2

I have a set of servers that I want to set on two distinct networks.

The justification is: 1) Last Mile Network Redundancy 2) Load Balancing

It is very unlikely we will be allowed to run BGP for external routing so we're going to just do round-robin DNS. So we will have two distinct IP address ranges for each network. For the purposes of this question well say (Net1 = 60.25.33.128/28) and (Net2 = 152.22.23.0/28). I would also like to run OSPF (or some other internal routing) to balance between the two lines. I have a Cisco 2800 (2811) to route between the networks.

The Cisco router is currently configured to use 1 to 1 NAT (ip nat inside source static network 172.16.1.0 60.25.33.128 /28). With this configuration I am working fine on Net1. The problem is that when I bring in the second network I anticipate trouble. For one if I run the command ip nat inside source static network 172.16.1.0 152.22.23.0 /28 (if it will let me do that) the NAT is overlapped. And while the server won't know which network the traffic has originated (good thing) the router will not know which IP address to put back on the IP header which would make requests coming from the secondary network unable to receive a response.

If, however I were to do ip nat inside source static network 172.16.2.0 152.22.23.0 /28 instead (creating a new internal network) and just assign the server a 172.16.1.x and a 172.16.2.x IP address then that would fix the NAT problem but at that point I'm not sure the router will be able to effectively route packets through the best network available. The networks have very different line speeds and because the internal routing is round-robin DNS there could be a better return route. That is to say it should be fine for a packet that originated from the 60.25.33.128 network to be routed back through the 152.22.23.0 network so long as I preserve the originating IP address header.

Any ideas on the best way to configure the network / Cisco 2800 router to achieve my goal?

Thanks!

Improve this question
3
  • I should also note that I would favor any possible solution that would require the servers to have only 1 IP address. If we were to bring in 4 or 5 more lines then it becomes a far less elegant solution!
    – Nate Zaugg
    May 11, 2011 at 16:17
  • Would it be possible to request an independent 3rd block of Public IPs? Then you could NAT to the 3rd block, and use the router to load-balance routes between the two ISP networks.
    – Robert
    May 11, 2011 at 16:28
  • I guess I'm not sure I understand what the 3rd block would be required to use NAT. Could you elaborate -- perhaps in the form of an answer?
    – Nate Zaugg
    May 11, 2011 at 21:09

1 Answer 1

Reset to default
1

Your server will still need a defined gateway route of last resort (0.0.0.0/0), breaking the high-availability premise behind this whole idea. Intelligent routing can fix this on the outgoing side.

Your round-robin DNS will address serving records for incoming IP connections, but not the availability of the IPs. That is where BGP comes in. You need BGP to advertise your AS/IPs across multiple links.

BGP was made for a reason, and this is it.

Improve this answer
3
  • He could have multiple default gateways defined and load-balance between them as long as they are equal cost. This would allow for high-availability. As for load-balancing based on network speeds, this would be impossible with static routes.
    – Robert
    May 11, 2011 at 16:42
  • If I had an intelligent DNS server that knew if a line was down and gave out only IP addresses for lines that are up then the setup would work fine. I'm mostly interested in configuration of internal routing to help balance the same traffic between two different lines.
    – Nate Zaugg
    May 11, 2011 at 16:48
  • 1
    you're dangerously close to a downvote with this kind of dogmatism about BGP and his problem. When was the last time you found a provider who would announce a /28 outside their own ASN?
    – Mike Pennington
    May 12, 2011 at 2:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.