Routing failed to locate next hop.....Any idea?

jhaddix385 · ‎12-15-2010

Below is the config

names
name 172.16.128.0 FW_SEGMENT
name 192.200.229.0 HRSDNET
name 172.16.32.0 WBFW_SEGMENT
name 172.16.96.0 NSFW_SEGMENT
name 172.16.64.0 VIPFW_SEGMENT
name 172.16.84.0 ATFW_SEGMENT
name 172.16.128.51 YREDS
name 192.168.251.0 VPN
name 192.168.206.0 WIRELESS
!
interface Vlan1
nameif inside
security-level 100
ip address 172.16.128.1 255.255.240.0
!
interface Vlan2
description OUTSIDE
nameif outside
security-level 0
ip address 192.200.229.22 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name default.domain.invalid
object-group service ODBC_WEST_NET tcp-udp
port-object range 1706 1706
object-group service EDS_CLIENTS udp
port-object range 43000 43060
access-list outside_access_in extended permit tcp 192.200.0.0 255.255.0.0 FW_SEGMENT 255.255.240.0 object-group ODBC_WEST_NET
access-list outside_access_in extended permit ip NSFW_SEGMENT 255.255.240.0 FW_SEGMENT 255.255.240.0
access-list outside_access_in extended permit ip WBFW_SEGMENT 255.255.240.0 FW_SEGMENT 255.255.240.0
access-list outside_access_in extended permit ip VIPFW_SEGMENT 255.255.240.0 FW_SEGMENT 255.255.240.0
access-list outside_access_in extended permit udp any object-group EDS_CLIENTS any object-group EDS_CLIENTS
access-list outside_access_in extended permit udp any host YREDS object-group EDS_CLIENTS
access-list outside_access_in extended permit tcp any host YREDS eq www
access-list outside_access_in extended permit tcp any host YREDS eq 9090
access-list outside_access_in remark VNC
access-list outside_access_in extended permit tcp any host YREDS eq 5915
access-list outside_access_in remark VPN
access-list outside_access_in extended permit ip VPN 255.255.255.0 host YREDS
access-list outside_access_in remark WIRELESS
access-list outside_access_in extended permit udp WIRELESS 255.255.255.0 host YREDS object-group EDS_CLIENTS
access-list outside_access_in remark SSH
access-list outside_access_in extended permit tcp any eq ssh host YREDS eq ssh
access-list outside_access_in extended permit tcp 192.168.0.0 255.255.0.0 FW_SEGMENT 255.255.240.0 object-group ODBC_WEST_NET
access-list inside_outbound_nat0_acl extended permit ip FW_SEGMENT 255.255.240.0 192.168.225.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip FW_SEGMENT 255.255.240.0 192.168.225.0 255.255.255.0
pager lines 24
logging enable
logging timestamp
logging trap notifications
logging history notifications
logging asdm informational
logging host outside 192.200.214.169 format emblem
mtu inside 1500
mtu outside 1556
ip local pool VPN 172.16.112.245-172.16.112.250 mask 255.255.240.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit host 192.200.214.169 outside
icmp deny any outside
icmp permit host 192.200.225.50 outside
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) FW_SEGMENT FW_SEGMENT netmask 255.255.240.0
access-group outside_access_in in interface outside
route outside WBFW_SEGMENT 255.255.240.0 192.200.229.21 1
route outside VIPFW_SEGMENT 255.255.240.0 192.200.229.21 1
route outside NSFW_SEGMENT 255.255.240.0 192.200.229.21 1
route outside 192.168.0.0 255.255.0.0 192.200.229.21 1
route outside WIRELESS 255.255.255.0 192.200.229.21 1
route outside 192.168.225.0 255.255.255.0 192.200.229.21 1
route outside VPN 255.255.255.0 192.200.229.21 1
route outside 192.200.0.0 255.255.0.0 192.200.229.21 1
route outside 192.200.214.0 255.255.255.0 192.200.229.21 1
route outside 0.0.0.0 255.255.255.255 192.200.229.21 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http FW_SEGMENT 255.255.240.0 inside
http 192.200.200.179 255.255.255.255 outside
http 192.200.0.0 255.255.0.0 outside
http 192.200.225.50 255.255.255.255 outside
snmp-server host outside 192.200.214.169 community mute
snmp-server location YRFW
snmp-server contact JHADDIX
snmp-server community mute
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
fragment timeout 10 outside
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 192.200.214.25
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 1 set nat-t-disable
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.200.214.169 255.255.255.255 outside
telnet timeout 5
ssh 192.200.214.169 255.255.255.255 outside
ssh timeout 5
console timeout 0

ntp server 192.168.225.1 source inside prefer
tftp-server outside 192.200.200.229 /CISCO/FIREWALLS/JR/JR-10.2007.txt
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect http

I am getting the "routing failed to locate "next hop for udp for NP Identity IFC: 172.16.128.1 /31488 to inside: 192.168.225.1/31488

Panos Kampanakis · ‎12-15-2010

What traffic is that?

When is the syslog generated?

Also can you provide your "sh route"?

PK

Kureli Sankar · ‎12-15-2010

I am getting the "routing failed to locate "next hop for udp for NP Identity IFC: 172.16.128.1 /31488 to inside: 192.168.225.1/31488

172.16.128.1 is the ip address of the inside interface?

Where does this host 192.168.225.1 live? All the routes are pointing to the outside interface.

route outside 172.16.32.0 255.255.240.0 192.200.229.21 1
route outside 172.16.64.0 255.255.240.0 192.200.229.21 1
route outside 172.16.96.0 255.255.240.0 192.200.229.21 1
route outside 192.168.0.0 255.255.0.0 192.200.229.21 1
route outside 192.168.206.0 255.255.255.0 192.200.229.21 1
route outside 192.168.225.0 255.255.255.0 192.200.229.21 1
route outside 192.168.251.0 255.255.255.0 192.200.229.21 1
route outside 192.200.0.0 255.255.0.0 192.200.229.21 1
route outside 192.200.214.0 255.255.255.0 192.200.229.21 1
route outside 0.0.0.0 255.255.255.255 192.200.229.21 1

Add a route on the ASA for this host or network via the inside interface.

route inside 192.168.225.1 255.255.255.255 x.x.x.x where x.x.x.x is the router on the inside.

-KS

Federico Coto Fajardo · ‎12-15-2010

Hi,

This threat was answered already on the other community.

Please check.

Federico.

Kureli Sankar · ‎12-15-2010

Thanks Federico,

Could you also post that link from the other community? What a waste of time.

-KS

Federico Coto Fajardo · ‎12-15-2010

KS,

Here's the link:

https://supportforums.cisco.com/thread/2057895?tstart=0

Federico.

Kureli Sankar · ‎12-15-2010

Thanks Federico. I will lock this thread since it has already been answered in the VPN community very clearly by our engineer Jennifer.

https://supportforums.cisco.com/thread/2057895?tstart=0

-KS