virtual-wire ARP issue

[bsimunko@recro-net.hr]

hi!

i have a topology of 2 cisco routers connected to e1/1 and e1/2 in a virtual-wire deployment. there is only 1 policy on the PA, permitting all traffic, and all VLANs are permitted through the v-wire.

the problem is that when i try to ping from R1 to R2 through the PA, the ping fails, and i do not get the MAC address of the destination interface. it looks like the PA is not passing the ARP requests through the virtual-wire.

looking at the monitor tab, i see absolutely no traffic traversing the box. when i connect the routers directly, the ping and ARP work perfectly. i did a packet capture, but all i got were LOOP packets and a couple of CDPs.

one thing to point out, the routers have subinterfaces (L3), vlan 100 and 200, and in this configuration the things do not work.

when i reconfigured the routers to be in the native vlan 1 (IP addresses directly on the interfaces) then it works.

the box is PA-2020 running 5.0.3

could this be a bug, or is something neccesary to configure additionaly on the PA?

[UhMayYeah · Accepted solution]

"all VLANs are permitted through the v-wire."

Just to confirm, have you configured allowed all the Tags (0-4094) in the Vwire config ?

[bsimunko@recro-net.hr]

i feel like an idiot now... the setting was still at default! i configured now the 0-4094, and everything works fine!

thanks!

[UhMayYeah]

This one is a major  gotcha in Vwire that I know of

[bsimunko@recro-net.hr]

yes, and i'm afraid it's not the first time it happened to me

i think that all vlans should be permitted by default, in the factory config, and if you want to filter anything out - you can use this feature, but in any other case you should not have to think about it