1

I am trying to use a IP SLA for HTTP on my Cisco ISR 4321 router to check if a website is reachable. The challenge is that I need to do that in a frontdoor VRF. I have configured

ip name-server vrf INET 8.8.8.8

ip domain-lookup vrf INET


ip sla 10
 http raw http://ifconfig.co name-server 8.8.8.8 cache disable
 vrf INET
 http-raw-request
  GET / HTTP/1.0\r\n
  exit
 threshold 2
 timeout 2
ip sla schedule 10 life forever start-time now

However, the result is a DNS error

IPSLAs Latest Operation Summary
Codes: * active, ^ inactive, ~ pending
All Stats are in milliseconds. Stats with u are in microseconds

ID           Type        Destination       Stats       Return      Last
                                                       Code        Run
-----------------------------------------------------------------------
*10          http        0.0.0.0           RTT=0       DNS query e 25 seconds ag
                                                       rror        o

DNS is however working in that VRF

#ping vrf INET ifconfig.co
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 104.18.39.101, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 13/18/34 ms

Any idea what I'm missing here?

  • Don't you need to set a source IP on your IP SLA? – user36472 Jan 24 at 14:20
  • That would be hard as the only interface in that VRF has DHCP enabled and has a dynamic IP. I tried it nevertheless like ` http raw ifconfig.co source-ip 192.168.0.101 name-server 8.8.8.8 cache disable` but it still results in a DNS query error. – waza-ari Jan 24 at 14:24
  • Ok well at least that's not the problem then. :-) – user36472 Jan 24 at 14:26
  • Tried the same thing in IOSv (15.5(3)M), and I don't have the option for "ip domain-lookup vrf <x>". No option in the vrf definition either. But, DNS works for my HTTP SLA's. Can't seem to get a working GET request, though. Curious if you'll see the same if you drop the domin-lookup vrf. – boomi Jan 25 at 12:41
  • Well... I found parts of the issue. Threshold and timeout are specified in msec, not in seconds. The raw request still results in a timeout, but a "normal" get request works. I'll edit the question soon, as there are actually two new problems – waza-ari Jan 25 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.