Solved: Load Balancing feature can possible between ISP and Tunnels on ASA?

nikuhappy2010 · ‎07-21-2008

Hi,

I have some idea which may be useful in the term of load balancing between tunnels and ISP links...just need to know is it possible or not....

I want to make a network like this with using two links.

Ist Link ISP Router A----ASA FW A--Inside Router A------Inside Network/DMZ A

IIst Link ISP Router B----ASA FW A--Inside Router A------Inside Network/DMZ A

ASA FW A outside Interace 1.1.1.1 connected with Ist ISP Link

ASA FW A outside 1 Interace 2.2.2.2 connected with IInd ISP Link

ASA Interface Inside 192.168.14.1

ASA Interface Inside1 192.168.13.1

Both Inside Interface are connected with Router Eth port and the 3 rd port of router is using for Inside Network (192.168.12.0)

I have created Tunnel on ASA to connect the DC network by configuring both Outsie interface. And both tunnel are working fine If i access by .13.0 or .14.0 network.

Now I set the comand on Inside router:-

Ip route 0.0.0.0 0.0.0.0 192.168.13.1

Ip route 0.0.0.0 0.0.0.0 192.168.14.1

Now in this scenario, can load balancing configre for both tunnels. I add the route comand on FW to tell the ASA for incoming traffic.

192.168.12.0 255.255.255.0 192.168.13.2

192.168.12.0 255.255.255.0 192.168.14.2

Thanks

husycisco · ‎07-22-2008

"Now wud to like to know if i use static routes instead of dynamic routing then why it wont be best practise"

Sure. Lets take the following example

Ip route 0.0.0.0 0.0.0.0 192.168.13.1

This route will stay in the table as long as the inside router's relevant interface is Up. And if interface goes down, this route will get passive. Thats great. If that interface fails, all traffic will be routed through other route only.

But if something happens to link between ASA and ISP router, Or ISP routers internet link goes down, or Site-To-Site VPN tunnel goes down, Inside router will have no idea if they are down or not and keep the route which is actually dead at far end, and your traffic will be load balanced which the packets that are routed wia that dead route will be dropped.

Dynamic routing protocols are a piece of cake. I wrote the necessary commands in the topology that I drew for you (I hope you downloaded it).

Can you show me any example which is related to Interested Traffic as you mentioned that I cant specify the Intersting traffic for both Tunnels. Are you talking about this entries on remote site?? Thanks..

Yes I am talking about remote site. Here is an example

access-list extended Crypto_10_Interesting

permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255

access-list extended Crypto_20_Interesting

permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255

crypto map outside map 10 ipsec-isakmp

set peer ISPrAPublicIP

set transform-set XXX-XXX-XXX

match address Crypto_10_Interesting

crypto map outside map 10 ipsec-isakmp

set peer ISPrAPublicIP

set transform-set XXX-XXX-XXX

match address Crypto_20_Interesting

Both tunnels are established to get to the 192.168.12.0 network, thats why the interesting traffic is destined for the same network. Also source is the same. Now how will router know which crypto map entry to trigger when the matched traffic arrives? It cant! Some scruffy tweaks can me made to that config like PNAT at remote site or defining different sources, but this is really not the best practise.

View solution in original post

husycisco · ‎07-21-2008

Hello Vinay,

Unfortunately, ASA pair can not Load Balance in Active/Active mode. But you have 3 routers and 2 firewalls, so we have options. Here is my suggestion

Establish GRE VPN Tunnel with remote site with both outside routers A and B. Configure EIGRP at remote site and advertise the remote site network from both tunnel interfaces. Also configure your ASAs and Inside Router A in same AS. Now your Inside router gets the same remote network advertised from ASA1 and ASA2, but only one is installed in routing table. Issue "variant 2" command in EIGRP config of inside router and now the remote network is load-balanced.

Regards

nikuhappy2010 · ‎07-21-2008

Well, in my posted scenario I am not using active/active failover. Both ASA are not connected with each other. Thanks

nikuhappy2010 · ‎07-21-2008

I m using only two routers and both ASA inside links are connected with inside router.

husycisco · ‎07-21-2008

Thats OK, so you can apply my suggestion.

nikuhappy2010 · ‎07-21-2008

So, its not possible Load balancing as per my scenario... Can you think about it again. Thanks

nikuhappy2010 · ‎07-21-2008

pl respond,,

husycisco · ‎07-21-2008

If you terminate the tunnels at ISP routers, this is possible with the diagram and config I attached

nikuhappy2010 · ‎07-21-2008

Request :- wud like to ask last question, why the load balancing can't be configured in my scenario. I hope, you will show all reasons and my confusion point will be over. Thanks and I appreciate...

nikuhappy2010 · ‎07-21-2008

?? :)

husycisco · ‎07-21-2008

Load balancing actually can be done with the method you mention, but load balancing with static routes instead dynamic routing protocols is not the best practise.

husycisco · ‎07-21-2008

Also if you choose your way, you again need 2 IPSEC VPN connections at remote office. you are going to have to specify the same interesting traffic ACL for both crypto map entries, and you can not specify the same interesting traffic for two different tunnels, you may have to apply policy NAT to change the IP scope at one of the ASAs

nikuhappy2010 · ‎07-21-2008

Well, I am very much impressed by your answers. Lot of confusion part has been removed. Now wud to like to know if i use static routes instead of dynamic routing then why it wont be best practise. Reason being, I havnt configured the Dynamic routing as yet. Second:- Can you show me any example to configure the policy nat so that I cud test and go into the production. Thanks

nikuhappy2010 · ‎07-21-2008

??

nikuhappy2010 · ‎07-21-2008

Can you show me any example which is related to Interested Traffic as you mentioned that I cant specify the Intersting traffic for both Tunnels. Are you talking about this entries on remote site?? Thanks..