I find my self in a situation I was in not too long ago, but I can't remember how I resolved it :)
I have a Cisco IOS router with a LAN interface (fa0/0) and a WAN interface (fa0/1), and 2nd WAN interface (fa0/2).
- There are two LAN sub-interfaces fa0/0.10 and fa0/0.20 lets say.
- There is a default route via fa0/1. However, there is a static route to a specific subnet, lets say 184.108.40.206/24 via fa0/2 (fa0/2 is closer to this subnet, but a more expensive $$$ WAN link)
All my fa0/0.10 users are accessing 220.127.116.11/24 and so the static route sends them out of fa0/2 (WAN2). For all other destinations fa0/0.10 users go via the DHCP default route I receive on the WAN1 interface fa0/1.
The problem definition;
Users in the fa0/0.20 subnet just access the Internet. No user in my fa0/0.20 subnet every really has the need to access the remote 18.104.22.168/24 subnet. Rarely they do though, in which case the static route sends them via fa0/2. I don't want this though, I want them to access 22.214.171.124/24 via fa0/1, the default WAN interface. I believe I can achieve this via PBR, but I can't seem to get it to work?
This is the config I am trying at present;
interface FastEthernet0/0.10 description LAN1 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 ip nat inside ip virtual-reassembly interface FastEthernet0/0.20 description LAN2 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 ip nat inside ip virtual-reassembly ip policy route-map FORCE-LAN2-VIA-WAN1 interface FastEthernet0/1 description WAN1 ip address dhcp ip nat outside ip virtual-reassembly interface FastEthernet0/2 description WAN2 - Used for 126.96.36.199/24 ip address 188.8.131.52 255.255.255.0 ! Static route to route to a remote subnet via 2nd WAN link ip route 184.108.40.206 0.0.0.255 220.127.116.11 ! A default route is received on fa0/1 (WAN1) via DHCP from ISP ! for all other traffic ! ! NAT fa0/0.10 users when accessing the Internet via WAN1 ip nat inside source route-map ROUTE-WAN1 interface FastEthernet0/1 overload ! ! NAT fa0/0.20 users out via WAN1 ip nat inside source route-map FORCE-LAN2-VIA-WAN1 interface FastEthernet0/1 overload route-map ROUTE-WAN1 permit 10 match interface FastEthernet0/1 route-map FORCE-LAN2-VIA-WAN1 permit 10 match interface FastEthernet0/0.20 set default interface FastEthernet0/1
I am trying to apply policy based routing directly to the fa0/0.20 sub interface to force all traffic via WAN1, fa0/1. My understanding is, that because there is a more specific route than the default route received by DHCP on fa0/1 in the FIB, it overrides the PBR and traffic from fa0/0.20 to 18.104.22.168/24 is still using WAN2, fa0/2. Or at least, I believe this to be the case when using "set default interface...". If I were to use "set ip next-hop" for example, this would force the PBR to take precedence, but WAN1, fa0/1, receives an IP by DHCP and is thusly changing :)
As a side note; There are actually many static routes via WAN2, so I don't want to reverse the situation and policy route fa0/0.10 via WAN2 for specific subnets. The config there is more complex than I have let on, long and short of it is though, it is not viable to change that. Additionally, if there is a better way to tackle this problem other than PBR, I'm all ears. I am fighting with this method because it is the best solution I am aware of.
Update Added a spectacularly drawn topology diagram