2600 with Two T1 - Different ISP

[grundy]

We have a 2600 with Two T1's from different ISPS. This setup worked fine until 2 days ago.

Goal: The client will route out to the correct network depending on their assigned static IPS. 12.X.X.X will go out the ATT network and 207.x.x.x will go out the Bullseye network.

Each client has static ips assigned (no nat) Right now anyone using the 12.x.x.x addresses can't make it to the dns server becuase the traffic leaves the wrong T1 and comes back with a destination unavailable. See config below.

boot-end-marker
!
!
no network-clock-participate slot 1
no network-clock-participate wic 0
no aaa new-model
no ip subnet-zero
no ip cef
ip telnet source-interface FastEthernet0/1
!
!
no ip dhcp conflict logging
!
no ip domain lookup
no ftp-server write-enable
!
!
interface FastEthernet0/0
ip address 207.148.203.81
shutdown
duplex auto
speed auto
no mop enabled
!
interface Serial0/0
ip address 12.124.119.42 255.255.255.252
encapsulation ppp
shutdown
no fair-queue
service-module t1 timeslots 1-24
!
interface FastEthernet0/1
ip address 12.181.230.161 255.255.255.224
shutdown
duplex auto
speed auto
!
interface Serial0/1
ip address 207.148.194.27 255.255.255.0
encapsulation ppp
shutdown
no fair-queue
service-module t1 timeslots 1-24
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/1
ip route 0.0.0.0 0.0.0.0 Serial0/0 5
ip route 135.89.152.48 255.255.255.240 12.124.119.41
ip route 135.89.154.144 255.255.255.240 12.124.119.41
no ip http server

 

[brianinms]

Any reason why your interfaces are shutdown?

 

[grundy]

Sorry about that. That was taken when I was doing a password recovery. The interfaces are not shutdown.

 

[brianinms]

Essentially with these two routes.

ip route 0.0.0.0 0.0.0.0 Serial0/1
ip route 0.0.0.0 0.0.0.0 Serial0/0 5

All traffic will go out s0/1.

You need to use route maps to force the traffic out the proper interface.

 

[grundy]

What if they have the same cost?

 

[grundy]

That config worked for the last few years up until two days ago. I don't know if someone got into the router and/or made changes.

Both FE0/0 and FE0/1 are plugged into the same switch.

Is route maps the only way to accomplish this?

 

[brianinms]

Route maps are the easiest. However this is the most insecure configuration I have seen in a while.

 

[jneiberger]

Yeah, that is pretty insecure. I shouldn't be able to Telnet into your router.

1. Never post real IP addresses to an Internet forum

2. Always block incoming Telnet, ICMP, SSH, SNMP, etc. There's no reason for someone in the outside world to access your router like that, so you should always block it or you leave yourself open to all sorts of nasty tricks.

 

[burtsbees]

Myself, I VPN into mine for management, and from the workstation, ssh in---transport input ssh on the vty lines ONLY, and I block ssh and telnet at the outside int.

Burt

 

[grundy]

Any help on configuring route maps would be greatly appreciated..