Re: Load-balancing across four T1's on 2 routers

Hi Roman

On the one ISP thing, that is just how they want it - this is just a
small contract job i'm doing.

My experience is mainly related to OSPF not BGP. I'll start looking at
BGP, it sounds like it may be a better fit? If you have any pointers
on setting it up using BGP let me know!

Thanks
Sean

nakhmanson@xxxxxxxxx wrote:
Sean

Thanks for the reply, but now it's even more "puzzling". Just out of
curiosity, since you have everything redundant (2 routers from an ISP +
2 switches + firewall with failover) why ONE ISP? ;-)

Now that I answered your question, any help with mine?
Sure.
With your current setup, I'd get rid of L3 pair and use OSPF on the
firewall (assuming it's a Cisco pix failover pair with more or less new
version).

The problem is if we lose one T1. At that point, one router has a
1.5Mb connection and the other still has a 3Mb connection. The L3
switch will then see 2 UN-equal cost default routes in its routing
table. Because they are not equal-cost routes, all traffic would be
directed to the router that has two operational T1s. The end result is
the same as loosing two T1s even though we only lost 1. OSPF only
performs equal-cost load-balancing.

You are absolutely right. And as always there is a "BUT"
Most likely client will be using just ONE T1 for any current session,
unless you do some "serious magic" like "per-packet" or "no ip
load-sharing per-destination". And some times people just want to
download stuff faster then 180kB/s. If you would use MLPP - any given
session is capable of getting up to 360kB/s guaranteed. And yes, if you
lose a T1 - you lose the "whole" router because of OSPF. But there are
always other ways of doing things (keeping in mind that T1 would be
fixed within reasonable period of time). For example you can use BGP
with link bandwidth feature between you and ISP. (using EIGRP between
you and ISP would be unconventional, but possible). Or even better
scenario - get two ISP with 2 T1 each. MLPP with each ISP. BGP (default
+ local routes) towards you from each ISP. GLBP/HSRP/VRRP or OSPF on
routers.

just my 2c
Roman

Sean-Usenet wrote:
Haha, well I dumbed down the full setup a little bit for simplicity
sake.

It is actually not a single L3 switch, it is two L3 switches with
redundant 32Gbps interconnects between them. With 1 router going to
each switch. The L3 switch is needed because the firewall is not setup
to run OSPF.

The firewall is not a single firewall, it is an active/passive firewall
cluster. One firewall connects to one of the above L3 switches and one
firewall connects to the other L3 switch.

Here is the reason for not using MLPP:

If all four T1s are up, everything would work fine with MLPP. Each
router would see a 3Mb connection. The L3 switch would have 2 default
routes in its routing table, and perform equal-cost load-balancing.
The traffic would also load-balance very nicely across the T1s because
of MLPP.

The problem is if we lose one T1. At that point, one router has a
1.5Mb connection and the other still has a 3Mb connection. The L3
switch will then see 2 UN-equal cost default routes in its routing
table. Because they are not equal-cost routes, all traffic would be
directed to the router that has two operational T1s. The end result is
the same as loosing two T1s even though we only lost 1. OSPF only
performs equal-cost load-balancing.

Without using MLPP, the L3 switch will still see two equal-cost default
routes and route traffic to both routers. Unless of course a router
looses both T1s, then it won't receive any traffic since it won't be
passing along the default route from the ABR any longer.

The reason for using a L3 switch and not GLBP on the routers is because
GLBP load-balances on a per source-host basis. Since the source host
is always the firewall, the traffic will always go through the same
router.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t15/ft_glbp.htm


Now that I answered your question, any help with mine? :-)

Thanks
Sean


nakhmanson@xxxxxxxxx wrote:
Sean-Usenet wrote:
It is the same ISP

Merv wrote:
BTW is it one ISP or two ?

Sean

I am sorry for stupid question, but I just can't resist. WHY all that
hustle with 4 T1's without MLPP, 2 routers + OSPF, if you have just ONE
provider. As far as I understand, you are trying to "invent the wheel",
which is design "indestructible" Internet access, or am I wrong? If
not, then WHY you want a SINGLE L3 switch (which you don't need) +
SINGLE firewall?

Roman

.

Relevant Pages

  • Re: sharing a firewall?
    ... I did repost this message on the XP networking net board with a different ... >> computers to access the internet through it's firewall, ... > prices are about the same, and the switch should provide better performance. ... > router probably make them a bit higher in price than the SMC ...
    (microsoft.public.windowsxp.network_web)
  • Re: sharing a firewall?
    ... I did repost this message on the XP networking net board with a different ... >> computers to access the internet through it's firewall, ... > prices are about the same, and the switch should provide better performance. ... > router probably make them a bit higher in price than the SMC ...
    (microsoft.public.security)
  • Re: Load-balancing across four T1s on 2 routers
    ... In you case (one ISP) BGP scenario will be really easy. ... switch will then see 2 UN-equal cost default routes in its routing ... directed to the router that has two operational T1s. ...
    (comp.dcom.sys.cisco)
  • Re: DMZ (De-militarized Zone)
    ... > Cisco 800 series router which gets configured by our ISP! ... > firewall software and 3 NIC) to used instead of a Router/Firewall? ...
    (comp.security.firewalls)
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip)
    ... I wouldn't expect the ISP to provide this service for nothing - some ISPs ... purchase and manage an additional filtering router. ... two-brain rule (where at least two people are involved in a firewall change ... use up precious customer bandwidth. ...
    (Incidents)