We have a number of Cisco 891 routers configured with dual WAN links. All of these routers are running Cisco IOS 15.x In some cases, we use policy based routing to force particular traffic down one link.
I use PBR a lot with Dual WAN setups, as the customer generally wants certain traffic to go over a particular link. For example, I will often need to have real-time traffic such as VOIP go over one link, then general internet to go over another, and typically will use PBR to route the traffic according to source/destination IP, VLAN, or whatever fits.
Obviously, it is best to still offer a degraded service if the dedicated voice link should go offline. I tend to use
set next-hop verify-availability with an IP SLA tracking object in order to allow the traffic to still fail-over to the other WAN, should it need to.
My question is: Is it at all possible to do the same config (wth a tracking object to verify availability) when using PBR to set an interface, instead of a next-hop?
There's a couple of reasons for this:
We auto-negotiate IP and routing settings in all our PPPoE Dialer interface. One of our third-party ISPs went ahead and changed the default-route for all their DSL connections. This meant that, since I had hard-coded the next-hop into the PBR config, it stopped working. Luckily, the PBR failed over to the other WAN, but in any case, I've been looking to avoid dependency on hard-coding the IP wherever I can, similar to how I do the default routes:
ip route 0.0.0.0 0.0.0.0 Dialer0 10 track 1
Today I've been asked to configure dual WANs on some new CPE, and was going to use PBR to force our VOIP traffic down a dedicated line, failing back to the internet link if needed. The catch is that this customer is using two DSL lines from the same ISP, and so the next-hop would be the same in both cases. So obviously what I'll next do is set the interface instead, but this then means I lose my verify-avilability.
Hoping some one knows what PBR config I can use to achieve this when setting interfaces.
For reference, here's how I currently do it, with
EDIT: Included more detailed example.
track 1 ip sla 1 delay down 20 up 10 ! track 2 ip sla 2 delay down 20 up 10 ! interface FastEthernet8 description PPPoE ADSL2+ VOIP no ip address ip nat outside ip virtual-reassembly in duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 interface GigabitEthernet0 description PPPoE ADSL2+ All Internet Traffic no ip address ip nat outside ip virtual-reassembly in duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 2 interface Vlan1 description $ETH_LAN$ ip address 192.168.1.254 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ip policy route-map PBR-LAN interface Dialer0 description VOIP ADSL2+ Dialer Interface bandwidth 1024 bandwidth receive 20480 ip address negotiated no ip redirects no ip proxy-arp ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp ip tcp adjust-mss 1452 dialer pool 1 dialer-group 1 ppp authentication chap pap callin ppp chap hostname firstname.lastname@example.org ppp chap password 0 yyyy ppp pap sent-username email@example.com password 0 yyyy no cdp enable interface Dialer1 description Internet ADSL2+ Dialer Interface bandwidth 1024 bandwidth receive 20480 ip address negotiated no ip redirects no ip proxy-arp ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp ip tcp adjust-mss 1452 dialer pool 2 dialer-group 2 ppp authentication chap pap callin ppp chap hostname firstname.lastname@example.org ppp chap password 0 aaa ppp pap sent-username email@example.com password 0 aaa no cdp enable ip local policy route-map PBR-LOCAL ip nat inside source route-map DSL2-DATA-NAT interface Dialer1 overload ip nat inside source route-map DSL2-VOIP-NAT interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 10 track 1 ip route 0.0.0.0 0.0.0.0 Dialer1 track 2 ip access-list extended NAT-POOL remark Be sure to exclude remote LANs in this ACL deny ip 192.168.1.0 0.0.0.255 192.168.7.0 0.0.0.255 permit ip 192.168.1.0 0.0.0.255 any ip access-list extended PBR-DSL-DATA remark Match local traffic with DSL DATA src IP permit ip host 126.96.36.199 any ip access-list extended PBR-DSL-VOIP remark Match local traffic with DSL VOIP src IP permit ip host 188.8.131.52 any ip access-list extended VOIP-PBX remark Match traffic to/from our VOIP PBX so it can use dedicated link. permit ip host 184.108.40.206 any permit ip any host 220.127.116.11 ! For the IP SLAs I simply ping the gateway of the circuit ! In this case, we have two DSL links from the same ISP ! So I simply ping the same gateway for both, with different source interfaces. ip sla 1 icmp-echo 18.104.22.168 source-interface Dialer0 threshold 4000 frequency 5 ip sla schedule 1 life forever start-time now ip sla 2 icmp-echo 22.214.171.124 source-interface Dialer1 threshold 4000 frequency 5 ip sla schedule 2 life forever start-time now ! These PBR-LOCAL route-maps are used for traffic coming from ! The router itself. (eg. ICMP, IPSec) Allows it to correctly ! Respond on both links, no matter which is the primary/active link. route-map PBR-LOCAL permit 10 description Route traffic with src IP VOIP DSL match ip address PBR-DSL-VOIP set interface Dialer0 ! route-map PBR-LOCAL permit 20 description Route traffic with src IP DATA DSL match ip address PBR-DSL-DATA set interface Dialer1 ! route-map PBR-LAN permit 1 description This route map is to match all VOIP traffic and force it over the correct ADSL line match ip address VOIP-PBX ! Using next-hop is how I would typically do this sort of thing. ! However - in this case since both links are from the same ISP, the next-hop is the same in both cases. ! So, although I haven't tried it, I am sure the router would have no way to know exactly which link I mean. ! ! In this example, I've used 126.96.36.199 as the gateway IP for both DSL links. ! ! ! Try using VOIP Link ! set ip next-hop verify-availability 188.8.131.52 1 track 1 ! If that fails, try the DATA link ! set ip next-hop verify-availability 184.108.40.206 2 track 2 ! ! ! Because of this, my work-around has been to simply specify the Dialer interface ! of the link I want to use. But this also means no failover to the data link. ! Hope this makes sense. ! ! set interface Dialer0 route-map DSL2-VOIP-NAT permit 10 description This route match is to match NAT traffic for the VOIP ADSL2+ Connection match ip address NAT-POOL match interface Dialer0 ! route-map DSL2-DATA-NAT permit 10 description This route match is to match NAT traffic for the DATA ADSL2+ Connection match ip address NAT-POOL match interface Dialer1 !