07-21-2008 02:46 PM - edited 03-11-2019 06:17 AM
Hi,
I have some idea which may be useful in the term of load balancing between tunnels and ISP links...just need to know is it possible or not....
I want to make a network like this with using two links.
Ist Link ISP Router A----ASA FW A--Inside Router A------Inside Network/DMZ A
IIst Link ISP Router B----ASA FW A--Inside Router A------Inside Network/DMZ A
ASA FW A outside Interace 1.1.1.1 connected with Ist ISP Link
ASA FW A outside 1 Interace 2.2.2.2 connected with IInd ISP Link
ASA Interface Inside 192.168.14.1
ASA Interface Inside1 192.168.13.1
Both Inside Interface are connected with Router Eth port and the 3 rd port of router is using for Inside Network (192.168.12.0)
I have created Tunnel on ASA to connect the DC network by configuring both Outsie interface. And both tunnel are working fine If i access by .13.0 or .14.0 network.
Now I set the comand on Inside router:-
Ip route 0.0.0.0 0.0.0.0 192.168.13.1
Ip route 0.0.0.0 0.0.0.0 192.168.14.1
Now in this scenario, can load balancing configre for both tunnels. I add the route comand on FW to tell the ASA for incoming traffic.
192.168.12.0 255.255.255.0 192.168.13.2
192.168.12.0 255.255.255.0 192.168.14.2
Thanks
Solved! Go to Solution.
07-22-2008 04:05 AM
"Now wud to like to know if i use static routes instead of dynamic routing then why it wont be best practise"
Sure. Lets take the following example
Ip route 0.0.0.0 0.0.0.0 192.168.13.1
This route will stay in the table as long as the inside router's relevant interface is Up. And if interface goes down, this route will get passive. Thats great. If that interface fails, all traffic will be routed through other route only.
But if something happens to link between ASA and ISP router, Or ISP routers internet link goes down, or Site-To-Site VPN tunnel goes down, Inside router will have no idea if they are down or not and keep the route which is actually dead at far end, and your traffic will be load balanced which the packets that are routed wia that dead route will be dropped.
Dynamic routing protocols are a piece of cake. I wrote the necessary commands in the topology that I drew for you (I hope you downloaded it).
Can you show me any example which is related to Interested Traffic as you mentioned that I cant specify the Intersting traffic for both Tunnels. Are you talking about this entries on remote site?? Thanks..
Yes I am talking about remote site. Here is an example
access-list extended Crypto_10_Interesting
permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255
access-list extended Crypto_20_Interesting
permit ip 172.20.100.0 0.0.0.255 192.168.12.0 0.0.0.255
crypto map outside map 10 ipsec-isakmp
set peer ISPrAPublicIP
set transform-set XXX-XXX-XXX
match address Crypto_10_Interesting
crypto map outside map 10 ipsec-isakmp
set peer ISPrAPublicIP
set transform-set XXX-XXX-XXX
match address Crypto_20_Interesting
Both tunnels are established to get to the 192.168.12.0 network, thats why the interesting traffic is destined for the same network. Also source is the same. Now how will router know which crypto map entry to trigger when the matched traffic arrives? It cant! Some scruffy tweaks can me made to that config like PNAT at remote site or defining different sources, but this is really not the best practise.
07-21-2008 03:06 PM
Hello Vinay,
Unfortunately, ASA pair can not Load Balance in Active/Active mode. But you have 3 routers and 2 firewalls, so we have options. Here is my suggestion
Establish GRE VPN Tunnel with remote site with both outside routers A and B. Configure EIGRP at remote site and advertise the remote site network from both tunnel interfaces. Also configure your ASAs and Inside Router A in same AS. Now your Inside router gets the same remote network advertised from ASA1 and ASA2, but only one is installed in routing table. Issue "variant 2" command in EIGRP config of inside router and now the remote network is load-balanced.
Regards
07-21-2008 03:09 PM
Well, in my posted scenario I am not using active/active failover. Both ASA are not connected with each other. Thanks
07-21-2008 03:14 PM
I m using only two routers and both ASA inside links are connected with inside router.
07-21-2008 03:16 PM
Thats OK, so you can apply my suggestion.
07-21-2008 03:19 PM
So, its not possible Load balancing as per my scenario... Can you think about it again. Thanks
07-21-2008 03:55 PM
pl respond,,
07-21-2008 04:02 PM
07-21-2008 04:10 PM
Request :- wud like to ask last question, why the load balancing can't be configured in my scenario. I hope, you will show all reasons and my confusion point will be over. Thanks and I appreciate...
07-21-2008 04:26 PM
?? :)
07-21-2008 04:43 PM
Load balancing actually can be done with the method you mention, but load balancing with static routes instead dynamic routing protocols is not the best practise.
07-21-2008 04:50 PM
Also if you choose your way, you again need 2 IPSEC VPN connections at remote office. you are going to have to specify the same interesting traffic ACL for both crypto map entries, and you can not specify the same interesting traffic for two different tunnels, you may have to apply policy NAT to change the IP scope at one of the ASAs
07-21-2008 06:33 PM
Well, I am very much impressed by your answers. Lot of confusion part has been removed. Now wud to like to know if i use static routes instead of dynamic routing then why it wont be best practise. Reason being, I havnt configured the Dynamic routing as yet. Second:- Can you show me any example to configure the policy nat so that I cud test and go into the production. Thanks
07-21-2008 06:44 PM
??
07-21-2008 08:28 PM
Can you show me any example which is related to Interested Traffic as you mentioned that I cant specify the Intersting traffic for both Tunnels. Are you talking about this entries on remote site?? Thanks..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide