Geekly Articles each Day
📜 ⬆️ ⬇️

One customer, two premises, four providers and eight connections

One of the customers asked that the connection between his office and the warehouse be permanent and secure. How we did it and what happened and what did not.

Conditions


The customer has two premises. Office and warehouse. There are Microtik-i and two providers in the office and in the warehouse. Warehouse staff use IP-telephony and office resources through a secure tunnel.

Task

It is necessary to organize communication in such a way that the failure of one provider (from either side) does not lead to the fact that Office users will remain without Internet access, and remote Warehouse users without internal Office resources.

Decision

First, let's draw a diagram and try to determine what needs to be done. We assume that the main channels go through the providers OfficeISP1 and SkladISP1, and the backup channels go through OfficeISP2 and SkladISP2. In the picture they are shown in a thick line.
')
image

Let's make the list of the parameters describing our configuration:

Subsequently, you can make such a list for yourself and then, using a replacement, get the configuration you need.

We divide the problem into two

  1. Failsafe Internet access through two providers.
  2. Organization of VPN-channels for communication between the Office and the Warehouse.

Failover of Internet access

The first task, at first, I tried to solve with a script that runs every 3 minutes and checks with the help of ping any of the hosts on the Internet (the survivability of which is beyond doubt). However, when testing this technology all the time failed. Why - it is not clear. Then I used a simple and, as it turned out, more efficient technique: organization of a backup communication channel without scripts . It turned out even better. When the main channel is unavailable, the transition to the backup channel almost instantly occurs.

VPN connections

For the organization of VPN connections, it was decided to use the IPSec protocol and IPIP tunnels. We make the plates for the tunnels. On each side, you will have to describe 4 IPIP tunnels in order to describe all possible combinations of connections.

For Office Router

For Warehouse Router


For both routers for all IPIP tunnels


Create addresses for each of the tunnels in order to organize the routing between the Office and the Warehouse:


Create routes. Note how the distance values ​​should be distributed among the routes:
For office


For warehouse


We give the highest priority to routes through the main providers, the lowest - through backup ones. Intermediate options (in principle) are the same, but in this case we give greater priority to the channel of the main provider from the Office. I pointed out the latest octets for tunnel IP addresses for easier understanding:

image

What happened

During normal operation of all providers, the main channels for IPSec VPN connections are used. If one of the channels fails, the routing for the users-Internet connection is rebuilt and the corresponding IPSec VPN channel is automatically used. Thus, even with the simultaneous shutdown of one provider on each side, the system will work.

What did not work

Do not reconfigure the phone connection with the provider of IP-telephony. As a result, when switching to the backup channel, the external address for the telephone exchange does not automatically re-register, but this has been left for the near future. Restrictions are imposed by the telephone exchange itself.

"Tips and Tricks"

To work with two providers at once, do not forget to make the same rules for the NAT (for the Office and the Warehouse - the same):

/ ip firewall nat
add action = masquerade chain = srcnat out-interface = bridge-isp1
add action = masquerade chain = srcnat out-interface = bridge-isp2

In order for the packets to go between the Office and the Warehouse without any problems, cancel the NAT between them by adding to the top of the table the rule for the Office:

/ ip firewall nat
add chain = srcnat dst-address = 192.168.1.0 / 24 src-address = 192.168.2.0 / 24

And for the warehouse:

/ ip firewall nat
add chain = srcnat dst-address = 192.168.2.0 / 24 src-address = 192.168.1.0 / 24

And in order that remote desktop users who work on the road or from home can always (with any active provider) use office resources, you can use DynDNS technology. This will allow when switching to a backup provider not to remember the external IP address of the backup channel.

Source: https://habr.com/ru/post/266527/

More articles:


All Articles