policy routing issue

[rajakumar.P]

Hi,

This query is regarding a policy routing issue.

We have about 11 L3-vlans on a Cisco 4507-L3 with diffrerent IP ranges.

We have an Eigrp running on this L3 on which all these 11 vlan networks are added.

We have two firewalls terminated to this L3 which is in turn is connected to two different ISP links .

We also have multiple redundant site-site VPN tunnels configured on these internet links.

My requirement is like this , all my to and fro traffic from all the L3-vlans towards a particular remote lan IP addresses has to take a particular firewall or ISP-link or VPN tunnel as the primary path.

It also must automatically failovered to the other link incase this primary path fails.

Please note that the route to this particular IP or location is currently advertised or provided by the Eigrp

The first solution i have is to create a mathching access list, create a policy map with this as the matching acl and apply this route map policy in all vlan interfaces.

But i don't want to apply this route map to all vlan interface. Iam looking for a solution in which global config change will help me in routing all the traffic towards this remote IP (even in incase of any future vlans are created on my L3 without any route maps to be added to the vlan interfaces

Any help for this issue is appreciated

With Regards

NMG

[vladrac-ccna]

Hello,

I dont think this can be done. You'll need to apply your policy routing on the incoming traffic.

Btw, if you have a reliable solution for policy routing on a Catalyst 4507, let us know.

Ive looked for something like this everywhere and could not do it. there's not enough routing features on these MLS switches.

vlad

[kamlesh.sharma]

i think this cold be done by influencing the routing.

you just need to make sure that at a given point of time only one default route pointing first firewall should be in the routing table. for failover put a floating default route with higher ad or in EIGRP with higher metric.

please rate if helps

HTH

[vladrac-ccna]

this is not as simple as it sounds.

Try using float static routes on a multilayer switch, and let us know.

vlad

[Richard Burts]

I am not clear from the original post whether the EIGRP is learning these destinations that must take a particular path or whether the EIGRP is using a default route for that outbound traffic. If EIGRP is learning these routes and has specific routes for these destinations then influencing the EIGRP metrics should work and be effective in sending the traffic out the desired interface. If EIGRP is just using a default route for the outbound traffic then Policy Based Routing would be the only thing I can think of to achieve the desired results.

Perhaps the original poster can provide some more details about the environment.

HTH

Rick

[rajakumar.P]

Yes, presently the routes to this destination is provided by the Eigrp after doing the DUAL calculations, it is not by a default route

But I have some clarifications regarding the Eigrp routing parameter manipulation

1) We have this Eigrp extended over multiple location, so will changing or influencing the Eigrp metric (like delay) will have any after effect on the total working of the entire Eigrp .

This is an important concern for me as this Eigrp is extended to our multiple locations which has more critcal networks on which more critical tasks are happening

2) I would also like to know is it possible manipulate the metric only for a single route ( say to a particular IP/ or a particular traffic to that IP, e.g. like ftp traffic towards the IP x.x.x.x/24 ) , so that eigrp can always choose one particular interface as the primary path destined to that IP addresses and must fail over in case this preffered path fails

Please find the below Outputs details

##################################

MY-4507-L3#sh ip route xx.xx.xx.yy

Routing entry for xx.xx.xx.0/24

Known via "eigrp 100", distance 90, metric 297249792, type internal

Redistributing via eigrp 100

Last update from aa.aa.aa.aa on Vlan100, 1d13h ago

Routing Descriptor Blocks:

* aa.aa.aa.aa, from aa.aa.aa.aa, 1d13h ago, via Vlan100

Route metric is 297249792, traffic share count is 1

Total delay is 500210 microseconds, minimum bandwidth is 9 Kbit

Reliability 255/255, minimum MTU 1476 bytes

Loading 184/255, Hops 3

MY-4507-L3#

#################################

MY-4507-L3#sh ip route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

D xx.xx.xx.0/24 [90/297249792] via aa.aa.aa.aa, 1d13h, Vlan100

###########################

MY-4507-L3#sh ip eigrp topology

IP-EIGRP Topology Table for AS(100)/ID(id.id.id.di)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,

r - reply Status, s - sia Status

P xx.xx.xx.0/24, 1 successors, FD is 297249792

via aa.aa.aa.aa (297249792/297249536), Vlan100

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,

r - reply Status, s - sia Status

MY-4507-L3#

With Regards

NMG

[rajakumar.P]

Please correct me if I am wrong, i have the following queries reagarding the floating route solution

1) I want my Eirp to take care of my failover as floating routes wouldn't be that much efficent ( because i feel they cannot check failures on the entire path towards the remote location ) and Eigrp is much more efficent.

2) I want Eigrp to take my desired path as primary and must do an automatic failover in case my preffered path fails. I also wan't to make sure that changing the Eigrp metrics for this wouldn't have any after effects as this Eigrp is extended to my multiple remote locations which has more critical networks than mine

Can you please help

With Regards

NMG

[rajakumar.P]

Can you please eloberate me how to keep only one route ( ie my preffered route) exists in the routing table at a time pointing towards my preffered path/ISP-link

Please correct me if I am wrong, i have the following queries reagarding the floating route solution

1) I want my Eirp to take care of my failover as floating routes wouldn't be that much efficent ( because i feel they cannot check failures on the entire path to the remote location ) and Eigrp is much more efficent.

2) I am not sure how floating route with an higher metric or AD than Eigrp will help, because Eigrp must have checked and calculated all possible exit paths towards this destination and after its failure only the router will check the floating route with an higher metric .So will the static route be able to take care of this path/route which Eigrp ( whic is more advanced) found not reachable

3) I want Eigrp to take my desired path as primary and must do an automatic failover in case my preffered path fails. I also wan't to make sure that changing the Eigrp metrics for this wouldn't have any after effects as this Eigrp is extended to my multiple remote locations which has more critical networks than mine

Can you please explain?

With Regards

NMG

[Richard Burts]

If you change the bandwidth or the delay of the interface it will affect all routes learned through that interface. Whether that would impact operations in other parts of the network is not something we can know based on the information provided thus far.

You are correct that the traditional floating static route can respond to local changes but not to changes that are remote. Cisco has introduced a new feature in recent versions of IOS called Relaible Static Routes with Object Tracking and the point of this feature is to detect loss of connectivity in remote parts of the network and make changes in the static routes in the routing table. This new feature might help you.

I believe that the best solution for you is to configure an offset list in EIGRP. The offset list uses a standard access list to identify routes so you could make changes that would impact only the single route that you care about (or affect several routes if you wish) without affecting other routes. The offset list adds to the metric of routes in the EIGRP topology table and this makes them less attractive. So I believe that you can configure an access list to identify the exact routes that you want to affect and then use that access list in an offset list and achieve the result that you want.

HTH

Rick

[vladrac-ccna]

Hello Rick,

I believe you are correct. I'd like to add though, that I ran into similar problem where I needed to do Reliable PBR using OT and this feature is not available on Catalyst Multilayer switches. Check feature navigator, you'll see the platforms for which this feature is available.

vlad

[Richard Burts]

Vlad

I continue to believe that the optimum solution for the situation in the original post is to use offset list in EIGRP to influence the metric of the particular routes.

You do make a good point that we tend to equate routers and layer 3 switches and treat them as if they were the same. But there are features in the code for "routers" that are not in the code for layer 3 switches.

HTH

Rick