1

What i wanna do is that.
If a traffic at F0/1 of R1 comes in for any source but destination 202.100.30.248/29 then the next hop shall be 192.168.1.1 enter image description here

Both R3 and R2 have default static route designated towards R1 router so i'm able to ping 192.168.1.1 from Router R3.

But when i try to ping 200.100.30.252 from R3 i don't get reply infact i want to know that my PBR works and forwards the packets or not.The 200.100.30.252 isn't in the R1 routing table.There is no routing protocol running.

Here is what i configure on R1

    route-map PBR, permit, sequence 10
          Match clauses:
            ip address (access-lists): 104 
          Set clauses:
            ip default next-hop 192.168.1.1

    Extended IP access list 104
        10 permit ip any 202.100.30.248 0.0.0.7 log-input

   interface FastEthernet0/1
   ip address 172.16.1.2 255.255.255.252
   ip policy route-map PBR

R1 configuration

R1#sh running-config 
Building configuration...
Current configuration : 1295 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip icmp rate-limit unreachable
!
!
ip cef
no ip domain lookup
!
ip tcp synwait-time 5
!
interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.252
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 172.16.1.2 255.255.255.252
 ip policy route-map PBR
 duplex auto
 speed auto
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet1/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
ip forward-protocol nd
!
no ip http server
!
!
access-list 104 permit ip any 202.100.30.248 0.0.0.7 log-input
no cdp log mismatch duplex
!
route-map PBR permit 10
 match ip address 104
 set ip default next-hop 192.168.1.1
!
control-plane
!
gatekeeper
 shutdown
!
!         
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
!
end

I analyze Packets from R3 to R1 and it only shows ARP broadcast asking for who is 202.100.30.252 and there is no reply coming back for that ARP.
May be I'm doing a big blunder i'm learning about this please correct me for my mistakes. If you need anything more just ask.

  • Why do you have two F1/0 interfaces in the network diagram? Please post the full running-configuration on R1. – Hung Tran Oct 14 '17 at 10:18
  • @HungTran updated the picture bro – Terminator Oct 14 '17 at 10:22
  • And please post the full running-configuration on R1 – Hung Tran Oct 14 '17 at 10:25
  • @HungTran here is link heypasteit.com/clip/0IIVQA – Terminator Oct 14 '17 at 10:29
2

You wrote

Both R3 and R2 have default static route designated towards R1 router...

And you also wrote:

I analyze Packets from R3 to R1 and it only shows ARP broadcast asking for who is 202.100.30.252 and there is no reply coming back for that ARP.

OK, so why is R3 ARPing for 202.100.30.252? Shouldn't it just send the ICMP packet towards R1? Well, that's because you have this on R3:

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

which is not quite the same thing as:

ip route 0.0.0.0 0.0.0.0 172.16.1.2

You can look up the details but to cut a long story short, the first form depends on Proxy ARP behavior on R1. And here is the thing: R1 does not have an IP route to the ultimate destination (202.100.30.248/29); it only has a PBR rule. As a consequence, R1 remains silent when the ARP request arrives, and therefore R3 does not send the ICMP packet towards R1.

| improve this answer | |
  • Thank you very very much mate .Although the other answer give the running commands but i was insisted on what i was doing wrong.I learned something new today take care and have fun.I will surely look more into the Proxy ARP thing you point out – Terminator Oct 15 '17 at 10:29
  • I was using the default route to interface command rather than latter one. – Terminator Oct 15 '17 at 10:33
  • 1
    @Terminator If you was really insisted on knowing what were wrong, you should be patient, keep our discussion and NOT give up right after you provided me the configuration on other router. You even had not read what I replied after that. That discussion would help to clear out all doubts by trying and asking. My answer was to prove that your R1 configuration (PBR section) was good at first, and provide the config references on other routers. And I think this answer was obviously based on what we discussed there. – Hung Tran Oct 15 '17 at 12:34
2

I am afraid that the interface f1/0 (with IP 200.100.30.252/29) on R2 is NOT really up, causing the issue. Please check it again.

And please use the next-hop IP addresses for all static default routes

The configuration on R1 looks good as I used that to reproduce the following case and I can ping both IPs 200.100.30.251 and 200.100.30.252 from R3.

enter image description here

Configuration on routers:

R1:

R1#
interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.252
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 172.16.1.2 255.255.255.252
 ip policy route-map PBR
 duplex auto
 speed auto
!
access-list 104 permit ip any 202.100.30.248 0.0.0.7 log-input

route-map PBR permit 10
 match ip address 104
 set ip default next-hop 192.168.1.1


R1#show ip route | beg Gateway
Gateway of last resort is not set

     172.16.0.0/30 is subnetted, 1 subnets
C       172.16.1.0 is directly connected, FastEthernet0/1
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.0 is directly connected, FastEthernet0/0
R1#

R3:

interface FastEthernet0/1
 ip address 172.16.1.1 255.255.255.252
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 172.16.1.2

R2:

interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.252
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 202.100.30.252 255.255.255.248
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 192.168.1.2

R4:

interface FastEthernet0/1
 ip address 202.100.30.251 255.255.255.248
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 202.100.30.252

Verification

On R3, pinging to 200.100.30.251 and 200.100.30.252 are successful:

R3#ping 202.100.30.252

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.30.252, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 120/128/148 ms
R3#ping 202.100.30.251

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.30.251, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 96/131/164 ms

On R1, log messages are generated:

R1#
%SEC-6-IPACCESSLOGDP: list 104 permitted icmp 172.16.1.1 (FastEthernet0/1 ) -> 202.100.30.252 (0/0), 10 packets                                                                       
%SEC-6-IPACCESSLOGDP: list 104 permitted icmp 172.16.1.1 (FastEthernet0/1 ) -> 202.100.30.251 (0/0), 20 packets

Updated answer:

  1. When we use (outgoing-) exit-interface for a static route, R3 router "thinks" that it is directly connecting to destination network (here is 0.0.0.0/0 including the IP 200.100.30.252 in 200.100.30.248/29), thus the router sends the ARP request for that destination IP (src: 172.16.1.1 and des: 200.100.30.252) out of that exit-interface after the first ping.

    When the ARP request reaches R1, R1 has no idea about the destination IP 202.100.30.252. Therefore it does not do anything.

    The ARP entry for the destination 202.100.30.252 cannot be created on R3, all ICMP packets failed at encapsulation and are not sent out.

  2. When we use next-hop IP address for a static route, R3 router knows that it has to route traffic to R1's IP address 172.16.1.2 and it needs an ARP entry for this IP address. Therefore the router sends only the ARP request for that next-hop IP (src: 172.16.1.1 and des: 172.16.1.2) out of directly connected interface after the first ping.

    When the ARP request reaches R1, R1 replies because the IP address 172.16.1.2 is on its directly connected interface.

    The ARP entry for next-hop IP address 172.16.1.2 is created on R3, the second and rest of ICMP packets are sent out. These ICMP packets are verifed against PBR on R1.

| improve this answer | |
  • I guess i'm bit unlucky i don't know i now put the same setup still not running.Can you help me out on Teamviewer? – Terminator Oct 14 '17 at 16:18
  • @Terminator Please delete your current project and create a new one like mine. Try with my configuration and let me know it if works for you or not? Can you join the chat room here – Hung Tran Oct 14 '17 at 16:26
  • @Terminator As we discussed, have you tried again with next-hop IP addresses for all static default routes? – Hung Tran Oct 15 '17 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.