Able to ping Servers from Router but not able to trace to Servers IP from router

[DEBADURLAV SARANGI]

Hi Team,

Need a small help from you.

We are able to ping server IP from Router but not able trace the Server IPs from router.

whenever we are tracing to Server IPs getting drops of that server default gateway.

Is that any configuration issue ?

[Mark Malone]

Hi

whats the last hop the trace is stopping at what type of device ?

Most likely not a miss config issue rather traceroute being blocked and ping being allowed  , sometimes it blocked by ISPs using MPLS or other services and sometimes its blocked in firewalls or access-list in routers/switches

[DEBADURLAV SARANGI]

Hi mark,

Thanks for your reply.

Last Hop - Distribution Switch.

Trace is dropping from DB switch. Server is connected  in a access switch which is connected to same DB Switch.

For Your reference-  i.We are able to reach destination network DB switch.There is no such kind of access-list in DB switch which can block the ICMP traffic.

My quires are..

1.We are able to trace same server from CMD prompt but while tracing from router/Switches it is reaching to default gateway device (DB Switch)of that server then we are getting RTO. 

PFA of sample diagram

Regards

Deb 

[lohit prasad]

Can you verify if PBR is configured. might be policy configured for Traceroute.

[DEBADURLAV SARANGI]

Hi Lohit,

PBR neither configured on Destination end nor Source end.

If i will do the trace route from CMD it is happening . but not from router/ switch.

Regards

Deb

[Georg Pauwen · Accepted solution]

Hello,

on a side note, check if 'no ip unreachables' is configured on the transit interfaces and if it is, enable ip unreachables.

[Richard Burts]

Deb

It is interesting and probably useful to know that traceroute does work from CMD but not from router/switch. The most likely explanation of this is that traceroute uses a different mechanism with CMD than with router/switch. tracert from CMD uses ping packets and manipulates the TTL to accomplish the traceroute. But router/switch for traceroute will use UDP packets and manipulate the TTL. This certainly suggests that something is treating ping differently from UDP. Can you post the switch config and perhaps we can find the explanation.

It occurs to me that we should check on where you are executing CMD and having success with traceroute. If CMD is executing on a device connected to the switch then there is the possibility that something on the router is impacting traceroute. So perhaps we need to see the config from the router as well as from the switch.

It also occurs to me that there is the possibility that the server is running some security software that will respond to ping probes from tracert but does not respond to UDP probes from router/switch traceroute. Can you tell us if there is any security software running on the servers?

HTH

Rick

[DEBADURLAV SARANGI]

Hi Richard,

I am really appreciated with you and showing interested to troubleshooting  issues.After removed the "no ip unreachable" command for L3 interface  from Switch.it is working fine in my lab.

Thank you gpauwen and others. you resolved my issue.

Regards

Deb