Load balance 2 WAN provider using each available IP block

[caramelmeimei]

We have a current SD WAN setup with LAN internet connectivity traffics load balanced to 2 ISP providers - both WAN interface IPs are used and the bandwidths are combined.

• 192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)
  
  1. Both IPs are used randomly in each session even in a single device
  2. Bandwidths are combined to 100Mbps

This time I would like to use the other available IPs from each ISP block then still have the bandwidth combined and load balance from a diff LAN subnet.

• 192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)

Attempt: Assign overload IP pool for each ISP, and setup an outbound firewall policy NAT to it.

1. Only single IP (random) is used per device
2. Only single ISP bandwidth is utilized - 50Mbps

[gfleming]

What version of FOS are you on?

Do you have any rules or services in your SDWAN config? Is there more under your 'config system sdwan' configuration?

Can you try changing the LB method to "source-dest-ip-based"?

Can you further explain the behaviour you are seeing with regards to LAN users using only single IP (random) per device? How is it random? Based on your config they should only be getting one IP from the pool that is linked to that ISP.

Next thing we could try is splitting the FW policy into two. One for upg-zone-wan1 and one for upg-zone-wan2 with associated pools, etc.

[caramelmeimei]

With the current setup:

• 192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)
  
  1. Both IPs are used
     • In a single device, when check for public IP : for instance, ipchicken see 1.1.1.1 and ipcow see 2.2.2.1
  2. Bandwidths are combined to 100Mbps
     • When speedtest

This is the target behavior I am expecting.

However after setting FW policy with NAT IP Pools, below are the results:

• 192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)
  1. Only single IP (random) is used per device
     • In a single device, when check for public IP, regardless of how many iplocation sites I use, it only gets 1.1.1.2. Random like, another device is only 2.2.2.2.
  2. Only single ISP bandwidth is utilized - 50Mbs
     • When speedtest

Having said those, I believe "changing the LB method to source-dest-ip-based"  & "splitting the FW policy into two" - please correct me if I'm wrong, wont meet the load balancing I need base on the current setup.

I am in v7.2.3

The reset of sdwan config are the ff:

config health-check
edit "ISP1_GW_PERF"
set server "1.1.1.254"
set members 1
config sla
edit 1
set latency-threshold 50
set jitter-threshold 50
set packetloss-threshold 10
next
end
next
edit "ISP2_GW_PERF"
set server "2.2.2.254"
set members 2
config sla
edit 1
set latency-threshold 50
set jitter-threshold 50
set packetloss-threshold 10
next
end
next
end
config service
edit 1
set name "ISP1_ISP2_WAN"
set mode load-balance
set dst "all"
set src "all"
config sla
edit "ISP1_GW_PERF"
set id 1
next
edit "ISP2_GW_PERF"
set id 1
next
end
set priority-members 1 2
next
end

[gfleming]

>>>I believe "changing the LB method to source-dest-ip-based"  & "splitting the FW policy into two" - please correct me if I'm wrong, wont meet the load balancing I need base on the current setup.

Load Balancing is a function of the SD-WAN rule and has nothing to do with the FW policies allowing the traffic. So splitting your FW policies into two will not affect your load balancing (assuming they allow the traffic).

Also, source-dest-ip based load balancing method means each connection will be evaluated based on the source and destination to determine the hash and decision making criteria to load balance it onto a specific link. Therefore source client A going to dest A will load balance on to ISP1 and source A dest B will go to ISP2. It really helps ensure the good sharing between ISP links but also maintains stability on the client level. i.e. some websites will break if they source IP keeps changing on them.

Please clarify something for me though: the load balancing is only done on a session-by-session basis. So there is no way a client will see 100mbps on speed test when you are load balancing between two 50mbps links. The behaviour you are describing in scenario 1 does not make sense. In fact the behavriour you are describing in the second scenario makes more sense. Things are being load balanced (one client gets a 1.1.1.2 address and another gets a 2.2.2.2 address. Perfect! And 50mbps on a speedtest is all you'll see on a single client.

What do you see in the SD-WAN Zones configuration on your FGT in terms of bw utilization on each link?

You can also add an interface bandwidth usage graph for each ISP link onto your Dashboard.

[gfleming]

>>>I believe "changing the LB method to source-dest-ip-based"  & "splitting the FW policy into two" - please correct me if I'm wrong, wont meet the load balancing I need base on the current setup.

[gfleming]

Load Balancing is a function of the SD-WAN rule and has nothing to do with the FW policies allowing the traffic. So splitting your FW policies into two will not affect your load balancing (assuming they allow the traffic).

[gfleming]

Also, source-dest-ip based load balancing method means each connection will be evaluated based on the source and destination to determine the hash and decision making criteria to load balance it onto a specific link. Therefore source client A going to dest A will load balance on to ISP1 and source A dest B will go to ISP2. It really helps ensure the good sharing between ISP links but also maintains stability on the client level. i.e. some websites will break if they source IP keeps changing on them.

[gfleming]

Please clarify something for me though: the load balancing is only done on a session-by-session basis. So there is no way a client will see 100mbps on speed test when you are load balancing between two 50mbps links. The behaviour you are describing in scenario 1 does not make sense. In fact the behavriour you are describing in the second scenario makes more sense. Things are being load balanced (one client gets a 1.1.1.2 address and another gets a 2.2.2.2 address. Perfect! And 50mbps on a speedtest is all you'll see on a single client.

[gfleming]

What do you see in the SD-WAN Zones configuration on your FGT in terms of bw utilization on each link?

[gfleming]

You can also add an interface bandwidth usage graph for each ISP link onto your Dashboard.

[caramelmeimei]

What do you see in the SD-WAN Zones configuration on your FGT in terms of bw utilization on each link?

It manages to have a balance load. This is in the actual infra using the first scenario sdwan config - boxed usage when did the speedtest:

Each link had 200 bandwidth. Got the speedtest result below with actual usage.

[gfleming · Accepted solution]

OK today I learned that fast.com uses multiple sesssions and servers to conduct a speed test. This makes sense why it would be combined across both wan links then!

So currently you have one FW policy that works and you have another FW policy referencing a different LAN subnet and using different IP pools that does not work in terms of load balancing? Is that correct?

Have you tried splitting the FW policies for the different LAN subnet for each ISP/pool?

[caramelmeimei]

Great! Splitting policies did it. Both IPs being used and bandwidth on speedtest are combined now. Thank you very much Graham.