1

enter image description here

I have the following network which splits a site into a Corp/DMz style network as best I can with the limitations of the ASA in packer tracer. Both routers have static routes to the 10.100.0.0 and 172.16.0.0 networks pointing at the corresponding ASA interfaces and a classless route out the network.

Both ASAs have two static routes. One for the inside network it covers and a classless route to its respective router (ASA1 to R1 and ASA2 to R2). From a machine inside the 10.100.0.0 network I can ping the inside R1 interface at 10.50.6.241. From R1 I can ping the router interface at 200.195.100.2.

However, when I try and ping 200.195.100.2 from a machine inside the 10.100.0.0 network (or ASA1) the packet hits ASA1 and is bounced between the inside 10.50.6.249/30 interface on ASA1 and the outside 10.50.6.244/29 interface on ASA2 inside of ASA1 sending it to R1 as defined by its default route.

Configured ASA1 routes:

route inside 10.100.0.0 255.255.0.0 10.50.6.250 1  
route outside 0.0.0.0 0.0.0.0 10.50.6.241 1

ARP output from ASA1

UK-Corp-EP-ASA1#show arp
        outside 10.50.6.241 000A.4146.0501
        outside 10.50.6.242 0030.F2A0.5101
        outside 10.50.6.243 0003.E4BC.38D8
        inside 10.50.6.249 0003.E4BC.38D8
        inside 10.50.6.250 00D0.BA60.B218
        inside 10.100.10.2 00D0.BA60.B218
        inside 10.100.10.3 00D0.BA60.B218
        outside 172.16.30.4 0002.1612.88E8

Could anyone suggest why this might occur?

EDIT:

As an interesting note. After reopening the file and running and tracert from the PC I get the following result:

PC>tracert 200.195.100.2

Tracing route to 200.195.100.2 over a maximum of 30 hops: 

  1   0 ms      0 ms      0 ms      10.100.10.1
  2   0 ms      0 ms      0 ms      10.50.6.249
  3   *         0 ms      1 ms      10.50.6.242
  4   37 ms     1 ms      1 ms      200.195.100.6
  5   *         *         *         Request timed out.
  6   *         *         *         Request timed out.
  7   *         *         *         Request timed out.
  8   *         *         *         Request timed out.
  9   *         *         *         Request timed out.
  10  

As requested:

R1 interfaces (others are shutdown and not in use)

interface FastEthernet0/0
 ip address 10.50.6.241 255.255.255.248
 ip nat inside
 duplex auto
 speed auto
!
interface Serial0/0/0
 ip address 200.195.100.1 255.255.255.252
 ip nat outside
!

R2 Interfaces

interface FastEthernet0/0
 ip address 10.50.6.242 255.255.255.248
 ip nat inside
 duplex auto
 speed auto
!
interface Serial0/0/0
 ip address 200.195.100.5 255.255.255.252
 ip nat outside
!

Switch Config:

R1 - fa0/24
R2 - fa0/23
ASA1 - fa0/1
ASA2 - fa0/2

UK-EP-Distro-SW1#show int trunk
Port        Mode         Encapsulation  Status        Native vlan
Fa0/1       on           802.1q         trunking      80
Fa0/2       on           802.1q         trunking      80
Fa0/23      on           802.1q         trunking      80
Fa0/24      on           802.1q         trunking      80

Port        Vlans allowed on trunk
Fa0/1       6,10,20,30,80,150
Fa0/2       6,10,20,30,80,150
Fa0/23      6,10,20,30,80,150
Fa0/24      6,10,20,30,80,150

Port        Vlans allowed and active in management domain
Fa0/1       6,10,20,30,80,150
Fa0/2       6,10,20,30,80,150
Fa0/23      6,10,20,30,80,150
Fa0/24      6,10,20,30,80,150

Port        Vlans in spanning tree forwarding state and not pruned
Fa0/1       6,10,20,30,80,150
Fa0/2       6,10,20,30,80,150
Fa0/23      6,10,20,30,80,150
Fa0/24      6,10,20,30,80,150

UK-EP-Distro-SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    
5    Default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Fa0/9, Fa0/10
                                                Fa0/11, Fa0/12, Fa0/13, Fa0/14
                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18
                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22
                                                Gig0/1, Gig0/2
6    Routing                          active    
10   UK-Corp-PC                       active    
20   UK-Corp-Server                   active    
30   UK-DMz-Server                    active    
80   Native                           active    
150  VoIP                             active    
1002 fddi-default                     active    
1003 token-ring-default               active    
1004 fddinet-default                  active    
1005 trnet-default                    active   

If I ping 200.195.100.6 from 10.100.0.0 it will get a reply as ASA1 will send the packet out of R2 (again, not it's default route).

I have considered the possibility of it being a bug in PT. Not a lot I can do about that :(

R1 routing table:

Gateway of last resort is 200.195.100.2 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       10.50.6.240/29 is directly connected, FastEthernet0/0
S       10.100.0.0/16 [1/0] via 10.50.6.243
S    172.16.0.0/16 [1/0] via 10.50.6.244
     200.195.100.0/30 is subnetted, 1 subnets
C       200.195.100.0 is directly connected, Serial0/0/0
S*   0.0.0.0/0 [1/0] via 200.195.100.2

Ping from PC 10.100.10.2:

PC>tracert 200.195.100.2

Tracing route to 200.195.100.2 over a maximum of 30 hops: 

  1   1 ms      1 ms      1 ms      10.100.10.1
  2   *         0 ms      0 ms      10.50.6.249
  3   *         *         0 ms      10.50.6.244
  4   *         11 ms     11 ms     10.50.6.249
  5   11 ms     10 ms     10 ms     10.50.6.244
  6   1 ms      12 ms     12 ms     10.50.6.249
  7   25 ms     11 ms     26 ms     10.50.6.244
  8   13 ms     12 ms     12 ms     10.50.6.249
  9   23 ms     22 ms     24 ms     10.50.6.244
  10   19 ms     21 ms     26 ms     10.50.6.249
  11   24 ms     13 ms     12 ms     10.50.6.244
  12   24 ms     24 ms     21 ms     10.50.6.249
  13   34 ms     10 ms     23 ms     10.50.6.244
  14   22 ms     33 ms     43 ms     10.50.6.249

Dropbox link for the file. As an update since this discussion I have changed the interfaces on the switch from trunks to sit on routing vlan 6.

https://www.dropbox.com/sh/kt5x03j1kckf9bw/AABdlTWqvyUNQer-O-t_AAv7a?dl=0

  • Can you post the packet trace and also the output of "show arp" on ASA 1? – Ron Trunk Dec 3 '15 at 13:41
  • Packet tracer ASAs don't have the packet trace command built in. arp result as above following a ping through the ASA from 10.100.10.2/3 and 172.16.30.4 is NTP. – Matthew Williams Dec 3 '15 at 14:52
  • Are you running a routing protocol between the devices? – Ron Maupin Dec 3 '15 at 15:27
  • No. The only routing between these 4 devices is the static routes specified. I have added some additional information following some more testing. – Matthew Williams Dec 3 '15 at 15:41
  • I'm suspicious of proxy arp on R1 and R2. Could you post their interface configurations (the ones facing the ASA)? As well as the Switch output of "show int trunk" "show vlan brief" (and tell us what ports are connected to what devices). Also, it could be a packet-tracer-ism. It tends to bug out every once in a while. – Eddie Dec 3 '15 at 15:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.