2 ISP, no WAN Balance

[JohnAgora]

Hello,

I have 2 ISP but I DON'T need WAN Balance nor failover.

What I need is:

1 ISP-A Default route (OK)

1 ISP-B For administration: 1 VPN, and Trusted hosts for SSH and HTTPS. (Problem)

How can I make the 2nd configuration?

If I put a route 0.0.0.0/0 with more distance or priority, traffic gets in, but response is done through ISP-B.

If I change the route to a more specific (for example 100.100.x.x) is works, but that is not what I want.

PBRs are not working.

Thanks!

[pcraponi]

Let both 0.0.0.0/0 routes with Distance 10

On ISP-B, put the Priority 5

Regards,

Paulo Raponi, NSE8

[JohnAgora]

I've done that but when I do that I can't access the IP of ISP-B

Thanks

[pcraponi]

What do you mean with "can't access" ?

From inside the network? Outside? Have you created the firewall rules?

it has to work. I use it for years

[JohnAgora]

I can't access from outside.

If I do a debug flow trace, it gets stucked in [S.].

If I do a debug sniffer on the interface (ISP-B), I just see the [ S ] arriving.

I think the response to the SYN is beeing send to ISP-A.

I don't have any FW rules in place, cause I just need to access the public IP (to manage the FW).

Thanks for your help

[pcraponi]

Can you put here your Static route CLI configuration? You can obfuscate the IPs... 

[romanr]

Hi,

setting equal distance and a higher priority value on your secondary line should do the trick as Paulo mentioned.

Have you turned on the administrative access on your Wan2 (or whereever your secondary ISP is connected).

the output from "diag debug flow" will give you the reason if it is a routing issue or a policy issue!

@Paulo - where did you do the NSE8 exam - it's still not available here in Europe...

[JohnAgora]

FW # show router static config router static edit 1 set gateway 189.1.2.3 set device "port1" next edit 2 //Not relevant set dst 100.26.28.3 255.255.255.255 set gateway 10.0.0.3 set device "port7" next edit 3 .... //More internal routes edit 40 set gateway 189.5.6.12 set priority 5 set device "port2" set comment "ISP-B " next end

Diagnose debug flow show info that is not very useful.

[romanr]

Show the output of:

diag deb ena

diag deb flow show con ena

diagnose debug flow filter daddr "port2-ip" diag deb flow trace start 10

and the access port2-ip from external

Br,

Roman

[JohnAgora]

Sure.

I saw nothing that helped.

ISP-B's IP is: 189.1.2.3

FW # id=20085 trace_id=6135 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.20.15.38:65027->189.1.2.3:22) from port22. flag , seq 3925503942, ack 0, win 65535"
id=20085 trace_id=6135 func=init_ip_session_common line=4569 msg="allocate a new session-4f9f2dba"
id=20085 trace_id=6136 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.1.2.3:22->189.20.15.38:65027) from local. flag [S.], seq 3002273997, ack 3925503943, win 5792"
id=20085 trace_id=6136 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, reply direction"
id=20085 trace_id=6137 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.20.15.38:65027->189.1.2.3:22) from port22. flag , seq 3925503942, ack 0, win 65535"
id=20085 trace_id=6137 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, original direction"
id=20085 trace_id=6138 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.1.2.3:22->189.20.15.38:65027) from local. flag [S.], seq 3002273997, ack 3925503943, win 5792"
id=20085 trace_id=6138 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, reply direction"
id=20085 trace_id=6139 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.20.15.38:65027->189.1.2.3:22) from port22. flag , seq 3925503942, ack 0, win 65535"
id=20085 trace_id=6139 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, original direction"
id=20085 trace_id=6140 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.1.2.3:22->189.20.15.38:65027) from local. flag [S.], seq 3002273997, ack 3925503943, win 5792"
id=20085 trace_id=6140 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, reply direction"
id=20085 trace_id=6141 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.20.15.38:65027->189.1.2.3:22) from port22. flag , seq 3925503942, ack 0, win 65535"
id=20085 trace_id=6141 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, original direction"
id=20085 trace_id=6142 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.1.2.3:22->189.20.15.38:65027) from local. flag [S.], seq 3002273997, ack 3925503943, win 5792"
id=20085 trace_id=6142 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, reply direction"
id=20085 trace_id=6143 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.20.15.38:65027->189.1.2.3:22) from port22. flag , seq 3925503942, ack 0, win 65535"
id=20085 trace_id=6143 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, original direction"
id=20085 trace_id=6144 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=6, 189.1.2.3:22->189.20.15.38:65027) from local. flag [S.], seq 3002273997, ack 3925503943, win 5792"
id=20085 trace_id=6144 func=resolve_ip_tuple_fast line=4479 msg="Find an existing session, id-4f9f2dba, reply direction"

Thanks for your help!