Internet failover strategy while hosting services with a staticip

Question

Given you have two networks with statics ips:

network A.) 66.xxx.xxx.9 (to reach this network DNS entry is myservice.mydomain.com)

and

network B.) 66.xxx.xxx.29 ((to reach this network DNS entry is myservice.backupmydomain.com))

The first network you typically use and the second network is a back up network.

You have a service hosted on a computer in the network.

When network A goes down, the router will switch to network B. But you still need some way to forward requests from the outside world from A to B. Otherwise a client outside the network will knock on the door and find that A is down.

How do you automatically forward to network B when network A is down if you're sending packets on the outside? Basically, I'd like to do two things when network A is down. 1.) Switch to network B. 2.) tell all packets going to network A to go to network B instead.

Answer 1

There are a few workarounds, but none of them are automatic/seamless. The easiest is to change the DNS entry when one of the networks is down. Some DNS providers offer "health checks" that can automate this for you, but there will still be downtime while the new DNS records propagate.

If you go this route, keep the TTL on your DNS entries as short as reasonably possible.

Another alternative would be to use a load balancer in the cloud. DNS would point here, and the load balancers would send traffic to the appropriate servers dynamically as they went down/up. The LB is the new single point of failure, but if designed properly, this can work pretty well.

Answer 2

On the inside of your network, for outbound traffic, you could run a FHRP* between your two routers. This will require you to reip device(s), as hosts will have a new default gateway. You would create or reuse a VIP [virtual ip] and assign that to the inside of both routers.

However, the protocols will, either by configuration or default settings, automatically forward traffic based on a configurable 'criteria'. Generally you're tracking connectivity to a layer 3 address (like your WAN default gateway), you'd want to consult the documentation and feature set of your routers.

The general idea is, when your FHRP, of choice, detects the internet down, it allows your 'standby' router (or active if this is needed) to begin responding to the virtual MAC ARP requests and it begins forwarding traffic with the same VIP shared by the primary router as its source. Again, protocol dependent, but some can use 'preempt' which will overthrow and revert back to the primary network once the fail condition is corrected. Some give more granular settings that can really fine tune to most specs.

Additionally, based on your traffic patterns and flow, you could load share, or session balance, between both circuits for outbound traffic. This has the benefit of ~100% outbound across two circuits (~50/~50 share) - instead of 100% across a single circuit. This is asymmetric routing, and sometimes isn't desired. It all really depends on your objectives and layout. An example of this is packets going outbound from your backup circuit, received by the client, but the replies go to your primary DNS. Out one router, in another. This could be a problem, or it could be the solution to the problem.

This doesn't take care of your secondary requirement for DNS, but it does provide the internal redundancy.

• First Hop Redundancy Protocol (VRRP/GLBP/HSRP/CARP/NSRP etc.)