Routing problem

cancel
Showing results for 
Search instead for 
Did you mean: 

Routing problem

L1 Bithead

I am configuring a new AP-850. MGT port works fine and I can access the Internet. Now, I configure ethernet1/1 to access the Internet. 

pa-5.JPG

I also configure the routing. But can't ping 8.8.8.8. Do I miss something or how do I troubleshoot it?

pa-6.JPG

 

 

 

 

Bob Lin, Chicagotech-MVP, MCSE & CNE
Data recovery, Windows OS Recovery, Networking, and Computer Troubleshooting on
http://www.ChicagoTech.net
How to Install and Configure Windows, VMware, Virtualization and Cisco on
http://www.HowToNetworking.com
1 ACCEPTED SOLUTION

Accepted Solutions

L6 Presenter

Hi @boblin ,

 

First of all, please check if you have proper security policy on the firewall to allow traffic to internet from interface IP address. Also check if it is getting match as expected. You can verify it under traffic logs.

 

Now you have pointed default route towards 192.168.11.1 so is it the IP address of router where your internet link is terminated ? If it is the case, do you have source NAT configured  on the router? If firewall is passing traffic properly, please check if NAT is working.

 

In most of the cases when internet link is terminated on the firewall itself then default route is pointed towards ISP gateway to route traffic towards internet. And the NAT policy is configured on the firewall itself.

Mayur S.

View solution in original post

7 REPLIES 7

L6 Presenter

Hi @boblin ,

 

First of all, please check if you have proper security policy on the firewall to allow traffic to internet from interface IP address. Also check if it is getting match as expected. You can verify it under traffic logs.

 

Now you have pointed default route towards 192.168.11.1 so is it the IP address of router where your internet link is terminated ? If it is the case, do you have source NAT configured  on the router? If firewall is passing traffic properly, please check if NAT is working.

 

In most of the cases when internet link is terminated on the firewall itself then default route is pointed towards ISP gateway to route traffic towards internet. And the NAT policy is configured on the firewall itself.

Mayur S.

View solution in original post

L7 Applicator

are you testing from the CLI? see if this one works:

ping source 192.168.11.12 host 192.168.11.1

if that works, do the following

traceroute source 192.168.11.12 host 1.1.1.1

meanwile keep an eye on your sessions from a second CLI to make sure your sessions are being allowed

show session all filter source 192.168.11.12

 

if you see them in DISCARD, your security policy is blocking, if they're in ACTIVE you may have an upstream issue, check your cabling etc

Tom Piens
Like my answer? check out my book! https://bit.ly/MasteringPAN

Hi Mayur,

 

Thank you for the tips. 

 

Forgot to mention, if I test using ping source 192.168.11.12 (e1/1) host 8.8.8.8, it works. 

pa-7.JPG

If I unplug the MGT cable, ping doesn't work. It seems to me the traffic goes through MGT port. I think it could be the NAT settings, but can't figure it out. 

 

boblin_0-1609958570678.png

 

 

 

Bob Lin, Chicagotech-MVP, MCSE & CNE
Data recovery, Windows OS Recovery, Networking, and Computer Troubleshooting on
http://www.ChicagoTech.net
How to Install and Configure Windows, VMware, Virtualization and Cisco on
http://www.HowToNetworking.com

Forgot to mention, ping and traceroute works fine if I have MGT cable connecting. If I unplug the MGT cable, ping or traceroute doesn't work. show session all filter source 192.168.11.12 gets "No Active session". Any suggestions? 

Bob Lin, Chicagotech-MVP, MCSE & CNE
Data recovery, Windows OS Recovery, Networking, and Computer Troubleshooting on
http://www.ChicagoTech.net
How to Install and Configure Windows, VMware, Virtualization and Cisco on
http://www.HowToNetworking.com

Did you apply the 'source'?

 

The management interface is completely different from the dataplane interfaces. If you do not add the 'source' the packet originates from the management interface which does not use the virtual router

Tom Piens
Like my answer? check out my book! https://bit.ly/MasteringPAN

How do you apply the source? When I ping, I do add source 192.168.11.12 which is e1/1 port.

 

pa-7.JPG

 

Bob Lin, Chicagotech-MVP, MCSE & CNE
Data recovery, Windows OS Recovery, Networking, and Computer Troubleshooting on
http://www.ChicagoTech.net
How to Install and Configure Windows, VMware, Virtualization and Cisco on
http://www.HowToNetworking.com

Hi @boblin ,

 

As @reaper said, MGMT & dataplane interfaces are completely different so if MGMT is down/removed, it should not create issue to dataplane interface traffic. To get more clarity about your network, is it possible for you to share topology diagram here?

Mayur S.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!