Design the internet edge for a company that wants two ISPs. What are your options?
Show the answer
Say this first
First I ask what must survive (a circuit, a router, a firewall, a whole ISP) and whether inbound services must stay reachable. The simple option is a default route to each ISP, the primary tracked with IP SLA, and NAT to each ISP's own address: outbound fails over in seconds, but inbound services and existing sessions do not move cleanly. The full option is BGP with your own public ASN and provider-independent space, so the same public prefix is reachable through both ISPs and inbound fails over too.
Go deeper
Options
| Option | Survives | Inbound services | Notes |
|---|---|---|---|
| One router, two ISPs, tracked statics | Circuit or ISP failure | Tied to one ISP's addresses, DNS changes needed | Router is a SPOF |
| Two routers, tracked statics, FHRP or IGP inside | Circuit, ISP or router failure | Same limitation | More resilient, still no inbound failover |
| BGP, own ASN and PI space | All of the above | Same addresses through both ISPs | Needs ASN, a /24 or larger, BGP skills |
The tracked default route on IOS-XE
ip sla 1
icmp-echo 192.0.2.53 source-interface GigabitEthernet0/0/0
frequency 10
ip sla schedule 1 life forever start-time now
!
track 1 ip sla 1 reachability
delay up 60
!
ip route 0.0.0.0 0.0.0.0 198.51.100.1 track 1
ip route 0.0.0.0 0.0.0.0 203.0.113.1 250
ip route 192.0.2.53 255.255.255.255 198.51.100.1- The probe target is beyond the ISP, not just its next hop, so it catches failures inside ISP1.
- The host route keeps the probe on ISP1 even after failover.
delay up 60waits a minute before moving back, so a flapping link does not bounce traffic.
NAT per ISP
ip access-list standard NAT-INSIDE
permit 10.0.0.0 0.255.255.255
route-map NAT-ISP1 permit 10
match ip address NAT-INSIDE
match interface GigabitEthernet0/0/0
route-map NAT-ISP2 permit 10
match ip address NAT-INSIDE
match interface GigabitEthernet0/0/1
ip nat inside source route-map NAT-ISP1 interface GigabitEthernet0/0/0 overload
ip nat inside source route-map NAT-ISP2 interface GigabitEthernet0/0/1 overloadmatch interface picks the translation by exit interface. After failover new sessions leave with the
ISP2 address; existing sessions break because their public source address changes.
Other things to ask for
Physically diverse circuits (different building entries and exchanges), the firewall pair in HA, and where remote access VPN and published services terminate.
They will ask next
How fast does each option fail over?
With IP SLA, roughly the probe interval plus timeout, so seconds to tens of seconds. With BGP and default timers, a failure the router cannot see as link down waits for the 180 second hold time on Cisco, so you lower timers or use BFD if the ISP supports it. Inbound BGP failover also depends on how fast the withdrawal spreads across the internet.
Why not ping the ISP's next hop for the SLA?
The next hop is the first thing that stays up when the ISP has a problem further in. Ping something beyond it, ideally two targets, so you test the path to the internet, not just the cable.
Traps
- Forgetting NAT. Without per-ISP NAT, traffic leaving ISP2 carries ISP1's addresses and the replies never come back.
- Promising inbound failover without BGP and portable address space.