session timeouts (using reliable static routing)

[tangerine0072000]

Hi all, need a little help !

I have configured 'reliable static routing' to route between two different ISP'S and internet connections. This gives the user some resillience when connecting to a remote server (AS400).

Please see this diagram…

http://82.68.231.26

The problem I have is when a user has a session open on the remote server (AS400) using telnet or IBM’S client software, the sessions drop during a failover to the secondary link and they have to re-connect.

‘Reliable Static Routing’ is configured on both routers in the diagram which track (poll) each others ‘f0’ interfaces. If the routers cannot see each other, they instantly point their default-gateway’s at the secondary firewall each end.

Failover appears to take 3-4 seconds and tunnels on both primary and secondary firewalls are contstantly active.

I’m trying to find out why the user sessions are dropping during failover and what ‘config’ I could possibly put in place on each cisco router to help prevent sessions dropping.

One of my routers configs…….

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption

hostname Router1

boot-start-marker
boot-end-marker

enable secret 5 $1$oFUs$iYjOCMovibIiq5ND9PllY/
enable password cisco

no aaa new-model

resource policy

mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180

ip cef
no ip domain lookup
ip sla monitor 1
type echo protocol ipIcmpEcho 192.168.43.2 source-ipaddr 192.168.99.66
timeout 1000
threshold 2
frequency 3
ip sla monitor schedule 1 life forever start-time now

track 123 rtr 1 reachability

interface Ethernet0
ip address 192.168.99.66 255.255.255.0
half-duplex

interface Ethernet1
ip address 192.168.243.2 255.255.255.252
half-duplex

interface FastEthernet0
ip address 192.168.222.2 255.255.255.0
speed auto
full-duplex

ip local policy route-map MY_LOCAL_POLICY
ip route 0.0.0.0 0.0.0.0 192.168.99.1 track 123
ip route 0.0.0.0 0.0.0.0 192.168.243.1 254
no ip http server

access-list 101 permit icmp any host 192.168.43.2

route-map MY_LOCAL_POLICY permit 10
match ip address 101
set interface Null0
set ip next-hop 192.168.99.1

control-plane

line con 0
line aux 0
line vty 0 4
password cisco
login

end

 

[JOAMON]

Probably has to do with NAT/PAT when you switch to the other ISP your NAT/PAT changes for the new connection and thus drops the session. Is the same true when after it fails and then the primary recovers the sessions drop again?

 

[tangerine0072000]

The remote server is connected to via VPN, so there isn't any NAT/PAT going on ! but sessions do fail when switching back to the primary link also.

 

[JOAMON]

Your session drops because the VPN was established using a specific ip routeable address. When the route changes you are using a different ip routeable address and must re-establish the VPN with that new address. It then will fail again when it switches back for the same reason.