2

I am new to networking and I have the following problem. In the small company I work in we have a load balance router with two ISPs (only one ISP is connected at the moment) and to the router there is a server connected with several websites hosted on it. The server has a static IP address from ISP1. This is the address that is routed on the Internet. The problem is, when ISP2 is connected to the router, it gives the server a different IP and the sites are not accessible anymore. All I can think of at the moment is calling ISP2 and requesting that they route the address from ISP1, but I don't know if they will agree to that. What is the best way to solve the problem and is there a solution that does not involve calling either ISP? Thanks in advance.

UPDATE: While the solution below is perfectly valid, it turns out that in our circumstances it will be pretty hard to accomplish, as we are not directly connected to the ISPs and configuring BGP will require lengthy talks with other people. Is it possible to just register the address from ISP2 (with RIPE ?), so that if the first one fails, the server is reached via the second one?

Improve this question
3
  • what is the make and model of the router?
    – hertitu
    Dec 12, 2016 at 9:11
  • It is TP-LINK TL-R480T+ Load Balance Router.
    – peter_s
    Dec 12, 2016 at 11:20
  • Unfortunately, questions about consumer-grade devices are explicitly off-topic here. You could try to ask this question on Server Fault for a business network, or on Super User for a personal network.
    – Ron Maupin ♦
    Dec 12, 2016 at 14:57

4 Answers 4

Reset to default
1

The most appropriate solution for you is to run BGP with your own address space. Then you can allocate your own Provider Independent address to the server and advertise it to both ISPs. Otherwise any adequate ISP will not agree to route network wich doesn't belong to you.

Except BGP the only option I see is to use something like dyndns. Albeit this solution is inappropriate for critical applications.

Improve this answer
2
  • Thanks for the answer. How do I choose an IP address then? From which ISP's network should it be? Or do I contact RIPE NCC directly (I'm in Europe)?
    – peter_s
    Dec 12, 2016 at 11:36
  • There was possibility to obtain an IPv4 block some time ago, I'm not sure about present though. Try to contact RIPE. 3rd party organizations could lend you and IP block as well.
    – ar_
    Dec 12, 2016 at 12:03
2

Unfortunately BGP will not help you, this is small-scale. You will not be able to justify a provider-independent block of addresses for a single web server even if RIPE is still issuing them. Without a large enough address block, no ISP can advertise your PI address block anyway.

If you really must host these webservers yourself then the solution is to host the DNS for your domains, possibly using CNAME records if you need to. You control the IP address used to contact the servers at any moment in time. You may need to buy some sort of DNS appliance or load-balancer to do this, or maybe just multiple use DNS views on a single DNS server. It just depends on your business need and budget. Good resilience is expensive and you need to analyse what risks you are protecting against and ensure that in increasing the complexity you are not creating extra technical and/or operational risks. The details of this solution are off-topic here.

However, unless you have ambitions to grow into a hosting centre business, I can't see why you wouldn't just stick the webservers in the cloud and relieve yourself of this sort of network problem.

Improve this answer
0

I agree with @artem_d93 that BGP is the most appropriate solution. With BGP, when one path fails, re-convergence occurs and a new path (over the alternate ISP) is presented to network traffic. This can take several minutes to occur.

You really need to ask yourself or management how critical it is that these servers remain available if an ISP or a piece of network equipment fails. If it's not overkill and it's really necessary, one way to go might be to so something like I've done.

I have two Cisco 4431 routers for each ISP, each connected directly to the other, sharing a standby (HSRP) address. These connect to a pair of DMZ switches that are port channeled together (not a stack as a stack could fail). Then have two ASA 5515X that are connected so they share state and failover. Then on to two Nexus 5548UP switches at my network core. This is a fully redundant setup so if there is a failure anywhere along the line, we will keep running. Our IPv4 and IPv6 blocks are used for addresses between the ASA 5515x and ISR4431 routers. I also have a dedicated WAN router (that has other one off connections) connected back to my core as well as to the 4431 routers

Ask one of your ISPs to allocate you an IPv4 /24 block (the smallest possible). You will pay a monthly fee for this, but then it will be assigned for your needs as long as you stay with the ISP. You will need at least one business class router or routing firewall appliance that can handle BGP. Most of the dedicated routers can as well as some of the firewall appliances. Consumer grade equipment cannot.

Once you have a block assigned, you will need to get an ASN from RIPE. This Autonomous System Number will allow you to be a unique node on the internet.

Once you have redundant ISPs, you should have two routers that share an IP address (look up HSRP) in a standby/failover config, each router connected to one ISP. With HSRP, if one router fails, traffic will run over the other - the will share one of your assigned public addresses.

Between the previously mentioned routers and your private network, you should have a (or a pair) of firewall devices. And perhaps a pair of DMZ switches. With all of this interconnected, you can have a fully redundant internet connection.

Or you can have a pair of firewall devices that have all of this self contained. It can get pretty extensive, but if you really need it, it's really a solid way to go.

Other options:

  • If you are accessing the addresses by IP address and port, give your end users both and tell them to use one if the other fails to load. It's clumsy work-around though.

  • If you have control over your DNS records, you can update the address, but make sure the TTL is set very low so stale records won't be around very long.

  • Use a web hosting service if possible - Some of them can provide VPN connectivity so the hosted servers can access internal data, however the type of access might make this unusable (such as database access).

Improve this answer
1
  • Thanks for the reply; that's quite a setup you've done. However, taking into account what you and marctxk have said, I'm leaning towards just leaving it as it is. Since I don't have access to the whole internal network, I have to coordinate BGP config with other people; there is little to no chance that RIPE will give us PI addresses and even if they do, there's the whole added complexity that is not really necessary. And the sites do not contain such critical information that they absolutely have to be accessible 100% of the time.
    – peter_s
    Dec 13, 2016 at 19:11
0

Your server is not behind a router if it is getting a public IP address from ISP1 via DHCP.

A DNS A record can take a secondary IP address. Use that for the failover/backup access.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.