Default route tracks IP SLA - Tip

[Julian Ortiz]

Hi community,

I need a tip for the following scenario. I have two branches with routers 1 and 2 (R1 and R2). I want R2 reaches the Internet through the upper path (MPLS A), and in case there is something wrong here, it goes through the lower path. For this, I am going to create a primary and secondary default routes on R2 with differents ADs. I am going to create a IP SLA to ping 8.8.8.8 through the upper path with a PBR, track this IP SLA, and use this track to use or not the primary default route.

The configuration on R2 will be something like this:

ip sla 1

icmp-echo 8.8.8.8 source-ip R2_int_loopback_1

ip sla schedule 1 start-time now forever

track 1 ip sla 1 state

ip route 0.0.0.0/0 IP_RC track 1

ip route 0.0.0.0/0 IP_RD 200

ip local policy route-map ping_ipsla_over_upper_path

route-map ping_ipsla_over_upper_path permit

match ip address 101

set ip next-hop IP_RC

access-list 101 permit ip host R2_int_loopback_1 host 8.8.8.8

Then, my doubt is, is this fine? Will the IP SLA pings reach 8.8.8.8 because the PBR configuration? Or will they need also the primary default route to have a route on the IP routing table?

Many thanks,

Julián

[MHM Cisco World]

please see below comment 

[Julian Ortiz]

Hi MHM,

I don't know what is the protocol the ISP uses, in fact, I am not sure if ISP A and ISP B uses MPLS to give the connectivity between R1 and R2, or they just have a direct fiber. I put MPLS as an example. I want to focus in the configuration of R2, IP SLA, and if IP SLA pings will reach 8.8.8.8 because of the PBR or if they will need the default route as well.

Regards,

Julián 

[MHM Cisco World]

please see below comment 

[Julian Ortiz]

Hi MHM,

The example is a bit different because is only tracking the ISP routers, I want to track all the ISP paths until Internet. But imagine the IP SLA configuration is something like this:

track 8 ip sla 1 reachability

ip sla 1
 icmp-echo 10.10.10.10 source-ip 10.0.12.1

ip route 0.0.0.0 0.0.0.0 10.0.12.2 track 8

Here the IP SLA pings use the default route to reach 10.10.10.10, but this default route is conditioned by the track or IP SLA result. Then, what is the track state at the beggining? Up or down?

Regards,

Julián

[MHM Cisco World]

please see below comment 

[Julian Ortiz]

Hi MHM,

Then, if local PBR is used for router generate traffic why do I need this static route?

ip route 8.8.8.8 IP_RC

This static route makes the same thing that the PBR, which sends the pings to IP_RC, and the PBR will apply because the pings are generated by the router R2:

route-map ping_ipsla_over_upper_path permit

match ip address 101

set ip next-hop IP_RC

access-list 101 permit ip host R2_int_loopback_1 host 8.8.8.8

[MHM Cisco World]

please see below comment 

[Julian Ortiz]

Hi MHM,

Honestly I don't understand you very well. When you say

IP SLA now use second static route BUT this make IP SLA UP and return the first failed static route...

I think IP SLA will never use neither the primary default route nor secondary default route, because the PBR is matching the IP SLA traffic and PBR will send it toward RC, because this traffic is locally generated from R2, and PBR has preference over the default routes in the IP routing table. By the other hand, in the example you indicated, the track command has keyword "reachability" and I use "state", do you know the difference between them?

track 8 ip sla 1 reachability

[MHM Cisco World]

I do small LAB and see if the IP SLA include local router generate traffic or pass through traffic, 
IT LOCAL ROUTER TRAFFIC 

so depend on your config YES the IP SLA use the next-hop as config under PBR not use the default route,
when I do lab I make the default route point toward ISP1 but the PBR use next-hop of ISP2 and do wireshark capture the traffic pass to ISP2 
and Yes the IP SLA is pass to ISP2 even if default route point to ISP1.

but what I find that this config make router some time blackhole, 
the case is
ISP1 is UP and router use default route toward ISP1,
the track of IP SLA pass to ISP2

BUT
ISP2 is down

the router also delete the default route "IP SLA pass to ISP2 is timeout" 
this make router drop traffic in blackhole.

hope my explanation is solve for your issue.

[Jon Marshall]

To answer your specific question the PBR configuration you have should send the pings to RC and as long as RC knows how to get to the internet then it should work. 

Jon

[Julian Ortiz]

Hi Jon,

Then I understand the IP SLA pings don't use the default route to reach 8.8.8.8 but the PBR policy (now I remember PBR has preference over the IP routing table), and yes, RC knows how to get the Internet.

Thanks,

Julián

[paul driver]

Hello
Just note when you policy route, you may incur asymmetric routing as the return path may differ from you original PBR path.

To append ip sla on an internet address you need to make sure that tracked destination is not seen by the sla track via the backup default route otherwise the sla track wont fail back over to to primary as/when that path becomes available again.

Please review attached file:

[Julian Ortiz]

Hi Paul,

OK, I think to do a similar PBR on R1 to make sure there is no asymmetric routing. By the other hand, what's the difference between your attached file configuration and my configuration? I see they do the same thing.

Regards,

Julián

[paul driver]

Hello Julian
My apologies i must have mis-read that, it looks fine to me.