1

Okay the issue i'm having at the moment is i've got a server stack connected to a switch. The switch is then connected to a router. That switch/router combo has been used and tested numerous times.

Now this router connects to another router via a BGP peer which then connects into the wider area network, sharing 200 or so BGP routes.

So R1 which is connected to my server stack can ping all the way through the network to any address it wishes to.

However the server stack behind it cannot ping out. It can ping the local router interface, and the router interface connecting R1 to R2...but heres the strange part, it cannot ping the connection on R2. So to clarify it can ping 25.231.34.106 which is R1 g0/0 but cannot ping 25.231.34.105 which is R2 g0/0.

It also cannot ping further into the WAN. This is really throwing me at the moment and i'm convinced the config is correct. Below is some excerpts.

router bgp 65001  
 network 25.141.156.0 mask 255.255.252.0  
 neighbor 25.231.34.105 remote-as 65677  
 neighbor 25.231.34.105 filter-list 150 out

as-path access-list permit ^$

ip route 0.0.0.0 0.0.0.0 25.231.34.105  
ip route 25.141.156.0 255.255.252.0 25.141.156.6 - Note .6 is the switch vlan.

To clarify, R1 has a full BGP routing table so connectivity from R1 to R2 is fine, it's just allowing my server stack and clients out through R1 that's the issue! I've used this config before and it has worked so i'm struggling to see what's causing this problem.

Any advice or guidance?

    Current configuration : 15583 bytes

version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone
service password-encryption
no service password-recovery
!
hostname Router1
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
!
!
!
!
!
aaa session-id common
clock timezone GMT 0 0
!
no ipv6 cef
no ip source-route
no ip gratuitous-arps
ip cef
!
!
!
!
!
no ip bootp server
no ip domain lookup
ip domain name example.net
multilink bundle-name authenticated
!
!
!
!
ip ssh version 2
ip scp server enable
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 duplex full
 speed 100
 no mop enabled
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 8.2.156.1 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 8.2.156.98 255.255.255.192
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface GigabitEthernet0/0.70
 encapsulation dot1Q 70
 ip address 8.2.156.9 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface GigabitEthernet0/0.80
 encapsulation dot1Q 80
 ip address 8.2.156.22 255.255.255.248 secondary
 ip address 8.2.156.18 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface GigabitEthernet0/0.210
 encapsulation dot1Q 210
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface GigabitEthernet0/0.301
 encapsulation dot1Q 301
 ip address 8.2.157.129 255.255.255.240
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface GigabitEthernet0/1
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1400
 ip tcp adjust-mss 1360
 duplex auto
 speed auto
 no mop enabled
!
interface GigabitEthernet0/0/0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 duplex auto
 speed auto
 no mop enabled
!
interface GigabitEthernet0/1/0
 ip address 77.5.34.106 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip tcp adjust-mss 1300
 duplex full
 speed 100
 media-type sfp
 no cdp enable
 no mop enabled
!
interface GigabitEthernet0/1/0
 ip address 77.5.34.106 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip tcp adjust-mss 1300
 duplex full
 speed 100
 media-type sfp
 no cdp enable
 no mop enabled
!
router bgp 64729
 bgp log-neighbor-changes
 network 8.2.156.0 mask 255.255.252.0
 neighbor 77.5.34.105 remote-as 64613
 neighbor 77.5.34.105 filter-list 150 out
!
ip forward-protocol nd
!
ip as-path access-list 150 permit ^$
no ip http server
ip http access-class 80
ip http authentication aaa
ip http secure-server
ip http secure-port 8443
!
ip route 0.0.0.0 0.0.0.0 77.5.34.105
ip route 8.2.156.0 255.255.252.0 8.2.156.6
ip tacacs source-interface GigabitEthernet0/0.20
!

access-list 8 permit 8.2.157.9
access-list 8 permit 8.2.157.10
access-list 8 permit 25.146.194.24
access-list 8 permit 8.2.157.128 0.0.0.15
access-list 8 deny   any log
access-list 80 permit 8.2.157.9
access-list 80 permit 8.2.157.10
access-list 80 permit 8.2.157.25
access-list 80 permit 8.2.156.130
access-list 80 permit 25.144.90.13
access-list 80 permit 25.144.90.12
access-list 80 permit 25.144.90.51
access-list 80 permit 25.144.90.50
access-list 80 permit 25.144.85.32 0.0.0.31
access-list 80 permit 25.144.101.32 0.0.0.31
access-list 80 permit 25.144.92.32 0.0.0.31
access-list 80 permit 25.149.202.128 0.0.0.127
access-list 80 permit 25.144.108.32 0.0.0.31
access-list 80 permit 25.149.181.128 0.0.0.127
access-list 80 deny   any log
access-list 110 permit tcp host 8.2.157.9 any eq 22
access-list 110 permit tcp host 8.2.157.10 any eq 22
access-list 110 permit tcp host 8.2.157.25 any eq 22
access-list 110 permit tcp host 8.2.156.130 any eq 22
access-list 110 permit tcp 8.2.157.128 0.0.0.15 any eq 22
access-list 110 permit tcp host 25.146.194.24 any eq 22
access-list 110 permit tcp 25.144.85.32 0.0.0.31 any eq 22
access-list 110 permit tcp 25.144.101.32 0.0.0.31 any eq 22
access-list 110 permit tcp 25.144.92.32 0.0.0.31 any eq 22
access-list 110 permit tcp 25.149.202.128 0.0.0.127 any eq 22
access-list 110 permit tcp 25.144.108.32 0.0.0.31 any eq 22
access-list 110 permit tcp 25.149.181.128 0.0.0.127 any eq 22
access-list 110 permit tcp host 25.144.90.12 any eq 22
access-list 110 permit tcp host 25.144.90.13 any eq 22
access-list 110 permit tcp host 25.144.90.50 any eq 22
access-list 110 permit tcp host 25.144.90.51 any eq 22
access-list 110 deny   ip any any log

BGP Fault

  • 1
    You really need to provide a better description of how things are connected (a diagram is best), and the full, sanitized configurations of the network devices. Without those, we are merely speculating and guessing, and that is off-topic here. – Ron Maupin Nov 8 '16 at 19:02
  • Unfortunately I can't provide the full configs at the moment. I work in a secure area and have no way to export them unfortunately. I will make a diagram though, one moment. – Kevin Robertson Nov 8 '16 at 19:15
  • You don't need to export them. Just copy them from the terminal application, paste them into a text editor, and change the public addresses and passwords, then paste them into the question, and use the Preformatted Text button ({}) on them. – Ron Maupin Nov 8 '16 at 19:20
  • Yeah I get that but the system on which the configs are located is completely isolated, not attached to the internet and the only devices allowed on it are those purely for that network. No internet access or USB or anything allowed. I've attached a diagram for better understanding, I hope. – Kevin Robertson Nov 8 '16 at 19:27
  • Unfortunately, we aren't going to be able to help without the rest of the configurations, For instance, filter-list 150 out may block sending the 25.141.156.0/22 route to R1, so R1 has no way to send return traffic for the ping back to the server network. There are a lot of possibilities, but we simply cannot tell what is actually wrong. – Ron Maupin Nov 8 '16 at 19:35
2

You have some real problems, and it seems to stem from a misunderstanding of how BGP works. Putting a network statement in BGP doesn't guarantee that the prefix will be advertised to neighbors. The exact network must exist in the local routing table before BGP will advertise it. It looks like you are trying to advertise an aggregate address without doing it correctly. If you use the aggregate address command, only one of the networks encompassed by the aggregate address need exist in the routing table.

You have a layer-2 connection to SW1, so you cannot simply point a route to the management address of SW1 for networks which are not on the same network as SW1. SW1 would need to be a layer-3 switch, and then you would only have a single routed link between R1 ans SW1. You would also need to either have a static default route on SW1 or run a routing protocol between them.

You should not be using static routes for any directly connected networks. That can confuse the router. Also, you cannot have the next hop for a network to be on the network for which you are establishing the route. That doesn't work, and it doesn't make any sense. You should remove the static route:

no ip route 25.141.156.0 255.255.252.0 25.141.156.6

You have multiple network interfaces toward SW1 as VLANs. Those routes will exist in your local routing table.

interface FastEthernet0/1
 ip address 25.141.156.1 255.255.255.224
 duplex auto
 speed auto
!
interface FastEthernet0/1.10
 encapsulation dot1Q 10
 ip address 25.141.156.98 255.255.255.224
!
interface FastEthernet0/1.20
 encapsulation dot1Q 20
 ip address 25.141.157.1 255.255.255.240
!
interface FastEthernet0/1.30
 encapsulation dot1Q 30
 ip address 25.141.157.140 255.255.255.192
!

You could have separate network statements in your BGP router configuration:

router bgp 65001
 no synchronization
 bgp log-neighbor-changes
 network 25.141.156.0 mask 255.255.255.224
 network 25.141.156.96 mask 255.255.252.224
 network 25.141.157.0 mask 255.255.252.240
 network 25.141.157.128 mask 255.255.252.192
 neighbor 25.231.34.105 remote-as 65002
 neighbor 25.231.34.105 filter-list 150 out
 no auto-summary
!

You could use the redistribute connected statement in your BGP router configuration:

router bgp 65001
 no synchronization
 bgp log-neighbor-changes
 redistribute connected
 neighbor 25.231.34.105 remote-as 65002
 neighbor 25.231.34.105 filter-list 150 out
 no auto-summary
!

If you are bound and determined to only have one network statement, then you need to use the aggregate-address command:

router bgp 65001
 no synchronization
 bgp log-neighbor-changes
 aggregate-address 25.141.156.0 255.255.252.0
 neighbor 25.231.34.105 remote-as 65002
 neighbor 25.231.34.105 filter-list 150 out
 no auto-summary
!

If you want it to only advertise the single prefix, then use the summary-only option:

router bgp 65001
 no synchronization
 bgp log-neighbor-changes
 aggregate-address 25.141.156.0 255.255.252.0 summary-only
 neighbor 25.231.34.105 remote-as 65002
 neighbor 25.231.34.105 filter-list 150 out
 no auto-summary
!

You really need access to R2 to see what the routing table is as you make these changes. As it stands, I don't believe that R2 has routes back to the networks on the other side of R1, so your pings from those networks should fail to R2.

  • Tomorrow I will try the seperate network statements in your BGP configuration, see if that makes an issue. The thing is, this exact setup works in GNS3 correctly but not for real and the configs are a copy and paste from previous use. It has worked in the past so i'm extremely confused as to what's changed. – Kevin Robertson Nov 9 '16 at 0:22
  • I attempted all 3 methods you highlighted and none of them had any effect. I believe it is R2 and am actively trying to engage with the team that manages it. However I've uploaded the full R1 config now (note IP address changes etc for sanitation purposes and removal of descriptions/ACL's etc) Please can you have a look at it and say if anything is glaringly obviously wrong? Thanks – Kevin Robertson Nov 9 '16 at 13:04
  • Yes. You are again trying to do an aggregate address incorrectly: ` network 8.2.156.0 mask 255.255.252.0. You should use the aggregate-address 8.2.156.0 255.255.252.0 command instead. See the Cisco documentation on the command. – Ron Maupin Nov 9 '16 at 15:21
  • @KevinRobertson, You should never do this: ip route 8.2.156.0 255.255.252.0 8.2.156.6, it doesn't actually do anything. The more specific, directly-connected routes are used, and you can't have the next hop on that same network. – Ron Maupin Nov 9 '16 at 15:21
  • @KevinRobertson, I don't see the filter list ACL.If it doesn't exist, you may be filtering all the routes with that command. – Ron Maupin Nov 9 '16 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.