Dipesh,

Why not let the default route be known over the tunnel?  This way failover can occur dynamically removing the need for PBR.  An ACL preventing non-proxy traffic from traversing the tunnel will be easier to maintain then PBR.  Fault Tolerance is the Achilles Heel of PBR as well as predictability and scalability.

Chris

Dear,Gatlin,

Thanks for the reply,

Can you show the sample configuration as per details given in my post?

Default route means you meant to say 0.0.0.0 0.0.0.0 Tunnel1

and on Tunnel1 there is an ACL which filter traffic of all non Proxy traffic. M I right?

But How can it auto change over when one Internet ISP goes down than on to other?

Other thing is that, We are using Static routing s IGP and BGP as OGP. so there are lots of Static routes.

Is there any option of HTTP/WEB Tracking option?

Pleae suggest.

Regards,

Dipesh P.

HI Sobair,

Thanks for the reply.

For Multiple Tracking object using PBR required CDP must enable as shown doc accor to attached link. In my case CDP is disable globally.

Suppose CDP is not an issue than what should I track, Is it Internet ISP - 1 GW ? If it is down than my traffic will be sent using other tunnel next hop address. Is it correct?

Where should I apply PBR means on which Int.?

Please, show me the sample configuration as per the deytails shown in POST. It will be very helpful to understand the scenario.

Regards,

Is there a compelling reason to use the GRE tunnels?  You could announce your enterprise prefixes to the service provider via BGP.  In the case of default (0.0.0.0) use as-path prepend to make site C more attractive. 

### Router C

router bgp 65001
network 0.0.0.0
Exit

### Router D

ip prefix-list DELTA permit 0.0.0.0/0

route-map BGP-OUT permit 10
match ip address prefix-list DELTA
set as-path prepend 65001 65001
exit


router bgp 65001
network 0.0.0.0
neighbor x.x.x.x route-map BGP-OUT ### MPLS PE
exit

This will cause the MPLS network to route default traffic to Router C until it fails.  At that point the default route being announced by Router D will remain and carry the load.  If this approach is taken you should also announce your LAN prefixes to the provider so traffic takes a symmetric path.


Another option is to use an IGP over the tunnels.  For a small network like this RIPv2 is a good choice.  RIPv2 doesn’t get the credit it deserves for small networks; it’s easy to tune in regard to timers and filtering.  If this network is going to grow consider EIGRP.  The example below assumes that default is a static route today. 

### Router C

ip prefix-list DELTA permit 0.0.0.0/0

route-map STATIC2RIP permit 10
match ip address prefix-list DELTA
exit

router rip
version 2
no auto-summary
timers basic 1 3 3 5
network 10.0.0.0
passive-interface default
no passive-interface tunnel 1
distribute-list prefix DELTA out
default metric 1
redistribute static route-map STATIC2RIP
exit

### Router D

ip prefix-list DELTA permit 0.0.0.0/0

route-map STATIC2RIP permit 10
match ip address prefix-list DELTA
set metric 3
exit

router rip
version 2
no auto-summary
timers basic 1 3 3 5
network 10.0.0.0
passive-interface default
no passive-interface tunnel 1
distribute-list prefix DELTA out
default-metric 1
redistribute static route-map STATIC2RIP
exit


### Router A

ip prefix-list PREVENT deny 0.0.0.0/0 le 32

router rip
version 2
no auto-summary
network 10.0.0.0
timers basic 1 3 3 5
passive-interface default
no passive-interface tunnel 1

no passive-interface tunnel 2
distribute-list prefix PREVENT out
exit

The config above allows Router A to learn default via RIP, yet RIP doesn’t advertise any prefixes.  The default route from Router C will look attractive with a metric of 1 while having a metric of 3 from router D.

For this to work it’s important the default route be removed from the routing table when the path to the ISP loses integrity.  If it is a static default to your ISP consider asking them to advertise default to you; RIP could also be used for this.  BGP is another option but seems overkill to simply learn default.  If the provider won’t send you default you can use ‘IP SLA’ to revoke the static default route in the event it a predetermined service isn’t available over the circuit.

As far as preventing hosts other than the proxy from utilizing the default route I’d install and ACL inbound on the LAN interface.  Something like the following may work.

access-list 100 permit ip any 10.0.0.0 0.255.255.255
access-list 100 permit ip any 172.16.0.0 0.31.255.255
access-list 100 permit ip any 192.168.0.0 0.0.255.255
access-list 100 permit ip host x.x.x.x any

### x.x.x.x above allows the proxy source address to reach any internet address.

int
ip access-group 100 in
exit



Chris

Dear Sobair,

Thanks for the reply.I havd tried the same and use Intrnet ISP gateway for tracking. It's working but only when ISP gateway was down.

But in most of the cases ISP Gatway is up but browsing is not working. This is my main concern.

Can you suggest how can I track or what should I track so that if t one location Internet Browsing or any way Internet is not working than my Proxy traffic is automatically diverted to other location with Internet BW as shown in Diagram.

Please reply soon.

Regards,

Dear Mohammad,

Thanks,

Will check the same.

Regards,