cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
250
Views
15
Helpful
4
Replies

Basic routing question web traffic back to Head Office Internet Breakout over MPLS

HI,

 

Forgive me for this rather basic question but I am new to Cisco and currently getting to grips with a new MPLS configuration.

 

I have the following configuration 

 

Head office

--------------

head office firewall LAN - 192.168.11.0

head office firewall 10.1.0.2

Cisco ISR 4431 10.1.0.1

Cisco ISR 4431 (interface into MPLS customer edge "CE") 192.168.200.1

MPLS Provider Edge router 192.168.200.2

BGP enabled into MPLS

 

Branch network

-------------------

Cisco 877VA router 10.1.56.254

 

I am in a position where devices on the branch network 10.1.56.2 for example can access resources on the 192.168.11.0/24 network (DNS/SMB etc)  but I would now like to route allow devices on the 10.1.56.0/24 network to use head office internet breakout.

 

I have a static route configured on the branch router 0.0.0.0 0.0.0.0 <MPLS PE> and when I ping google.co.uk, I get a "Destination host unreachable" from the MPLS PE router. The 192.168.11.0 network is advertised into the MPLS via BGP

 

What routes do I need to add to allow internet breakout via Head office? Is there something additional needed for this to work?

4 REPLIES 4
Joseph W. Doherty
Hall of Fame Expert

From a routing perspective, generally all inside networks use a default network to get to the device that sends the traffic out to the Internet. Conversely, that device needs to "know" all internal networks (and routing needs to get outside traffic to those networks).

As you also mention a FW. That device needs to allow and translate (if using private IPs, usually the norm for IPv4) internal networks to pass through it (both ways).
Deepak Kumar
VIP Advocate

Hi,

I am not sure what is the issue but here are general tricks:

 

1. Check the Branch Office router's routing table. Are you getting "Default Route" which is advertised by you?

2. Run a tracert command and check are you reaching to your Head office MPLS router?

4. Is there a default route/Policy Route which will route the unknown destination traffic from the branch office to HQ firewall?

5. Did you check all Nanting/Routing/Firewall rules on the firewall which will allow traffic from the Branch office subnet and route to the Internet and vice versa?

  

 

Regards,
Deepak Kumar,
Don't forget to vote and accept the solution if this comment will help you!

thanks, managed to get this working.

We weren't advertising the routes into bgp so the branch networks at the other side were unsure where to route "unknown" traffic.

Every day is a school day :-)

Hi,

Happy to know. DOn't forget to vote a helpful answer.

Regards,
Deepak Kumar,
Don't forget to vote and accept the solution if this comment will help you!