1

EDITED: ADDED FULL ROUTER CONFIG I have a cisco 2921. It uses EIGRP to learn its routing table and has no static default routes set up. I would like to keep it that way. The default route (learned from EIGRP) is another device on my network across a Metro ENS link. When this particular router receives traffic from host 192.168.2.5 I want it to be given a default route out this routers ISP connection (3.3.3.1). It is not working, does anyone know why this route map does not work?

The traffic from my host arrives at Interface GigabitEthernet0/1. I want it to go out Interface GigabitEthernet0/0 using the ISP ( the IP in the route-map is the default gateway my ISP has provided). Interface gi0/0 also has a vpn tunnel configured to my main site, its more of a backup link but I do not see this as being a problem (or is it?).

I have verified that the access list on interface gig0/0 is not blocking any traffic for this host.

I ran debug ip policy and debug ip packet and nothing comes up. This tells me that whenever I try to access this device from the internet it is not hitting interface gi0/1 at all. I can see the traffic hitting gig0/0, but never gig0/1.

Perhaps I have a NAT issue? 

version 15.5
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname name
!
boot-start-marker
boot system flash0:c2900-universalk9-mz.SPA.155-3.M7.bin
boot-end-marker
!
!
card type t1 0 0
logging buffered 58192
enable secret 
enable password 
!
aaa new-model
!
!
aaa authentication 
!
!
!
!
!
!
aaa session-id common
ethernet lmi ce
process cpu threshold type total rising 75 interval 5
process cpu statistics limit entry-percentage 100 size 50000
clock timezone EST -5 0
clock summer-time EDT recurring
no network-clock-participate wic 0 
!
!
!
!         
!
!
no ip source-route
ip options drop
!
!
!
!
!
!
ip dhcp snooping vlan 1
ip dhcp snooping
ip flow-cache timeout active 1
no ip bootp server
ip domain name 
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint ssssssssssssssssssssss
 enrollment selfsigned
 subject-name sssssssssssssssssssssssssssssssssssssss
 revocation-check none
 rsakeypair ssssssssssssssssssssssssss
!
!
crypto pki certificate chain TP-self-signed-sssssssssssssss
 certificate self-signed 01
  jjjjjjjjjjjj
  ddddddddddd
  eeeeeeeeeee
        quit
license udi pid CISCO2921/K9 sn FGL171511XH
!
!
memory reserve critical 10024
memory free low-watermark processor 599187
memory free low-watermark IO 599187
!
redundancy
!
!
!
!
!
controller T1 0/0/0
 cablelength long 0db
 channel-group 0 timeslots 1-24
!         
controller T1 0/0/1
 cablelength long 0db
 channel-group 0 timeslots 1-24
!
track 1 ip sla 1 reachability
!
track 2 ip sla 2 reachability
!
track 3 ip sla 3 reachability
!
track 100 list boolean or
 object 1
 object 2
 object 3
!
! 
!
crypto isakmp policy 1
 encr aes 256
 authentication pre-share
 group 2
!
crypto isakmp policy 15
 encr aes
 authentication pre-share
 group 2
 lifetime 28800
crypto isakmp key KEY address 1.1.1.1 
crypto isakmp key KEY address 2.2.2.2 
crypto isakmp keepalive 10
!
!
crypto ipsec transform-set ESP-AES-256-SHA esp-aes 256 esp-sha-hmac 
 mode tunnel
crypto ipsec transform-set ESP-AES-128-SHA1 esp-aes esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile IPSEC-PROF-1
 set transform-set ESP-AES-256-SHA 
!
!
!
crypto map HA_SERVICES 1 ipsec-isakmp 
 set peer 2.2.2.2
 set transform-set ESP-AES-128-SHA1 
 set pfs group2
 match address HASERVICES_DR
!
!
!
!
!
interface Loopback0
 description Management Int
 ip address 
!
interface Tunnel1
 ip address 10.254.254.2 255.255.255.252
 tunnel source 3.3.3.2
 tunnel mode ipsec ipv4
 tunnel destination 1.1.1.1
 tunnel protection ipsec profile IPSEC-PROF-1
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description Internet
 ip address 3.3.3.2 255.255.255.248
 ip access-group BLOCKEDIN in
 no ip redirects
 no ip unreachables
 ip directed-broadcast 100
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly in
 ip verify unicast source reachable-via rx allow-default
 duplex auto
 speed auto
 no lldp transmit
 no lldp receive
 crypto map HA_SERVICES
!
interface GigabitEthernet0/1
 ip address 172.31.2.7 255.255.255.0
 ip flow ingress
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
 ip policy route-map NVR
!
interface GigabitEthernet0/2
 no ip address
 duplex auto
 speed auto
!
interface Serial0/0/0:0
 no ip address
 encapsulation ppp
 shutdown
 ppp multilink
!
interface Serial0/0/1:0
 no ip address
 encapsulation ppp
 shutdown
 ppp multilink
!
!
router eigrp 100
 distribute-list Tunnel-Out out Tunnel1
 network 10.2.2.22 0.0.0.0
 network 10.254.254.0 0.0.0.3
 network 172.31.2.0 0.0.0.255
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list NAT_ACL interface GigabitEthernet0/0 overload
ip nat inside source static 192.168.2.5 3.3.3.4
ip route 10.0.0.0 255.248.0.0 172.31.2.1 200
ip route 10.1.1.39 255.255.255.255 172.31.2.1
ip route 10.1.1.73 255.255.255.255 172.31.2.1
ip route 1.1.1.1 255.255.255.255 3.3.3.1
ip route 172.31.0.0 255.255.248.0 172.31.2.1 200
ip route 192.168.0.0 255.255.248.0 172.31.2.1 200
ip ssh time-out 60
ip ssh version 2
!
ip access-list standard Tunnel-Out
 permit 10.2.2.2
 permit 10.2.2.22
 permit 10.2.200.0 0.0.0.255
 permit 172.31.2.0 0.0.0.255
 permit 192.168.2.0 0.0.0.255
!
ip access-list extended BLOCKEDIN
 deny   tcp any any fragments
 deny   udp any any fragments
 deny   icmp any any fragments
 deny   ip any any fragments
 deny   tcp any any eq ftp
 deny   ip any any option any-options
 deny   tcp any any eq 22
 deny   tcp any any eq telnet
 permit tcp any host 3.3.3.4 eq www
 permit tcp any host 3.3.3.4 eq 5445
 deny   tcp any any eq www
 deny   tcp any any eq 2002
 deny   tcp any any eq 4002
 deny   tcp any any eq 6002
 deny   tcp any any eq 9002
 permit ip any any
ip access-list extended HASERVICES_DR
 permit ip 172.31.2.0 0.0.0.255 10.1.1.0 0.0.0.255
 permit ip 10.2.100.0 0.0.0.255 10.1.1.0 0.0.0.255
 permit ip 192.168.2.0 0.0.0.255 10.1.1.0 0.0.0.255
ip access-list extended NAT_ACL
 permit ip 10.2.200.0 0.0.0.255 any
 deny   ip any 10.0.0.0 0.255.255.255
 deny   ip any 172.16.0.0 0.15.255.255
 deny   ip any 192.168.0.0 0.0.255.255
 permit ip 10.2.100.0 0.0.0.255 any
 permit ip 172.31.2.0 0.0.0.255 any
 permit ip 192.168.2.0 0.0.0.255 any
!
ip radius source-interface GigabitEthernet0/1 
ip sla auto discovery
ip sla 1
 icmp-echo 8.19.112.154
 threshold 3000
 timeout 3000
 frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
 icmp-echo 8.19.112.193
 threshold 3000
 timeout 3000
 frequency 5
ip sla schedule 2 life forever start-time now
ip sla 3
 icmp-echo 8.19.203.193
 threshold 3000
 timeout 3000
 frequency 5
ip sla schedule 3 life forever start-time now

!
route-map NVR permit 10
 match ip address 5
 set ip default next-hop 3.3.3.1
!
route-map BGP-Community permit 10
 set community 13697114
!
!
access-list 5 permit 192.168.2.5
access-list 23 permit 10.1.1.0 0.0.0.255
access-list 23 permit 10.1.4.0 0.0.0.255
access-list 23 deny   any log
!
radius server 
 address ipv4  auth-port 1645 acct-port 1646
 timeout 30
 key 
!
!
!
control-plane
!
!
no vstack
!
line con 0
 exec-timeout 5 0
 authorization exec CONSOLE
 logging synchronous
 login authentication CONSOLE
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class 23 in
 exec-timeout 4 59
 privilege level 15
 password 7 13353701181B54382F
 logging synchronous
 login authentication VTYLOGIN
 transport input ssh
 transport output ssh
line vty 5 15
 access-class 23 in
 exec-timeout 4 59
 privilege level 15
 password 7 01232617481C561D25
 logging synchronous
 login authentication VTYLOGIN
 transport input ssh
 transport output ssh
!
exception memory ignore overflow processor
exception memory ignore overflow io
exception crashinfo maximum files 5
scheduler allocate 20000 1000
ntp server  prefer
!
end

I used ip default next-hop because I want it to look at the routing table first (for internal communications to DNS, AD, local access) and then as a last resort use this route to get out to the internet. For testing, i add a static route 0.0.0.0/0 ab.ac.ab.ax and everything works great. But i do not want any of my other devices that send traffic through this router to know there is a way out to the internet. I only want this specific host to be able to use this local ISP link. This is why i am using PBR. Everything else that hits this router will go out the configured vpn tunnel on gi0/0 to another location.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Apr 1, 2018 at 21:26

1 Answer 1

Reset to default
1

If you are learning the networks at the other site from EIGRP, then PBR is something to avoid.

Packets to a destination not in the routing table get dropped. A default route will match anything else. If you do not have a default route, then traffic destined for unknown, Internet networks will be dropped. If you are learning a default route through EIGRP, then you need a better default route in your local router. That would need to be statically configured.

Unlike consumer-grade routers, business-grade routers need to be configured with a default route for Internet traffic. Business-grade routers do not automatically assume that the router is connecting to the public Internet.

Improve this answer
5
  • but it should work correct? this host first goes through another device, a layer 3 switch, before hitting this router. PBR is working fine on that switch. I guess I am not following the logic. The route table on this router has a route for the network where this host is, its back out gi0/1. There is a default gateway set which is another router. For the traffic coming from the internet, should i see the NAT translation even if the packets get dropped? I am looking at order of operations for outside-to-inside. ACL, Rate limits, accounting, NAT, PBR, Routing and so on.
    – veel84
    Feb 23, 2018 at 19:06
  • 1
    What you are trying to do is a complex kludge, Also, understand that PBR punts the packets to the processor slowing your router, and PBR is really a last resort. The correct thing to do is to remove all the PBR and simply set a default route. You need to edit the question to give us a better description of how the network is connected, and the full network device configurations from the network devices in the path.
    – Ron Maupin ♦
    Feb 23, 2018 at 19:19
  • I know I know PBR = duck tape
    – veel84
    Feb 23, 2018 at 19:30
  • It is actually "duct tape". Duck Tape is a brand of duct tape, which was originally designed to be used on air ducts.
    – Ron Maupin ♦
    Feb 25, 2018 at 17:29
  • I edited my question with the full router config. I found this cisco.com/c/en/us/support/docs/ip/…. I believe I may be running into an issue with PBR, NAT'ing and traffic going over that tunnel i have configured. I am setting up a lab to test.
    – veel84
    Mar 2, 2018 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.