Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

OER and routing problems

I'm trying to create a load-balanced/fail-over configuration for a customer using a single router. My customer can't get any routing information from the ISP and most likley will not have a down interface during an outage I thought OER would be the ideal way to go. I'm having all kinds of difficulty with this.

My test lab has a DSL connection and a Cable modem connection which both have dynamic IP addressing. I have a Cisco 2811 router with a 4-port 10/100 HWIC. The integrated FA ports are configured for the ISP connections. I've created a VLAN on 4-port HWIC to communicate with my LAN. At this time I'm not convinced I have an OER problem but more of a general routing issue. My first question is how should I create my default routes? If I create two 'ip route 0.0.0.0 0.0.0.0 fa0/x DHCP' nothing works, I'll intermittenly get a packet to go through. I thought this was a pretty normal configuration? I currently have the two default routes configured with different administrative distances. This allows me to get to the Internet but fail-over doesn't happen during a brown-out, OER doesn't take over. Attached is my configuration, I've tried this with all OER configuration removed still no luck.

My second question is, does anybody have a functional OER configuration they could share? Information on this is hard to come by. Any suggestions would be appreciated.

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Cisco2811

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

no logging console

!

no aaa new-model

!

resource policy

!

ip subnet-zero

!

!

ip cef

!

!

no ip domain lookup

ip domain name yourdomain.com

!

!

!

key chain OER

key 1

key-string abcd1234

!

oer master

policy-rules OER

max-range-utilization percent 50

logging

!

border 1.1.1.1 key-chain OER

interface Vlan100 internal

interface FastEthernet0/0 external

interface FastEthernet0/1 external

!

learn

throughput

periodic-interval 1

monitor-period 2

prefixes 250

mode route control

mode select-exit best

!

oer border

local Loopback0

master 1.1.1.1 key-chain OER

username cisco privilege 15 secret xxx

!

!

!

!

!

interface Loopback0

ip address 1.1.1.1 255.255.255.255

!

interface FastEthernet0/0

description Ethernet to WAN ISP1

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/1

description Ethernet to WAN ISP2

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/0/0

switchport access vlan 100

vlan-id dot1q 100

exit-vlan-config

!

!

interface FastEthernet0/0/1

switchport access vlan 100

!

interface FastEthernet0/0/2

switchport access vlan 100

!

interface FastEthernet0/0/3

switchport access vlan 100

!

interface Vlan1

no ip address

!

interface Vlan100

description LAN VLAN

ip address 192.168.10.1 255.255.255.0

ip nat inside

ip virtual-reassembly

!

ip classless

ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 dhcp 11

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp 10

!

ip nat inside source route-map CHARTER interface FastEthernet0/0 overload

ip nat inside source route-map UTMI-DSL interface FastEthernet0/1 overload

!

!

ip prefix-list OER seq 10 permit 0.0.0.0/0

access-list 100 permit ip 192.168.0.0 0.0.255.255 any

route-map CHARTER permit 10

match ip address 100

match interface FastEthernet0/0

!

route-map UTMI-DSL permit 10

match ip address 100

match interface FastEthernet0/1

!

!

!

oer-map OER 10

match ip address prefix-list OER

!

control-plane

!

!

!

line con 0

login local

line aux 0

line vty 0 4

privilege level 15

login local

transport input telnet ssh

!

scheduler allocate 20000 1000

!

end

8 REPLIES
New Member

Re: OER and routing problems

Try this;

no ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 dhcp 11

no ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp 10

!

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

ip route 0.0.0.0 0.0.0.0 FastEthernet0/1

!

I've only implemented OER once, but from what I recall you want equal cost paths, however I do believe it works w/ unequal cost paths but just for testing sakes try this out and see if there is any difference. If the IP from the provider never changes even though it is DHCP, you could try pointing to that IP address in the static route, even just for testing it would be worth a shot. Depending on what type of connection you have from each provider, you may be better off using basic CEF load balancing..

Hall of Fame Super Gold

Re: OER and routing problems

Perhaps OER is too much an overkill for this application ?

Your could try PBR for multiple tracking

http://cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080457bcc.html

It is much simpler and would support a dual connection/NAT/backup scenario.

Hall of Fame Super Gold

Re: OER and routing problems

I was thinking about all this and there may be implications depending on the order in which the inside interface processes PBR and NAT, thing that I'm not sure about.

So I would need to lab this out before saying for sure.

I hope to be able to do that after I'm back from a trip I'm taking now.

New Member

Re: OER and routing problems

Okay. I've decided to simplify this. I removed all the OER configuration. All I have now are two Internet connections both set as default routes. Both interfaces are set to do NAT overloading. As before Internet access is extremely spotty and slow. I'm thinking about wiping my configuration and starting over but there just isn't that much in here. Please see current config. Thank you for your replies.

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname 2811

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

no logging console

!

no aaa new-model

!

resource policy

!

ip subnet-zero

!

!

ip cef

!

!

no ip domain lookup

ip domain name yourdomain.com

!

!

username cisco privilege 15 secret 5 $1$

!

!

!

!

!

interface FastEthernet0/0

description Ethernet to WAN ISP1

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/1

description Ethernet to WAN ISP2

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/0/0

switchport access vlan 100

vlan-id dot1q 100

exit-vlan-config

!

!

interface FastEthernet0/0/1

switchport access vlan 100

!

interface FastEthernet0/0/2

switchport access vlan 100

!

interface FastEthernet0/0/3

switchport access vlan 100

!

interface Vlan1

no ip address

!

interface Vlan100

description LAN VLAN

ip address 192.168.10.1 255.255.255.0

ip nat inside

ip virtual-reassembly

!

ip classless

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

ip route 0.0.0.0 0.0.0.0 FastEthernet0/1

!

ip http server

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

ip nat inside source route-map CHARTER interface FastEthernet0/0 overload

ip nat inside source route-map UTMI-DSL interface FastEthernet0/1 overload

!

access-list 100 permit ip 192.168.0.0 0.0.255.255 any

route-map CHARTER permit 10

match ip address 100

match interface FastEthernet0/0

!

route-map UTMI-DSL permit 10

match ip address 100

match interface FastEthernet0/1

!

!

!

control-plane

!

!

line con 0

login local

line aux 0

line vty 0 4

privilege level 15

login local

transport input telnet ssh

!

scheduler allocate 20000 1000

!

end

Osprey2811#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

68.0.0.0/32 is subnetted, 1 subnets

S 68.114.36.54 [254/0] via 66.227.208.1, FastEthernet0/0

C 192.168.10.0/24 is directly connected, Vlan100

66.0.0.0/22 is subnetted, 1 subnets

C 66.227.208.0 is directly connected, FastEthernet0/0

67.0.0.0/24 is subnetted, 1 subnets

C 67.59.46.0 is directly connected, FastEthernet0/1

S* 0.0.0.0/0 is directly connected, FastEthernet0/0

is directly connected, FastEthernet0/1

Osprey2811#

New Member

Re: OER and routing problems

One more thing. I removed all my NAT configuration and performed ping tests from the router. The behavior is the same without NAT. The only way I can get reliable outbound access is to set unequal cost default routes or disabling one of the interfaces. Thanks.

New Member

Re: OER and routing problems

Well I opened up a case with Cisco. The engineer had me remove all default routes. Because the interfaces were on DHCP they automatically learn a default route. These default routes end up in the routing table. Just like that everything started working properly.

I'm still working on some OER related problems. Once I have it all done I'll post a final config.

New Member

Re: OER and routing problems

Success!!! For anybody following in my foot steps be aware of your testing procedures. My method of testing was to send several continuous pings from my PC to different locations on the Internet. This lead me to believe I had a problem because some of the connections would drop and not come backup. The reason they wouldn't come back up was not because OER wasn't working but because my continuous ping never allowed my dynamic NAT translation to clear out. The default timeout for a NAT translation is 60 seconds.

Thank you to everybody who helped on this.

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Cisco2811

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

no logging console

!

no aaa new-model

!

!

ip cef

!

!

no ip domain lookup

ip domain name yourdomain.com

!

!

!

key chain OER

key 1

key-string OER-KEY-123

!

crypto pki trustpoint TP-self-signed-xxx

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-3209123731

revocation-check none

rsakeypair TP-self-signed-xxx

!

!

crypto pki certificate chain TP-self-signed-3209123731

certificate self-signed 01 nvram:IOS-Self-Sig#3131.cer

oer master

policy-rules OER

max-range-utilization percent 50

logging

!

border 1.1.1.1 key-chain OER

interface Vlan100 internal

interface FastEthernet0/0 external

interface FastEthernet0/1 external

!

learn

throughput

periodic-interval 1

monitor-period 2

prefixes 250

mode route control

mode monitor active

!

active-probe echo 66.227.208.1

active-probe echo 67.59.46.1

!

oer border

local Loopback0

master 1.1.1.1 key-chain OER

username cisco privilege 15 secret 5 $1

!

!

!

!

!

interface Loopback0

ip address 1.1.x.x.255.255.255

!

interface FastEthernet0/0

description Ethernet to WAN ISP1

bandwidth 3072

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/1

description Ethernet to WAN ISP2

bandwidth 384

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/0/0

switchport access vlan 100

!

interface FastEthernet0/0/1

switchport access vlan 100

!

interface FastEthernet0/0/2

switchport access vlan 100

!

interface FastEthernet0/0/3

switchport access vlan 100

!

interface Vlan1

no ip address

!

interface Vlan100

description LAN VLAN

ip address 192.168.10.1 255.255.255.0

ip nat inside

ip virtual-reassembly

!

!

ip http server

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

ip nat translation icmp-timeout 15

ip nat inside source route-map CHARTER interface FastEthernet0/0 overload oer

ip nat inside source route-map UTMI-DSL interface FastEthernet0/1 overload oer

!

!

ip prefix-list OER seq 5 permit 0.0.0.0/0

access-list 100 permit ip 192.168.0.0 0.0.255.255 any

route-map CHARTER permit 10

match ip address 100

match interface FastEthernet0/0

!

route-map UTMI-DSL permit 10

match ip address 100

match interface FastEthernet0/1

!

!

!

oer-map OER 10

match ip address prefix-list OER

!

control-plane

!

!

line con 0

login local

line aux 0

line vty 0 4

access-class 23 in

privilege level 15

login local

transport input telnet ssh

line vty 5 15

access-class 23 in

privilege level 15

login local

transport input telnet ssh

!

scheduler allocate 20000 1000

!

end

New Member

Re: OER and routing problems

What is the function of IP prefix list?

166
Views
0
Helpful
8
Replies