Is this a router bug or my lack of understanding routing?

[Paul Morgan]

I have a WAN connected router which is configured for a range of 8(6) IPs from our ISP. - ip address 101.102.103.250 255.255.255.248

The default gateway address is 101.102.103.249 and this is the next hop on the ISP link to us.

This is working just fine for this primary IP of .250. But we are not receiving any traffic for the other IPs in the range .251 .252 .253 .254

Ive tested this with PING, TRACEROUTE and SSH.

Now if I go and create a NAT rule that translates traffic for one of those IPs, then we get traffic successfully.

It is like the IP is not recognised as 'alive' until something specifically receives it.

But it gets weirder...

I ran packet captures and found that ICMP traffic is not even being received for these 'dead' IP addresses.

Am I missing something fundamental here?

[eduardopozo56]

Its your lack of understanding of routing/addressing/NAT/ARP :)

101.102.103.248/29 is a 8ip (6hosts) range, you are right.. BUT

the command "ip address 101.102.103.250 255.255.255.248" applied to your router, is only 1 ip, not a range of IP. Your router ip is .250 and the ISP ip is .249, So unless you are using a ip pool on your NAT configuration, you are only using the .250 IP

When you configure a static NAT using one of the other IP's on the range, or a NAT pool, the router uses proxy-arp on the Outside interface to signal the ISP that those IPs are also "alive" on the same router besides the one already configured (.250).

If a Static NAT or a NAT pool is not configured, the router will only respond to ARP requests for its own ip (.250), that's why you don't see any traffic for the .251, .252, etc.

[Paul Morgan]

Thanks for that friend. I understand the logic of what you say - but that doesn't explain why the ISP would not send traffic to my router if it was destined for an IP in my range?

[eduardopozo56 · Accepted solution]

Just edited to add this :)

If a Static NAT or a NAT pool is not configured, the router will only respond to ARP requests for its own ip (.250), that's why you don't see any traffic for the .251, .252, etc.

[Jon Marshall]

Paul

Just to add to Eduardo's response.

If the IPs are from the same subnet then the ISP can't route to those IPs ie. you only route to remote subnets.

All it can do is request the mac address and until you configure the IPs on your router your router won't respond to those requests

Jon

[Jon Marshall · Accepted solution]

Paul

You won't be able to ping the IP until you do something with it ie. either assign it to an interface or create a static NAT statement.

Because the IPs are in the same subnet as the ISP interface it will send an arp request for any of those IPs. When you create a static NAT on your router the router will then respond to these requests using proxy arp ie. it sends back the mac address of it's outside interface so that the ISP then forwards traffic for that IP to the router.

The reason you see no traffic until you configure the static is because when the ISP sends a request for the mac address of the IP there is nothing to respond to that request.

Jon

[Paul Morgan]

Ahh thanks Jon - that explains it perfectly. Eduardo had just said the same but I understand it completely now.

Many thanks guys.