Mailing List Archive

Hi List

Radware makes a product called Linkproof. It basically does load balancing
and automagical failover
for multiple isp's for outgoing connection. it states it using something as
smart nat. without the use
of any (i/eBGP)

as i understand it basically nat's traffic in a way that load is balanced
and in the case of a fail of one
link it just uses the other one the full extent.

What I was wondering is, if I can accomplish the same behavior with a
multiple ethernet router, say a 2621
with 3 FE for example.

basically I'd like to:

+--------- ISP 1 (static)
|
/--------\
[firewall]----| CISCO |
\--------/
+--------- ISP 2 (static)

without using any BGP. Any suggestion of you "gurus"? :)

Thank you in advance

Arie

On Thu, Sep 12, 2002 at 12:05:09PM +0200, Arie J. Gerszt wrote:
>
> Radware makes a product called Linkproof. It basically does load balancing
> and automagical failover
> for multiple isp's for outgoing connection. it states it using something as
> smart nat. without the use
> of any (i/eBGP)
>
> as i understand it basically nat's traffic in a way that load is balanced
> and in the case of a fail of one
> link it just uses the other one the full extent.

It has builtin DNS server which maps names to IP addresses (from
ISP 1 and ISP 2) to obtain load balancing and fail over.
It uses small TTL (zero?) for replies and when link to ISP 1
fails it returns only address from ISP 2 for www.somedomain.com.

> What I was wondering is, if I can accomplish the same behavior with a
> multiple ethernet router, say a 2621
> with 3 FE for example.
>
> basically I'd like to:
>
> +--------- ISP 1 (static)
> |
> /--------\
> [firewall]----| CISCO |
> \--------/
> +--------- ISP 2 (static)
>
> without using any BGP. Any suggestion of you "gurus"? :)

Can be done with same DNS trick.
What you need is DNS server with two IP addresses (one from ISP 1 and
other from ISP 2) which are both NS for yourdomain.com (server is
behind router which does NAT for those two addresses).

On that server, with use of SNMP (traps and/or snmpget) you can
verify state of links and in case when one fails, script removes
dead addresses (from ISP which link is down) from configuration file
of DNS server.

Basically you have this:
(x.x.x.x address from ISP 1, y.y.y.y address from ISP 2
- both links up:

$ host -v www.yourdomain.com
www.yourdomain.com 10 IN A x.x.x.x
www.yourdomain.com 10 IN A y.y.y.y

- link to ISP 2 fails:

$ host -v www.yourdomain.com
www.yourdomain.com 10 IN A x.x.x.x

Important thing is to use small TTL (zero is best, but it DNS
will get more requests).

Also with SNMP you can monitor utilisation of both links and when
one of the links becomes saturated, script removes address associated
with that link from configuration (like when link fails) for shorter
period to offload that link.

Maybe there are tools which automate this process (scripts for BIND,
djbdns, ...) but I'm not aware of any.

Ask your friendly local Cisco SE or account manager for a copy of a
whitepaper titled "Enabling Enterprise Redundancy to Multiple ISP’s with the
Cisco Content Services Switch (CSS 11000) Multihoming Function" by Robert
Barton, an SE at the Cisco Vancouver, Canada, office.

> -----Original Message-----
> From: cisco-nsp-admin@puck.nether.net
> [mailto:cisco-nsp-admin@puck.nether.net]On Behalf Of Arie J. Gerszt
> Sent: Thursday, September 12, 2002 3:05 AM
> To: cisco-nsp@puck.nether.net
> Subject: [nsp] cisco load balancing
>
>
> Hi List
>
> Radware makes a product called Linkproof. It basically does load balancing
> and automagical failover
> for multiple isp's for outgoing connection. it states it using
> something as
> smart nat. without the use
> of any (i/eBGP)
>
> as i understand it basically nat's traffic in a way that load is balanced
> and in the case of a fail of one
> link it just uses the other one the full extent.
>
> What I was wondering is, if I can accomplish the same behavior with a
> multiple ethernet router, say a 2621
> with 3 FE for example.
>
> basically I'd like to:
>
> +--------- ISP 1 (static)
> |
> /--------\
> [firewall]----| CISCO |
> \--------/
> +--------- ISP 2 (static)
>
> without using any BGP. Any suggestion of you "gurus"? :)
>
> Thank you in advance
>
> Arie
>
> _______________________________________________
> cisco-nsp mailing list real_name)s@puck.nether.net
> http://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>

This will work if you're doing all NAT on the inside, if you must have
publically routable IP addresses on the inside this will not work. You can
do something like this (but just substitute the serial for ethernet):



s0/0 goes to ISP1, s0/1 goes to ISP 2. let's say we use 10.1.1.0/24 on the
inside. (Ethernet)


access-list 1 permit 10.1.1.0 0.0.0.255

route-map s00-nat permit 10
match ip address 1
match interface s0/0
!
route-map s01-nat permit 10
match ip address 1
match interface s0/1
!
ip nat inside source route-map s00-nat interface s0/0 overload
ip nat inside source route-map s01-nat interface s0/1 overload
!
ip route 0.0.0.0 0.0.0.0 Serial0/0
ip route 0.0.0.0 0.0.0.0 Serial1/0


Thanks,

Mario Puras
SoluNet Technical Support



-----Original Message-----
From: Arie.Gerszt@student.unisg.ch [mailto:Arie.Gerszt@student.unisg.ch]
Sent: Wednesday, September 11, 2002 2:24 PM
To: cisco-nsp@puck.nether.net
Subject: [nsp] cisco load balancing


Hi List

Radware makes a product called Linkproof. It basically does load balancing
and automagical failover
for multiple isp's for outgoing connection. it states it using something as
smart nat. without the use
of any (i/eBGP)

as i understand it basically nat's traffic in a way that load is balanced
and in the case of a fail of one
link it just uses the other one the full extent.

What I was wondering is, if I can accomplish the same behavior with a
multiple ethernet router, say a 2621
with 3 FE for example.

basically I'd like to:

+--------- ISP 1 (static)
|
/--------\
[firewall]----| CISCO |
\--------/
+--------- ISP 2 (static)

without using any BGP. Any suggestion of you "gurus"? :)

Thank you in advance

Arie

_______________________________________________
cisco-nsp mailing list real_name)s@puck.nether.net
http://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/