Multiple ISP's and NAT load-balance

This lab I will show how we can load-balance traffic based on protocols between two ISP’s while using each ISP provided IP.

Device	Role
R1	Customer router
R2	ISP1
R3	ISP2
R4	Internet
R5	Emulate customer node on LAN

The customer requirements are:

1.  All HTTP and telnet traffic will go through ISP2

2. All other traffic will go through ISP1

3. In case of failure in one of the ISP’s all traffic will go through the other one

This is the network topology:

After configuring all interfaces with the correct IP’s we need to configure default route:

ip route 0.0.0.0 0.0.0.0 10.1.12.2 name PRIMARY ip route 0.0.0.0 0.0.0.0 10.1.13.3 150 name BACKUP

Here I configured a default route to ISP1 as primary while configuring floating static route with AD of 150 to ISP2.

Next configuring ACL which will capture the appropriate traffic:

ip access-list extended ACL_HTTP  permit tcp 192.168.15.0 0.0.0.255 any eq telnet  permit tcp 192.168.15.0 0.0.0.255 any eq www  deny   ip any any

This ACL will capture all HTTP and telnet traffic from network 192.168.15.0/24.

And configuring track object for ISP2 interface:

track 3 interface FastEthernet0/1 ip routing

Next configuring PBR (Policy-Based Route) with attached track object:

Route-map RM_HTTP_PBR permit 10  match ip address ACL_HTTP  set ip next-hop verify-availability 10.1.13.3 10 track 3 ! route-map RM_HTTP_PBR deny 20 !

In case of failure in ISP2 link the PBR won’t take in affect.

Now attach this PBR to interface Fa1/0 which connected to customer’s LAN:

interface FastEthernet1/0  ip address 192.168.15.1 255.255.255.0  ip virtual-reassembly  ip policy route-map RM_HTTP_PBR  speed 100  full-duplex !

Now for the NAT part, configuring two route-maps, one for each ISP with the corresponding interface:

route-map RM_ISP1 permit 10  match interface FastEthernet0/0 ! route-map RM_ISP2 permit 10  match interface FastEthernet0/1 !

And last configuring the NAT statements:

ip nat inside source route-map RM_ISP1 interface FastEthernet0/0 overload ip nat inside source route-map RM_ISP2 interface FastEthernet0/1 overload

The NAT statement will take place only if the interface, which I configured on the route-map, is matched else it will be ignored.

Summary

R1 will use IP 10.1.13.1 for NAT to all HTTP and telnet traffic from R5 and IP 10.1.12.1 for NAT to all traffic from R5 except HTTP and telnet.

In case of failure of ISP2, the PBR won’t work and R1 will use NAT IP 10.1.12.1 for all traffic. In case of failure of ISP1, the static route to ISP2 will take over and R1 will use NAT IP 10.1.13.1 for all traffic.

Verification

In case of both links are up, Ping from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#ping 192.168.41.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.41.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 52/76/112 ms

Result:

Telnet from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#telne            R5#telnet 192.168.41.1 Trying 192.168.41.1 ... Open User Access Verification Username:

Result:

Note the source IP on each capture.

Now shutting down interface Fa0/1 on R1 and testing again, Ping from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#ping 192.168.41.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.41.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 52/76/112 ms

Result:

Telnet from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#telne            R5#telnet 192.168.41.1 Trying 192.168.41.1 ... Open User Access Verification Username:

Result:

On the captures both source IP's are 10.1.12.1.

Now bring back interface Fa0/1 and shut down interface Fa0/0 on R1 and testing again, Ping from R5 (192.168.15.5) to R4 (192.168.41.1):
 

R5#ping 192.168.41.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.41.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 52/76/112 ms

Result:

Telnet from R5 (192.168.15.5) to R4 (192.168.41.1):

R5#telne            R5#telnet 192.168.41.1 Trying 192.168.41.1 ... Open User Access Verification Username:

Result: