Hello, I´ve this example scenario.
The biggest problem is how to achieve load balance for outgoing traffic between my two ISP.( ISP1- 500Mbps, ISP2 - 700Mbps)
Network 10.1.1.0/24 => ISP1
Network 10.1.2.0/24 = > ISP2
For inbound traffic balance I use prepend
.
Are you receiving full routes or just default routes?
For what you’re trying to do, default route should pretty much be all you need.
You could use route marks and mangle table packet marking to achieve your goal with a single router, but the logic and failover configurations are quite crazy.
It would be better to use 2 routers. It requires no packet marking craziness.
Configure EBGP:
Connect ISP1 to R1, and ISP2 to R2.
Set both R1 and R2 to originate 10.1.1.0/24 and 10.1.2.0/24 with network statements (use synchronization)
Then make R1’s out-filter to ISP1 do prepend on 10.1.2.0/24, and R2’s out-filter do prepend on 10.1.1.0/24
*Do not use blackhole route to “nail up” the advertisements. This design has a nice benefit that R1 will withdraw its advertisements from eBGP if its LAN interface fails and it can no longer reach 10.1.1.0/24 and 10.1.2.0/24
If the ISPs support BGP communities that lower the ISP’s local preference, use this in stead of prepend. It will be MUCH more effective. Send the community which lowers preference to backup-only level.
Configure internal redundancy with ospf and iBGP:
Next, create a direct link between R1 and R2, use some other IP address on the link like 10.255.255.0/24 with 10.255.255.1 = R1 and 10.255.255.2 = R2 (really use private IP on this link)
Also create loopback interfaces (bridges with no ports) loop-bridge0 on each router, and assign some unique local ID like 10.10.10.1/32 on R1 and 10.10.10.2/32 on R2.
Configure ospf on R1 and R2 with 10.255.255.0/24 and 10.10.10.0/24 as networks in backbone area. (allows dynamic reachability between them)
Also on R1, add the isp1 interface to OSPF, but set the interface to passive.
Do the same on R2.
Peer R1 and R2 with each other using the 10.10.10.x IP addresses as remote/local peering address.
iBGP is much less desirable than ebgp, so R1 will always use isp1 as default GW so long as isp1 bgp is operational, and R2 will always use isp2 as long as isp2 bgp is operational. If isp2 goes down, then R2 will lose its 0.0.0.0/0 route from ebgp, but will still have a backup default route from R1 in iBGP, so it will start going out isp1 while isp2 is down.
Finally-
Take advantage of having two routers and give yourself more internal redundancy with vrrp:
R1 = 10.1.1.253/24 and 10.1.2.253/24
R2 = 10.1.2.254/24 and 10.1.2.254/24
vrrp addresses are 10.1.1.1/24 and 10.1.2.1/24
Make R1 primary for 10.1.1.1 and make R2 primary for 10.1.2.1
Hosts in each network use 10.1.x.1 as their default GW, which under normal circumstances will be R1 for hosts in 10.1.1.0/24 and R2 for hosts in 10.1.2.0/24
There - you’re fully redundant, and have the routing policy you want, and it’s all automatic using the natural behavior of the routing protocols.
Final Thoughts
I suspect that your ACTUAL topology is a little more advanced on the inside, and that you don’t just have two flat /24 public network interfaces. If this is the case, then you can divide up your access routers into two OSPF non-backbone areas. Make sure that only 10.1.1.0/24 addresses come from area 1, and only 10.1.2.0/24 addresses come from area 2. Then you set your metrics so that routers in area 1 tend to favor R1 as the default gateway, and area 2 favors R2 as the default gateway.
Honestly, you don’t have to make it that complicated because who cares what source IP goes out which ISP, right? So long as outbound is balanced… so you could just make some routers favor R1 as default GW (regardless of the customers’ public IP addresses) and others favor R2 as default GW. Whichever router they hit first will go out via that isp link, so don’t worry about strictly balancing on source. Just balance by how much you connect to each router and let things evolve naturally.
Another point - it might be a good idea to get each isp to give you default+interior/customer routes. This way, stuff directly in isp1 will always go out isp1, and stuff directly in isp2 will always go directly out isp2. If you do this, you should use as_prepend in stead of communities (if you followed the earlier suggestion).
I know this is a lot to digest, but it’s really a much more scalable, best-practice solution than to do some forced behavior inside of a single router. Such things skyrocket in complexity as the number of interfaces and network destinations gets beyond even just 3 of each, and DEFINITELY doesn’t scale well with multiple routers in your topology.
Thank´s Zerobyte for the quick and complete answer.
For now, I´ve only one CCR1036 router.
For one ISP I´m accepting default routes, but the other ISP are advertising 3800 routes from my country. If I do mangle it allways go to ISP1 ignoring ISP2.
Next month we are introducing another ISP.
I don´t know if is possibly in mikrotik to do the following
ISP1 = GW = 10.6.51.1/20 (BGP default route)
ISP2 =GW = 190.20.7.1/20(BGP default route)
ISP3=GW = 200.40.7.1/24 (local traffic from my country , full routing table ~3800 .)
0.0.0.0/0 => 10.6.51.1 (mark_to_isp1)
0.0.0.0/0 => 190.27.7.1 (mark_to_isp2)
Customers networks
10.1.1.0/24 if the destination is any local route go to ISP3 if not mark to isp1.
10.1.2.0/24 if the destination is any local route go to ISP3 if not mark to isp2.
Regards,.
If you want quick-and-easy load balancing, then you could engineer it by getting “full routes” from everyone, choosing some stable destinations like 4.0.0.0/8, 8.8.8.0/24, and 12.0.0.0/8 as the targets, filter out everything except 4.0.0.0/8 on isp1, 8.8.8.0/24 on isp2, and 12.0.0.0/8 on isp3.
Then create one static route with destination=0.0.0.0/0 three gateways: 12.0.0.1, 8.8.8.1, and 4.0.0.1, and set scope=50, target scope=40
I tested this in the lab and it works. It’s going to be “per connection” load balancing, so don’t expect perfect balance.
It doesn’t require you to do backflips with route marks and mangle table rules.
(Those have their place as a SOHO balancing some NAT links, but in my opinion, this is bad practice when using BGP - you should use routing protocols’ natural behavior)
You might even enhance this a little bit by having the providers send communities as well (if they support them) and in each peer’s in-filter, also allow routes with the community that means the prefix is local to that ISP.
This way, you don’t send packets “the long way around the Internet” just to reach an ISP that you’re directly connected to.
If they don’t all do communities, and you want to do this behavior, then have them all send local/customer routes only and then use some guaranteed-stable prefix from each provider’s network in stead of the Level3, Google, and AT&T prefixes above.
Thank´s Man for another quick response.!!
Hello everyone,
I have faced a weird situation as if I am the only one in the world, who tries to settle that kind of problem. An external server changes its address. Client software connects to it via IP, not FQDN. How might I perform a destination address substitute in order not to reconfigure hundreds of client computers?
I tried all possible kinds of dstnat, netmap, mark routing – RouterOS either does nothing, or refuses to accept a rule at all. Does that mean that it cannot do destination address spoofing at all?
Yours faithfully, Vadim.