We recently migrated our edge routers to 2 seperate BGP connections to 2 seperate ISP's. Our routers are running firewall feature set.
While we were going throught the issues with the ISP's we had an IP Inspect ftp statement on the inside interface. Once we finally got the second ISP working we noticed our ftp sessions were failing. I move the inspect statement to the new ISP router because it was our preferred path and the ftp started working again. I really need to have the inspect statements on each inside interface but when I add it the original ISP all ftp stops working.
I can provide more detail regarding our routers if need be.
ip inspect is a smart feature and it works like a firewall: it creates temporary opens if it sees both directions of the flow : the permissions are created if the session setup is seen with asymmetric routing the risk is that the return traffic arrives on the router that hasn't seen the packets in the other directions and that has not opened the temporary permissions traffic is dropped.
You need to try to influence the return path from internet to your AS:
you can use AS path prepending by prepending your own AS number in updates sent to the second ISP (you need to make a choice here if you want to keep using inspect for security or you want to use both ISPs in load balancing without ip inspect)
This is actually a pretty cool feature, i didn't even know it existed until I was looking for a solution to advertise a subnet (prefix in BGP talk), only if a certain condition existed. This is exactly what conditional advertisements does
j ai une question j ai achete un routeur cisco 887VA-k9 , je le configuré avec la configuration ci- dessous
si je le lier avec mon pc portable sur l un de ses ports directement ça marche toute est bien ( la connexion internet + m...
Attached policy provides CLI access to the Cisco 4G router over text messaging. Two files are in the attached .tar file:
2. PDF with instructions on how to load and use the .tcl file.