2

I've searched thoroughly in an attempt to find a similar question here, but aside from finding information about pfSense (which appears to only support 1 WAN?) I can't find much else...

Our current office setup consists of about 15 Macs, and 20-odd Windows PCs. We are currently all connected to a 50MB Virgin fibre connection, but a suggestion has been made to get a second ~100MB connection and filter traffic through each WAN depending on their IP. Ultimately we would like the 50MB line to be reserved/used by only ~7 Windows PCs, and all other traffic should go through the other WAN. We also have a Windows Exchange server and some NAS drives that we will require all machines to have access to, and we have a Cisco RV016 VPN Router which is supposedly being used as a load balancer(?).

Our reasons for this change are that the 50MB line isn't capable of dealing with the traffic being put through it by all members of staff, but Virgin don't offer a static IP on anything >50MB in our area. A static IP is required by our developers for their line of work.

How would we best implement this? What additional hardware would you suggest we get (if any)?

3

As one of the previous answers states, you can use Policy Based Routing and set up a route map on your router. However, instead of using VLANs or Static IPs, you could use QoS Marking instead. This could be rolled out in a group policy to your Windows PCs, and the route map on your router could be configured to look out for a particular DSCP value to differentiate between the PCs and the Macs.

Like I say, this can be configured with a group policy, so you could literally just add or remove computers to or from a group in order to choose which computers use which internet connection.

3
  • Thanks for your response, I'll get to work on this and as soon as I work out which one works, I'll mark as the correct answer!
    – Nick
    Apr 24 '15 at 10:48
  • Both will work - it just depends on how you want to manage it. One gives you two separate routed networks managed by VLAN membership on the switches. The other will give you a single network that will allow you to manage the Windows computers via group policy. The first one would probably be easier to troubleshoot in the event of a problem. The second one will be nice and easy to manage - well, for the Windows PCs anyway!
    – ChadH360
    Apr 24 '15 at 10:55
  • This is the route we've taken, thanks for your assistance!
    – Nick
    Apr 27 '15 at 8:11
1

EDIT: The below should work with a Cisco ASA and Cisco Layer 3 Switch

This might work:

  • Configure two VLANs - one for Windows and one for MAC's
  • Assign independant DHCP scopes to the two VLAN's
  • Configure routing to allow VLAN's to pass traffic between each other, which will allow both MAC & Windows to speak to Exchange server.

Then you can configure somethig called PBR available on Cisco.

You can configure somnething called Polic Base routing (PBR) on a Cisco ASA The router passes the packets through enhanced packet filters called route maps. Based on the criteria defined in the route maps, packets are forwarded/routed to the appropriate next hop.

http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/ http://howdoesinternetwork.com/2013/configuration-of-pbr-policy-based-routing

If you want to keep all computers on the same subnet, what you could do is configure DHCP to assign IP's based on MAC address and then create a PBR per IP.

1
  • Thanks for your response, I'll get to work on this and as soon as I work out which one works, I'll mark as the correct answer!
    – Nick
    Apr 24 '15 at 10:48
0

I strongly recommend the use of a link balancer for this type of environment.

I make heavy use of the Elfiq Link Balancers at my customers' locations because it allowed them to accommodate multiple ISPs and transit options, while retaining one firewall (usually Cisco ASA).

A solution like this gives you incredibly granular control over inbound and outbound load balancing by source, protocol and allows you to use any of 8 load-balancing algorithms. You can set thresholds on how connections are shared across the ISP links; e.g. if the 50Mbps link is 80% utilized, start sending traffic over the other line. Or perhaps round-robin allocation... or always use the least-busy line for new connections.

The ISP links plug directly into the Elfiq device, which sits in front of your firewall and has a passthrough in case of hardware failure. You can still terminate your VPNs and such to an endpoint.

It's worth some consideration...

enter image description here

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.