ip route not being used on 1812

A

alt.testing 18 years ago

Hi All, I have set up policy routing on a Cisco 1812. However; the ip route functionality, does not seem to working.

I have this setup.

{ INTERNET } | | | | [1] [2] Modems 165.228.170.213, 203.38.223.125 | | | | Wan Ports 165.228.170.214, 203.38.223.126 [ 1812 ] | 203.36.134.33 | | 203.36.134.34 [Linux fw/gateway] | 203.37.109.49 | [DMZ] 203.37.109.48/28

The problem is that, from the DMZ, I can't ping or connect to anything further out than the internal interfaces of either modem - Packets just aren't getting routed back in through the fw/gateway. I can connect and ping the Internet from the fw/gateway.

On the 1812, the ip set up is this:

interface Vlan1 ip address 203.36.134.33 255.255.255.252 no ip route-cache cef ip route-cache policy ip policy route-map managed_traffic_01 ! ! ip route 0.0.0.0 0.0.0.0 203.38.223.125 ip route 0.0.0.0 0.0.0.0 165.228.170.213 2 ip route 203.37.109.48 255.255.255.240 203.36.134.34 permanent

Here is the policy map configuration.

! no ip http server no ip http secure-server ! ip access-list extended NAT permit ip any any ! access-list 103 permit tcp 203.36.134.32 0.0.0.3 any eq smtp access-list 103 permit tcp 203.36.134.32 0.0.0.3 eq www any access-list 103 permit tcp 203.36.134.32 0.0.0.3 eq 81 any access-list 103 permit tcp 203.36.134.32 0.0.0.3 eq 443 any access-list 111 permit ip any 203.37.109.48 0.0.0.15 ! ! ! route-map managed_traffic_01 permit 10 match ip address 103 set ip next-hop 165.228.170.213 ! route-map managed_traffic_01 permit 20 set ip default next-hop 203.38.223.125 ! ! !

I cannot figure why the ip route functionality isn't working, does the route policy have something to do with this?

The ISP has routing entries for both routes into this setup, one normal priority (modem 2), and one low (modem 1).

Vote

T

Trendkill 18 years ago

Your problem is not the 1812, its the modem. It receives a packet from the internal DMZ network, but does not have a route back through the 1812. It probably only points out whichever interface is its gateway. Could be wrong, but I would check the config of the modems if there is one. The 1812 looks good, although the dual static default routes are a bit suspect unless it is for load balancing, but even then, it will have no knowledge if something is down upstream, and if something does drop, you will have impact to the network as the

1812 will continue round robin load balancing.

Vote

M

Merv 18 years ago

from Linux fw/gateway, does a ping with the -I option set to

203.37.109.49 fail ? - it should

Verify with Telstra that they have configured a static route on their side for 203.37.109.48/28 pointing to your 1812 IP address

203.38.223.126

Vote

A

alt.testing 18 years ago

Right idea, wrong route in the 857 (incorrect entry). So, indirectly, you were indeed right, I went back and checked. Thanks.

Further to this; I now am considering advice from a friend. As there is a low and high priority route upstream that routes down to our network, only one link is being used.

Would anyone else recommend that; other than policy map directly to upstream routers, would it be better to map to two subnets, and then use BGP to advertise routes into each of those subnets?

Vote

M

Merv 18 years ago

857 ???

Are the "modems" your equipment or the carrier's ?

If they are your what are both of them exactly ?

Vote

A

alt.testing 18 years ago

As per our contract, we purchased all hardware.

We were provided with the following equipment:

Symmetric DSL connection: * Adtran 234ntu (already configured) * Cisco 1812

Asymmetric DSl connection: * Cisco 857w

The Adtran was configured with a gateway ip address. (The tech did this, and indicated that the unit is remotely configured when he puts it online, and makes a call to Telstra HQ)

Connected to the Adtran modem is the 1812. I configured the first wan port of the 1812, with the associated "customer wan ip" (as they call it).

The Telstra tech did some basic config to set up the dialer on the

857. I configured the internal interface of the 857 to be an ip address of a /30 network. The other useable ip address of that net, I configured on the second wan port of the 1812.

The Cisco 857 has two static routes. One pointing to the network in between the 1812 and the Linux fw/gateway, and the other one points to the network, on the other side of the Linux fw/gateway (DMZ). Both have the entries as next hops to the external interface of the 1812.

*Other than configuring the dialer on the Cisco 857, the rest of the configuration was performed by myself.

Vote

A

alt.testing 18 years ago

I haven't looked at the Adtran unit at all, but more correctly, it's a bridged connection. So the gateway ip address is external.

Vote

ip route not being used on 1812

Join the Discussion

Didn't find your answer?