Routing problem

[boblin]

I am configuring a new AP-850. MGT port works fine and I can access the Internet. Now, I configure ethernet1/1 to access the Internet. 

I also configure the routing. But can't ping 8.8.8.8. Do I miss something or how do I troubleshoot it?

[SutareMayur · Accepted solution]

Hi @boblin ,

First of all, please check if you have proper security policy on the firewall to allow traffic to internet from interface IP address. Also check if it is getting match as expected. You can verify it under traffic logs.

Now you have pointed default route towards 192.168.11.1 so is it the IP address of router where your internet link is terminated ? If it is the case, do you have source NAT configured  on the router? If firewall is passing traffic properly, please check if NAT is working.

In most of the cases when internet link is terminated on the firewall itself then default route is pointed towards ISP gateway to route traffic towards internet. And the NAT policy is configured on the firewall itself.

[reaper]

are you testing from the CLI? see if this one works:

ping source 192.168.11.12 host 192.168.11.1

if that works, do the following

traceroute source 192.168.11.12 host 1.1.1.1

meanwile keep an eye on your sessions from a second CLI to make sure your sessions are being allowed

show session all filter source 192.168.11.12

if you see them in DISCARD, your security policy is blocking, if they're in ACTIVE you may have an upstream issue, check your cabling etc

[boblin]

Hi Mayur,

Thank you for the tips. 

Forgot to mention, if I test using ping source 192.168.11.12 (e1/1) host 8.8.8.8, it works. 

If I unplug the MGT cable, ping doesn't work. It seems to me the traffic goes through MGT port. I think it could be the NAT settings, but can't figure it out. 

[boblin]

Forgot to mention, ping and traceroute works fine if I have MGT cable connecting. If I unplug the MGT cable, ping or traceroute doesn't work. show session all filter source 192.168.11.12 gets "No Active session". Any suggestions? 

[reaper]

Did you apply the 'source'?

The management interface is completely different from the dataplane interfaces. If you do not add the 'source' the packet originates from the management interface which does not use the virtual router

[boblin]

How do you apply the source? When I ping, I do add source 192.168.11.12 which is e1/1 port.

[SutareMayur]

Hi @boblin ,

As @reaper said, MGMT & dataplane interfaces are completely different so if MGMT is down/removed, it should not create issue to dataplane interface traffic. To get more clarity about your network, is it possible for you to share topology diagram here?