05-30-2011 11:39 AM - edited 03-11-2019 01:40 PM
Hello,
I'd like to present the following case to the community to see if any member has been facing a similar case.
Have a 5510 in Routed mode, simple Static NAT to interface two networks (inside_1 is my private space, and outside_1 the larger intranet that hosts heavy traffic). outside_2 faces internet via pppoe just for VPN purposes.
It was operating fine for one year then one port broke (outside_2, internet), leaving no vpn. We followed RMA service replacement and the new unit came with upgraded SW (8.0.4) than the one the original config was created on (8.0.2).
To ease the replacement, I did downgrade the sw boot image. Then I did restore the config by tftp to the startup-config and then a reload. Everything seems to load fine.
Problem is that testing reveals some sort of issue: I can ping some of the intranet hosts but can't reach gateway, thus larger segment of hosts become unreachable. It seems as if the NAT mechanism can't find the next gateway where to hop. For debug practice, I've enabled all the icmp stuff so ping wasn't being blocked by the device.
Being given the fact that this config was up and running prior to the replacement, I've no reason to suspect any mysconfigured items (ie routes, NAT, access-list), but obviously I'm obfuscated and can't see what else I'm missing.
How is that possible that the PING only reaches certain hosts? Pinging to 10.15.5.90 works (Route is 0.0.0.0 0.0.0.0 to 10.15.5.126 (gw)), but pinging to the gateway itself doesn't (10.15.5.126) and even worse, hosts like 10.15.167.210 do not respond either. Clueless.
I appreciate your time taken to read this. Hopefully you can help with your experience and shedding some light to figure t
05-30-2011 12:12 PM
Hi Martin,
You might have to clear the arp tables on the upstream and downstream devices.
Thanks,
Varun
05-30-2011 01:18 PM
Hi Varun,
Thanks for the insight. I spoke with the Network Admin for the intranet segment and he did clear the ARP tables on the 10.15.5.126 Gateway. Problem persists. I did clean via "# clear arp" on de cisco ASA too.
I'm wondering why in the informational log it seems to assemble the message:
Teardown outbound icmp connection for faddr/10.15.5.126/0 gaddr/192.168.10.20/38772 laddr 192.168.10.20/38772
Built outbound icmp connection for faddr/10.15.5.126/0 gaddr/192.168.10.20/39540 laddr 192.168.10.20/39540
But to my limited knowledge it is missin a couple of lines like those.
Any other hint? I did already open a case over TAC.
Many Thanks Varun.
.\\
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide