question about multiple ISP's and procurve 5308

[Mike Tupker]

We are thinking about adding another route out to the internet through a secondary ISP. What I'd like to do is route all traffic from one vlan through connection 1 and the rest through connection 2.

The switches that are being used in this setup are 5300xl series and 4100gl series. To make matters more interesting, the 4100gl is actually in another building on campus and will be connected to the 5300xl with fiber. Currently our main internet connection is connected to a firewall which is connected to the 5300xl.

I know this switches can also be layer 3 devices however i'm not sure how to setup the routes to achieve the results I want. Buying new equipment is not necessarily out of the question either, but from what I've read there should be some way to make this work. Thanks in advance.

[Matt Hobbs]

With the 5300, you can only set one default route, or if using OSPF ECMP it will still select only one of the routes to send traffic through. Basically this rules out the option of the 5300 handling this itself.

In your situation though I'm thinking that if you enable the 4100 as a router too, then it can have its own default route and you'll be able to achieve what you're after.

If the 5300 was looking after VLAN1, and the 4100 looking after VLAN2, all hosts on VLAN2 would set their default gateway as the IP address of the 4100. The link between the 5300 and 4100 would be untagged VLAN1 and tagged VLAN2 (or tagged both). You could physically connect the secondary internet connection anywhere as long as it was in the correct VLAN.

Bearing in mind though that the 4100 isn't as powerful as the 5300, so you may find it's performance starts to suffer under heavier loads.

Another option altogether would be the 7000dl series which can do this type of load balancing by itself.

[Mohieddin Kharnoub]

Hi

I believe if your secondary ISP connection is connected to the same firewall or to another firewall, then the best way for defining the routes to ISPs is by using the Firewall.

Its very easy to do that by using the Firewall, you can control your traffic, load balance between your 2 ISP connections, and also you can create a Backup route if one ISP connection failed.

Matt's idea is another cost effective solution if you don't want to use the firewall.

Good Luck !!!

[Mike Tupker]

Thats kind of what I was afraid of based on what I've seen for configuration options on the 5300xl. Sadly the second internet connection will not be coming into the campus anywhere near the firewall. Actually, there will be a dedicated long distance 20Mbit wifi link to another building in town where the second internet connection will be connected to another firewall.

I did have a bit of an afterthought about this. Would it be possible to simply change the default gateway value on the DHCP server for the various vlans to direct the traffic straight to one firewall or the other. I know I would loose any failover ability if this would work, but I'm fine with that. Thanks for everyone's input.

[Mohieddin Kharnoub · Accepted solution]

Hi

Once you change the Gateway in the DHCP scope for each Vlan, none of the clients will be able to connect because each client's Gateway is his Vlan IP Address of the switch.

I recommend you to try using the existing firewall, like if you have another Ethernet port to connect the new Internet Connection.

or

I have a suggestion, you can disconnect the existing Internet connection from the firewall, and connect it with the new Internet connection to a normal switch then have a connection to the firewall from the switch.

Now you can define in your Firewall two Policies, one guides Vlan1 Internet traffic to Connection1, and the other policy guides Vlan2 internet traffic to Connection2.

I still believe that the best way to do your scenario is by using the firewall.

Good Luck !!!