Basic routing question web traffic back to Head Office Internet Breakout over MPLS

[martin.daley@eventura.com]

HI,

Forgive me for this rather basic question but I am new to Cisco and currently getting to grips with a new MPLS configuration.

I have the following configuration 

Head office

--------------

head office firewall LAN - 192.168.11.0

head office firewall 10.1.0.2

Cisco ISR 4431 10.1.0.1

Cisco ISR 4431 (interface into MPLS customer edge "CE") 192.168.200.1

MPLS Provider Edge router 192.168.200.2

BGP enabled into MPLS

Branch network

-------------------

Cisco 877VA router 10.1.56.254

I am in a position where devices on the branch network 10.1.56.2 for example can access resources on the 192.168.11.0/24 network (DNS/SMB etc)  but I would now like to route allow devices on the 10.1.56.0/24 network to use head office internet breakout.

I have a static route configured on the branch router 0.0.0.0 0.0.0.0 <MPLS PE> and when I ping google.co.uk, I get a "Destination host unreachable" from the MPLS PE router. The 192.168.11.0 network is advertised into the MPLS via BGP

What routes do I need to add to allow internet breakout via Head office? Is there something additional needed for this to work?

[Joseph W. Doherty]

From a routing perspective, generally all inside networks use a default network to get to the device that sends the traffic out to the Internet. Conversely, that device needs to "know" all internal networks (and routing needs to get outside traffic to those networks).

As you also mention a FW. That device needs to allow and translate (if using private IPs, usually the norm for IPv4) internal networks to pass through it (both ways).

[Deepak Kumar]

Hi,

I am not sure what is the issue but here are general tricks:

1. Check the Branch Office router's routing table. Are you getting "Default Route" which is advertised by you?

2. Run a tracert command and check are you reaching to your Head office MPLS router?

4. Is there a default route/Policy Route which will route the unknown destination traffic from the branch office to HQ firewall?

5. Did you check all Nanting/Routing/Firewall rules on the firewall which will allow traffic from the Branch office subnet and route to the Internet and vice versa?

[martin.daley@eventura.com]

thanks, managed to get this working.

We weren't advertising the routes into bgp so the branch networks at the other side were unsure where to route "unknown" traffic.

Every day is a school day :-)

[Deepak Kumar]

Hi,

Happy to know. DOn't forget to vote a helpful answer.