1

askk

Hi. When I do traceroute from host 192.168.11.0/24 to the server 10.0.0.0/24, which is site B. When the packets get into the public area it show Request timed out (as shown in this figure). I'm using IPSec protocol btw. thank you... enter image description here

NETWORK DIAGRAM. enter image description here

KCP 1 (SITE A) Conf

Current configuration : 1284 bytes
!
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname KCP1
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
license udi pid CISCO2911/K9 sn FTX1524EEWL-
license boot module c2900 technology-package securityk9
!
!
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp key bjj address 209.165.100.1
!
!
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
!
crypto map bjjtunnel 1 ipsec-isakmp 
 set peer 209.165.100.1
 set transform-set TS 
 match address vpn-ke-bjjpusat
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0
 ip address 209.165.101.1 255.255.255.248
 duplex auto
 speed auto
 crypto map bjjtunnel
!
interface GigabitEthernet0/1
 ip address 192.168.11.1 255.255.255.0
 duplex auto
 speed auto
!
interface GigabitEthernet0/2
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.101.2 
!
ip flow-export version 9
!
!
ip access-list extended vpn-ke-bjjpusat
 permit ip 192.168.11.0 0.0.0.255 192.168.10.0 0.0.0.255
 permit ip 192.168.11.0 0.0.0.255 10.0.0.0 0.0.0.255
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

BJJPUSAT (SITE B) Conf

Current configuration : 1290 bytes
!
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname BJJPUSAT
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
license udi pid CISCO2911/K9 sn FTX1524I08N-
license boot module c2900 technology-package securityk9
!
!
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp key bjj address 209.165.101.1
!
!
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
!
crypto map bjjtunnel 1 ipsec-isakmp 
 set peer 209.165.101.1
 set transform-set TS 
 match address vpn-ke-kcp1
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0
 ip address 209.165.100.1 255.255.255.248
 duplex auto
 speed auto
 crypto map bjjtunnel
!
interface GigabitEthernet0/1
 ip address 192.168.10.1 255.255.255.0
 duplex auto
 speed auto
!
interface GigabitEthernet0/2
 ip address 10.0.0.1 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.100.2 
!
ip flow-export version 9
!
!
ip access-list extended vpn-ke-kcp1
 permit ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255
 permit ip 10.0.0.0 0.0.0.255 192.168.11.0 0.0.0.255
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end
  • So, what is your question? – Zac67 Jul 12 '19 at 16:58
  • when i do traceroute from host 192.168.11.0/24 to the server 10.0.0.0/24 which is site B when the packets get into the public area it show 'request timed out' can u explained why ?? – C1sc0 Jul 12 '19 at 17:19
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 5:18
0

KCP 1, the tunnel side towards the source, doesn't send an Time Exceeded ICMP message when TTL runs out. It just silently drops the probe packet.

| improve this answer | |
  • i'd love to see ebook,or journal talking about this, if u dont mind maybe you can give me the reference – C1sc0 Jul 13 '19 at 4:09
  • ICMP? Check out RFC 792. – Zac67 Jul 13 '19 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.