1

I'm trying to test a new B2B VPN that I've configured. I tried to ping to it from a host on my end, which fails. So I ran a traceroute that show the packets dying out at a multi-layer switch right before the firewall/ASA (which I'll call R1). I logged into that switch, and tried to trace the route from there. Then things got strange. I got the destination listed as the next hop, even though it's several hops away, on the other side of the firewall, and the routing table lists the inside interface of the firewall as the next hop for packets to that destination.

R1# traceroute 10.6.115.135

1 10.6.115.135 8 msec 4 msec 4 msec
2 10.6.115.135 4 msec *  0 msec
3  *  4 msec *
4  *  *  *
5  *  *  *
6  *  *  *

Since 10.6.115.135 is not connected to R1, and not listed specifically in the routing table, I have no idea why it's being listed as the next hop, or why I'm getting response times for it at first. I'm guessing it's related to the VPN, but the VPN is configured on the router...shouldn't the next hop still have to be the router interface R1 is connected to? Thanks in advance.

Improve this question

1 Answer 1

Reset to default
1

A traceroute through a tunnel only shows the tunnel endpoints. The packets, including traceroute packet, are encapsulated in outer packets, which don't have the TTL set the same way as the packets carrying the traceroute, and traceroute depends on the TTL for discovering where the router hops are.

The tunnel fools traceroute into thinking the tunnel endpoints are directly connected. This sort of thing can happen with other protocols (e.g. MPLS), too.

Improve this answer
4
  • Thanks for the answer! I had a couple follow up questions in that case... Why can't I ping to the other side, if the tunnel is working? And why does the traceroute continue to run if the packets are getting there and back? Thanks again!
    – user3573647
    Feb 25, 2016 at 21:29
  • You need to edit your question to include the tunnel configurations on both ends if you want help. Even better would be full router configurations of both ends, and a drawing would be helpful, too. You should sanitize the public addresses, but don't make every public address say x.x.x.x, give them different values so that we can tell which address belongs where.
    – Ron Maupin ♦
    Feb 25, 2016 at 22:52
  • I actually had a friend help me figure out the rest, but you were a big help, so thanks again! I didn't realize traceroute couldn't accurately figure out the hop through the tunnel (as in not showing the hop to the ASA interface). Much appreciated.
    – user3573647
    Feb 26, 2016 at 15:40
  • If I answered your question, you should accept the answer. If you have a better answer, post it and accept it. Otherwise, the question will keep popping up forever.
    – Ron Maupin ♦
    Feb 26, 2016 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.