TRAFFIC FLOW ANALYSIS FROM LAN, MX95 TO WAN

[Mazide]

Hello everyone! I hope you’re all doing well,

I have a question regarding Option 6: Two MX, two ISPs (4), and I’d like to clarify the traffic flow in the event of a primary MX failure. Would the traffic be routed through the switch connected to ISP1 or ISP2? Both switches are L3 managed but do not support load balancing—how does this affect traffic distribution? Will both ISPs be utilized simultaneously? I’m particularly interested in understanding how traffic flows from the internal LAN to the Meraki, through the two switches to the ISPs, especially if the primary MX fails. In that scenario, what would the traffic path look like? Would both switches share the load, or would only one be active?

Thank you!

[ww]

Both can be used. If you have configed the load balancing/ flow pref on mx.

You already made the drawing

[Mazide]

I'm currently simulating this setup in Packet Tracer. Right now, all the traffic is going through ISP1, and I'm trying to figure out why the second router won't forward traffic when the first one goes down. I understand it's just Packet Tracer 😞 just using it to get a general idea of the behavior.

Thanks for your explanation. I think PhilipDAth is also explaining the same concept.

[PhilipDAth]

If you have configured ISP1 to be the primary, it will use the top switch.

If you have configured ISP2 to be the primary, it will be the bottom switch.

If you have configured ISP1 and ISP2 to be load balanced, both switches will be used.

[Mazide]

I was aware of the first two options but not the third one (load balancing between ISP1 and ISP2). With the monitoring tool we have both WAN interfaces are added but only one is forwarding traffic. I’ll change that asap.   Thanks Phil!

[GIdenJoe]

Your drawing is incorrect.
The uplink switches are connected to LAN ports instead of WAN ports which is incorrect.
Each MX WAN uplink cannot be split on the MX itself.  So basically for WAN1 you can only have 1 cable coming from the MX to the uplink switch.

So each MX should have 1 line going to the upper switch for ISP 1 and each MX should have 1 line going to the lower switch for ISP 2.

In case of a device failure, VRRP will make the spare take over and the spare will use the same primary ISP as configured in dashboard.

[Mazide]

It might not have been clear, but each different cable color represents a different VLAN. The purple cable running over each MX to the uplink switches is for the management VLAN, which serves a different purpose than forwarding WAN traffic.

[GIdenJoe]

So may I assume, green is ISP 1 and blue is ISP 2?  Each MX can only have 1 WAN cable per WAN, you can't use the LAN ports as WAN ports.

In that case it is quite easy.
If the primary MX goes down, the spare takes over due to missing VRRP messages, and since ISP 1 is still configured as primary WAN, the spare MX will use the diagonal green link towards the upper switch to reach ISP 1.

[Mazide]

Yes, your assumption is correct. However, I’ll be using the WAN interface of the MX devices to connect to the intermediate switches, so VRRP packets will still be sent through the LAN ports. The only difference from a setup where the MX is directly connected to the ISP is that the MX will receive a private IP address from the intermediate switch for internet access. The diagram I attached would have been the ideal solution, but most providers won’t activate two ports for businesses.

 

[GIdenJoe]

That the MX'es receive private IP addresses is very possible.  Many providers only give 1 public IP on the WAN side of their own routers and then NAT to an internal range so your two MX devices can take each an IP from that with a third being the vIP.  And just DMZ host feature on that vIP.

I don't however see why you think the intermediate switches would give an IP to the MX.  The switches usually are L2 in that part and the upstream router is the one providing the IP space for your MX'es.

VRRP always runs on the LAN side of the MX, never on the WAN side at least for routed mode.  The upstream connectivity test is purely done using the uplink monitor (icmp, dns, http).

[Mazide]

The intermediate switch is a Layer 3 C1300. My goal is to assign an IP address to each interface, both on the MX and the intermediate switch. The switch would technically act as the router (forwarding ´ and natting packets) while the MX behind it handles Wi-Fi, security, and other services.

[GIdenJoe]

Only a select few switch can handle NAT and that is then limited to the TCAM space they have.  A C1300 is too limited a switch to do NAT.
I can perfectly understand if you use an upstream router for each ISP and they NAT to a private "WAN" space but then your MX will NAT again to the internal network, unless you place the MX'es as transparent (passthrough).

I think you need to think your design through because it is making less and less sense 😉