load balancing between tunnels and ISP links...just need to know is it possible or not....

I want to make a network like this with using two links.


Ist Link ISP Router A----ASA FW A--Inside Router A------Inside Network/DMZ A


IIst Link ISP Router B----ASA FW A--Inside Router A------Inside Network/DMZ A


ASA FW A outside Interace 1.1.1.1 connected with Ist ISP Link


ASA FW A outside 1 Interace 2.2.2.2 connected with IInd ISP Link


ASA Interface Inside 192.168.14.1

ASA Interface Inside1 192.168.13.1


Both Inside Interface are connected with Router Eth port and the 3 rd port of router is using for Inside Network (192.168.12.0)


I have created Tunnel on ASA to connect the DC network by configuring both Outsie interface. And both tunnel are working fine If i access by .13.0 or .14.0 network.


Now I set the comand on Inside router:-


Ip route 0.0.0.0 0.0.0.0 192.168.13.1

Ip route 0.0.0.0 0.0.0.0 192.168.14.1


Now in this scenario, can load balancing configre for both tunnels. I add the route comand on FW to tell the ASA for incoming traffic.


192.168.12.0 255.255.255.0 192.168.13.2

192.168.12.0 255.255.255.0 192.168.14.2


Thanks


Correct Answer by husycisco about 8 years 7 months ago

"Now wud to like to know if i use static routes instead of dynamic routing then why it wont be best practise"

Sure. Lets take the following example


Ip route 0.0.0.0 0.0.0.0 192.168.13.1

This route will stay in the table as long as the inside router's relevant interface is Up. And if interface goes down, this route will get passive. Thats great. If that interface fails, all traffic will be routed through other route only.

But if something happens to link between ASA and ISP router, Or ISP routers internet link goes down, or Site-To-Site VPN tunnel goes down, Inside router will have no idea if they are down or not and keep the route which is actually dead at far end, and your traffic will be load balanced which the packets that are routed wia that dead route will be dropped.

Dynamic routing protocols are a piece of cake. I wrote the necessary commands in the topology that I drew for you (I hope you downloaded it).

Can you show me any example which is related to Interested Traffic as you mentioned that I cant specify the Intersting traffic for both Tunnels. Are you talking about this entries on remote site?? Thanks..


Yes I am talking about remote site. Here is an example


access-list extended Crypto_10_Interesting

permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255


access-list extended Crypto_20_Interesting

permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255



crypto map outside map 10 ipsec-isakmp

set peer ISPrAPublicIP

set transform-set XXX-XXX-XXX

match address Crypto_10_Interesting


crypto map outside map 10 ipsec-isakmp

set peer ISPrAPublicIP

set transform-set XXX-XXX-XXX

match address Crypto_20_Interesting


Both tunnels are established to get to the 192.168.12.0 network, thats why the interesting traffic is destined for the same network. Also source is the same. Now how will router know which crypto map entry to trigger when the matched traffic arrives? It cant! Some scruffy tweaks can me made to that config like PNAT at remote site or defining different sources, but this is really not the best practise.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
husycisco Mon, 07/21/2008 - 15:06

Hello Vinay,

Unfortunately, ASA pair can not Load Balance in Active/Active mode. But you have 3 routers and 2 firewalls, so we have options. Here is my suggestion

Establish GRE VPN Tunnel with remote site with both outside routers A and B. Configure EIGRP at remote site and advertise the remote site network from both tunnel interfaces. Also configure your ASAs and Inside Router A in same AS. Now your Inside router gets the same remote network advertised from ASA1 and ASA2, but only one is installed in routing table. Issue "variant 2" command in EIGRP config of inside router and now the remote network is load-balanced.


Regards

nikuhappy2010 Mon, 07/21/2008 - 15:09

Well, in my posted scenario I am not using active/active failover. Both ASA are not connected with each other. Thanks

nikuhappy2010 Mon, 07/21/2008 - 15:14

I m using only two routers and both ASA inside links are connected with inside router.

nikuhappy2010 Mon, 07/21/2008 - 15:19

So, its not possible Load balancing as per my scenario... Can you think about it again. Thanks

nikuhappy2010 Mon, 07/21/2008 - 16:10

Request :- wud like to ask last question, why the load balancing can't be configured in my scenario. I hope, you will show all reasons and my confusion point will be over. Thanks and I appreciate...

husycisco Mon, 07/21/2008 - 16:43

Load balancing actually can be done with the method you mention, but load balancing with static routes instead dynamic routing protocols is not the best practise.

husycisco Mon, 07/21/2008 - 16:50

Also if you choose your way, you again need 2 IPSEC VPN connections at remote office. you are going to have to specify the same interesting traffic ACL for both crypto map entries, and you can not specify the same interesting traffic for two different tunnels, you may have to apply policy NAT to change the IP scope at one of the ASAs

nikuhappy2010 Mon, 07/21/2008 - 18:33

Well, I am very much impressed by your answers. Lot of confusion part has been removed. Now wud to like to know if i use static routes instead of dynamic routing then why it wont be best practise. Reason being, I havnt configured the Dynamic routing as yet. Second:- Can you show me any example to configure the policy nat so that I cud test and go into the production. Thanks

nikuhappy2010 Mon, 07/21/2008 - 20:28

Can you show me any example which is related to Interested Traffic as you mentioned that I cant specify the Intersting traffic for both Tunnels. Are you talking about this entries on remote site?? Thanks..

Correct Answer
husycisco Tue, 07/22/2008 - 04:05

"Now wud to like to know if i use static routes instead of dynamic routing then why it wont be best practise"

Sure. Lets take the following example


Ip route 0.0.0.0 0.0.0.0 192.168.13.1

This route will stay in the table as long as the inside router's relevant interface is Up. And if interface goes down, this route will get passive. Thats great. If that interface fails, all traffic will be routed through other route only.

But if something happens to link between ASA and ISP router, Or ISP routers internet link goes down, or Site-To-Site VPN tunnel goes down, Inside router will have no idea if they are down or not and keep the route which is actually dead at far end, and your traffic will be load balanced which the packets that are routed wia that dead route will be dropped.

Dynamic routing protocols are a piece of cake. I wrote the necessary commands in the topology that I drew for you (I hope you downloaded it).

Can you show me any example which is related to Interested Traffic as you mentioned that I cant specify the Intersting traffic for both Tunnels. Are you talking about this entries on remote site?? Thanks..


Yes I am talking about remote site. Here is an example


access-list extended Crypto_10_Interesting

permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255


access-list extended Crypto_20_Interesting

permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255



crypto map outside map 10 ipsec-isakmp

set peer ISPrAPublicIP

set transform-set XXX-XXX-XXX

match address Crypto_10_Interesting


crypto map outside map 10 ipsec-isakmp

set peer ISPrAPublicIP

set transform-set XXX-XXX-XXX

match address Crypto_20_Interesting


Both tunnels are established to get to the 192.168.12.0 network, thats why the interesting traffic is destined for the same network. Also source is the same. Now how will router know which crypto map entry to trigger when the matched traffic arrives? It cant! Some scruffy tweaks can me made to that config like PNAT at remote site or defining different sources, but this is really not the best practise.

nikuhappy2010 Tue, 07/22/2008 - 15:18

Brilliant.... Thanks and I appreciate. Can you send me any example if I use the load balancer device like linkproof then able to make Load Balancing between Links and Tunnels.

husycisco Tue, 07/22/2008 - 16:59

You are welcome :)

I have experienced Drytek and Cisco Linksys load balancers. But they again have the same problem I previously addressed. They can not understand the status of the link connected to far end device, and they run a service called NSD (Network Service Detection) (name depends on brand, but the function is same) to understand if the link is up or down. Long story short, you specify a destination address to ping (or some other services) in predefined intervals, if %x is lost, load balancer stops sending data over that link, untill ping becomes responsive. Much like ip sla monitors in cisco routers and firewalls.

In general, Load Balancer is deployed as ISP routers connected to LB and inside clients or switch to LB, but in your scenario, your inside router should be replaced with LB two ASAs connected to LB and inside switch to LB. NSDs can be set for pinging a device in remote site in intervals to understand if the tunel is up, and can be set to ping the gateway of your ISP router to detect internet connection failures.

nikuhappy2010 Tue, 07/22/2008 - 19:47

If I go with the same details as you mentioned then will it be a best practise. Can you post a network diagrame with IP details so that it will be more easier to understand all entire things. Thanks

nikuhappy2010 Tue, 07/22/2008 - 19:56

If i use dynamic routing protocols instead of static routed then the local site issue will be resolved.. Is it right????? But the prblem is on the remote location. Can you give me any other suggestion which well be use for best practise and cud be implement in the production. Thanks...

husycisco Wed, 07/23/2008 - 05:06

Best practise will be my very first advise with diagram attached. Since interesting traffic ACL will be based on the gre traffic created to different destinations, there wont be any issues.

a.alekseev Wed, 07/23/2008 - 05:17

you are using standalone ASAs,

you cannot loadbalance through them because of asymmetric routing.


session goes through one ASA and return traffic goes though another.


This contradict with a statful inspection.


In this case you must use contexts and ASR-group on ASAs


Actions

This Discussion