Background:
1841 router with 1 HWIC-4SW (4 port FastEthernet switch) for a total of 6 interfaces.
FastEthernet0/0 connects to ISP 1 using a static address.
FastEthernet0/1 connects to ISP 2 obtaining an address via dhcp
A loopback interface, address 2.2.2.2 is used for communication between the master controller and border process.
Clients are in vlan10 or vlan20 and use dhcp to obtain an address.
The following are not included in the configuration below -
1. There are 4 always up multipoint gre tunnels protected with IPSec using two tunnel interfaces. (One tunnel interface per ISP.)
2. EIGRP is used to pass routes over the tunnels.
3. DMVPN is used.
All addresses shown are fake.
This configuration balances the load across the two ISPs trying to keep
utilization of each external link within 10%. I'll add an alternative
configuration later this weekend which using ISP 1 until it is 70% busy and
then starts using ISP 2. Of course if either ISP fails all traffic is
switched to the other ISP.
Note that OER uses passive information and active probes so it detects problems "black holes, "brown outs" and other bad things happening to traffic on an exit link.
The documentation at www.cisco.com/go/oer describes the commands and gives
background information on OER.
OER configuration -
oer master
policy-rules fixed-static
port 4444
max-range-utilization percent 10
keepalive 1
!
border 2.2.2.2 key-chain key1
interface Vlan20 internal
interface Vlan10 internal
interface FastEthernet0/1 external
interface FastEthernet0/0 external
!
learn
throughput
delay
periodic-interval 1
monitor-period 2
prefixes 200
aggregation-type prefix-length 32
max prefix total 2500
backoff 180 360
mode route control
mode select-exit best
periodic 180
resolve range priority 5
resolve loss priority 7 variance 1
resolve delay priority 8 variance 1
no resolve utilization
!
oer border
local Loopback1
port 4444
active-probe address source interface Vlan10
master 2.2.2.2 key-chain key1
!
interface Loopback1
ip address 2.2.2.2 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 !ISP 1's gateway here
! ISP 2 requires I access their web site and email/news servers from
!their network.
ip route 1.1.1.1 255.255.255.255 FastEthernet0/1 dhcp
ip route 2.1.1.1 255.255.255.255 FastEthernet0/1 dhcp
ip route 3.1.1.1 255.255.255.255 FastEthernet0/1 dhcp
ip route 4.1.1.1 255.255.255.255 FastEthernet0/1 dhcp
!
! These are 4 static routes for the IPSec encapsulated packets via the gre
! tunnels (2 per ISP).
ip route 10.10.10.65 255.255.255.255 !ISP 1's gateway here
ip route 10.10.10.66 255.255.255.255 !ISP 1's gateway here
ip route 10.10.10.67 255.255.255.255 FastEthernet0/1 dhcp
ip route 10.10.10.68 255.255.255.255 FastEthernet0/1 dhcp
!
! ISP 2 requires I access their web site and email/news servers from
!their network. Force OER to never change these routes.
ip prefix-list fixed-static seq 5 deny 1.1.1.1./32
ip prefix-list fixed-static seq 10 deny 2.1.1.1/32
ip prefix-list fixed-static seq 11 deny 3.1.1.1/32
ip prefix-list fixed-static seq 12 deny 4.1.1.1/32
! Force OER to not change the routes for the IPSec encapsulated packets
ip prefix-list fixed-static seq 20 deny 10.10.10.64/28
!
oer-map fixed-static 10
match ip address prefix-list fixed-static
!
