topic Routing problem in General Topics

Routing problem

boblin — Wed, 06 Jan 2021 01:05:06 GMT

I am configuring a new AP-850. MGT port works fine and I can access the Internet. Now, I configure ethernet1/1 to access the Internet.

I also configure the routing. But can't ping 8.8.8.8. Do I miss something or how do I troubleshoot it?

Re: Routing problem

SutareMayur — Wed, 06 Jan 2021 08:21:56 GMT

Hi @boblin ,

First of all, please check if you have proper security policy on the firewall to allow traffic to internet from interface IP address. Also check if it is getting match as expected. You can verify it under traffic logs.

Now you have pointed default route towards 192.168.11.1 so is it the IP address of router where your internet link is terminated ? If it is the case, do you have source NAT configured on the router? If firewall is passing traffic properly, please check if NAT is working.

In most of the cases when internet link is terminated on the firewall itself then default route is pointed towards ISP gateway to route traffic towards internet. And the NAT policy is configured on the firewall itself.

Re: Routing problem

reaper — Wed, 06 Jan 2021 12:31:10 GMT

are you testing from the CLI? see if this one works:

ping source 192.168.11.12 host 192.168.11.1

if that works, do the following

traceroute source 192.168.11.12 host 1.1.1.1

meanwile keep an eye on your sessions from a second CLI to make sure your sessions are being allowed

show session all filter source 192.168.11.12

if you see them in DISCARD, your security policy is blocking, if they're in ACTIVE you may have an upstream issue, check your cabling etc

Re: Routing problem

boblin — Wed, 06 Jan 2021 18:43:12 GMT

Hi Mayur,

Thank you for the tips.

Forgot to mention, if I test using ping source 192.168.11.12 (e1/1) host 8.8.8.8, it works.

If I unplug the MGT cable, ping doesn't work. It seems to me the traffic goes through MGT port. I think it could be the NAT settings, but can't figure it out.

Re: Routing problem

boblin — Wed, 06 Jan 2021 18:51:51 GMT

Forgot to mention, ping and traceroute works fine if I have MGT cable connecting. If I unplug the MGT cable, ping or traceroute doesn't work. show session all filter source 192.168.11.12 gets "No Active session". Any suggestions?

Re: Routing problem

reaper — Wed, 06 Jan 2021 18:57:29 GMT

Did you apply the 'source'?

The management interface is completely different from the dataplane interfaces. If you do not add the 'source' the packet originates from the management interface which does not use the virtual router

Re: Routing problem

boblin — Wed, 06 Jan 2021 19:25:49 GMT

How do you apply the source? When I ping, I do add source 192.168.11.12 which is e1/1 port.

Re: Routing problem

SutareMayur — Thu, 07 Jan 2021 06:03:34 GMT

Hi @boblin ,

As @reaper said, MGMT & dataplane interfaces are completely different so if MGMT is down/removed, it should not create issue to dataplane interface traffic. To get more clarity about your network, is it possible for you to share topology diagram here?