cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1711
Views
0
Helpful
17
Replies

PBR and IPSLA Tracking on Cisco 1941

buzzhani1
Level 1
Level 1

I'm trying to configure IPSLA on my network such that if my primary network fails, the backup network network picks up. I have one router and two modems. The primary modem is connected to the GE0/1 port of the 1941 router. The router also has 4 Gigabit EHWIC ports which i've learnt may be on layer 2 (not sure). The secondary modem is connected to one of these EHWIC ports (GE0/0/0). Below are the commands i'm using to configure IPSLA

   ip sla 10
   icmp-echo 41.73.20.59 [the ip here is the WAN gateway for the primary modem]
   threshold 2
   timeout 1000
   frequency 3

ip sla monitor schedule 1 life forever start-time now

track 10 ip sla 10 reachability

 ip access-list 101 permit icmp any host 40.73.20.59 echo 
 route-map DEFAULT-ROUTE-POLICY permit 10
 match ip address 101
 set ip next-hop 41.73.20.59
 set interface null 0 

ip local policy route-map DEFAULT-ROUTE-POLICY

ip route 0.0.0.0 0.0.0.0 41.73.20.59 track 10
ip route 0.0.0.0 0.0.0.0 197.242.249.20 100 [this is the WAN gateway address for the backup modem]

All commands execute just fine. However, when i try to test by turning off the primary modem and running show ip route. I get: Gateway of last resort is not set. I don't understand why. Please what is my error? Also when i check the GE0/0/0/0 interface(where the backup modem is connected) with sh ip int brief. I see it shows the port is unassigned but the link status shows as up. I don't know if that has anything to do with this but i just thought i should mention it.

Thanks.

17 Replies 17

Nagendra Kumar Nainar
Cisco Employee
Cisco Employee

Hi,

 

Do you have any SVI configured with relevant IP address to be connected to your backup modem?.  Are you able to ping your back modem?.

 

Can you share the complete configuration?.

 

-Nagendra

Hello,

No i don't have any SVI configured. Did you mean pinging from the CLI? Haven't tried pinging from the CLI but connected directly via ethernet to a computer, the modem works.

 

Thanks

**Please i don't understand what configurations you're requesting.

 

I hope 197.242.249.20 is the address of the connected modem?. You need an address on SVI (interface vlan) from same range.

 

Can you share teh running-configuration from the router?. (You can use "show run") to get the same.

 

-Nagendra

I agree with Nagendra that the issue is likely something about the configuration of the interface where the second modem is connected and that seeing the router configuration would help us figure out the issue.

 

A slightly different way to look at the problem is to look at the backup default route (the floating static) which has 197.242.249.20 as its next hop. The question would be when the primary modem is turned off is this next hop reachable? So when the primary modem is turned off do a show ip route and look to see if there is a subnet in the routing table that includes  197.242.249.20. If the next hop is not reachable then IOS will not put the route into the routing table.

 

HTH

 

Rick

HTH

Rick

Yes it is the modem's IP address. [it's actually 197.242.249.17, used 197.242.249.20 as an example]. Here's the configuration.

 

show run gives the following results. The primary modem's WAN IP is actually 41.73.20.57 and the back up modem's WAN IP is actually 197.242.249.17
-------

ip dhcp excluded-address 192.168.1.2 192.168.1.60
ip dhcp excluded-address 192.168.1.109 192.168.1.116
!         
ip dhcp pool Qhotel
 network 192.168.1.0 255.255.255.0
 dns-server 8.8.8.8 4.2.2.2 
 default-router 192.168.1.1 
 domain-name vhotel
 lease 0 6 30
!         
!         
!         
no ipv6 cef
multilink bundle-name authenticated
!         
!         
!         
license udi pid CISCO1941/K9 sn FTX173984WM
license boot module c1900 technology-package datak9
!         
!         
!         
redundancy
!         
!         
!         
track 10 ip sla 10 reachability
!         
!         
!         
!         
interface Embedded-Service-Engine0/0
 no ip address
 shutdown 
!         
interface GigabitEthernet0/0
 description ###LAN_SIDE###
 ip address 192.168.1.1 255.255.255.0
ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!         
interface GigabitEthernet0/1
 description ###WAN CONNECTION###
 ip address 41.73.20.58 255.255.255.252
 ip nbar protocol-discovery
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!         
interface GigabitEthernet0/0/0
 switchport access vlan 2
 no ip address
!         
interface GigabitEthernet0/0/1
 no ip address
!         
interface GigabitEthernet0/0/2
 no ip address
!         
interface GigabitEthernet0/0/3
 no ip address
!         
interface Vlan1
 no ip address
!         
interface Vlan2
 ip address 197.242.249.18 255.255.255.248
!         
ip local policy route-map DEFAULT-ROUTE-POLICY
protocol nd
!         
no ip http server
no ip http secure-server
!         
ip nat pool Qhotel 41.73.20.58 41.73.20.58 netmask 255.255.255.0
ip nat source list 1 interface GigabitEthernet0/1 overload
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip nat inside source list 10 pool Qhotel overload
ip route 0.0.0.0 0.0.0.0 41.73.20.57 track 10
ip route 0.0.0.0 0.0.0.0 41.73.20.57
ip route 0.0.0.0 0.0.0.0 10.255.178.177 100
ip route 0.0.0.0 0.0.0.0 10.225.178.177 100
ip route 0.0.0.0 0.0.0.0 197.242.249.17 100
ip route 0.0.0.0 0.0.0.0 192.242.249.17 100
!         
ip sla 10 
 icmp-echo 41.73.20.57
 threshold 2
 timeout 1000
 frequency 3
ip sla schedule 10 life forever start-time now
access-list 1 permit 192.168.0.0 0.0.255.255
access-list 10 permit 192.168.0.0 0.0.0.255
access-list 101 permit icmp any host 192.168.1.1 echo
access-list 101 permit icmp any host 41.73.20.57 echo
access-list 101 permit icmp any host 41.73.20.57
LT-ROUTE-POLICY permit 10
 match ip address 101
 set ip next-hop 192.168.1.1 41.73.20.57
 set interface Null0

 no activation-character
 no exec  
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
!         
scheduler allocate 20000 1000
!       


Thanks.

Thanks for the additional information. I still would like to see the output of show ip route in normal operation and perhaps the output of show ip route when the primary modem is turned off.

 

In looking through your config I do have these comments, which may or may not have a bearing on your problem is ip sla.

- you have configured ip nat outside on the interface with the primary modem but not on the interface with the backup. Is that on purpose?

- I do not understand why you have two commands with the primary default route

ip route 0.0.0.0 0.0.0.0 41.73.20.57 track 10

ip route 0.0.0.0 0.0.0.0 41.73.20.57

and I wonder if the second command without track is affecting routing if ip slap removes the first one.

- I do not understand why you have 4 copies of the floating static default route

ip route 0.0.0.0 0.0.0.0 10.255.178.177 100

ip route 0.0.0.0 0.0.0.0 10.225.178.177 100

ip route 0.0.0.0 0.0.0.0 197.242.249.17 100

ip route 0.0.0.0 0.0.0.0 192.242.249.17 100

- I do not know why you added 192.168.1.1 to the route map and believe that this creates a problem when set it as the next hop

set ip next-hop 192.168.1.1 41.73.20.57

- I do not know why you have the null0 interface included in the route map and suggest that you remove it

set interface Null0

 

HTH

 

Rick

HTH

Rick

1) "I do not understand why you have two commands with the primary default route"

"I do not understand why you have 4 copies of the floating static default route" 

I didn't mean to configure it that many times (i.e. for the primary default route and floating static default route). I kept having to troubleshoot and reconfigure and assumed the new configurations will override the old ones. How do i reset everything...? Will the command no ip sla 10 clear/reset the configuration?

2) I do not know why you added 192.168.1.1 to the route map and believe that this creates a problem when set it as the next hop

I actually didn't add 192.168.1.1 while setting the next hop. The command i used was

set ip next-hop 41.73.20.57 [where 41.73.40.57 is the gateway address of the primary modem] 

3) you have configured ip nat outside on the interface with the primary modem but not on the interface with the backup. Is that on purpose?

I actually didn't take note of that nat configuration. Must have been configured before i took hold of the router. Do i need to configure ip nat outside on the backup modem as well? I don't think it would affect ip sla or would it?

show ip route with the primary modem functional gives:

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 41.73.20.57 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 41.73.20.57
      41.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        41.73.20.56/30 is directly connected, GigabitEthernet0/1
L        41.73.20.58/32 is directly connected, GigabitEthernet0/1
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/0
L        192.168.1.1/32 is directly connected, GigabitEthernet0/0

I'm not able to get the full details for show ip route when the primary modem is off at the moment. But it gives:

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set  

-----incomplete----

 

 

 

There are quite a few things to address here. So let me start with the most important one. The content of show ip route does not include 197.242.249.17 or 197.242.249.16 (which is the subnet which contains the backup modem). If its next hop is not reachable then your floating static (backup) route will not be put into the table. This is the biggest problem and we need to solve it. What can you tell us about Gi0/0/0 where the modem is connected and about vlan 2?

 

For the other points:

- no ip sla 10 will remove that sla (if you need to do that) but it will not address other issues in the configuration.

- I am not sure why you have two of these but they both need to be removed.

ip route 0.0.0.0 0.0.0.0 10.255.178.177 100

ip route 0.0.0.0 0.0.0.0 10.225.178.177 100

-  I am not sure why you have two of these but one of them needs to be removed

ip route 0.0.0.0 0.0.0.0 197.242.249.17 100

ip route 0.0.0.0 0.0.0.0 192.242.249.17 100

after you enter no ip route 0.0.0.0 0.0.0.0 197.242.249.17 100 then do show run and check whether one or both of them were removed. You want to wind up with exactly one of them.

- I do not know how 192.168.1.1 got into the route map. But it needs to not be there.

- No having nat on the backup modem or not would not impact ip sla. But it will have a huge impact on how traffic is treated that is sent out that interface. Your router is configured with nat on the primary modem so that traffic is not sent outside using 192.168.1.0 addresses. If nat is not configured on the backup then the traffic sent out it will have 192.168.1.0 addresses. You know your environment better than we do but it seems to me that if you need nat on one modem then you probably need nat on the other modem.

 

HTH

 

Rick 

HTH

Rick

This is what show int GigabitEthernet0/0/0 returns:

GigabitEthernet0/0/0 is up, line protocol is up 
  Hardware is EHWIC-4 Gigabit Ethernet, address is c067.af0f.6ff0 (bia c067.af0f.6ff0)
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 100Mb/s
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     68066 packets input, 4811317 bytes, 0 no buffer
     Received 68003 broadcasts (13 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     48814 packets output, 5403635 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     4 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

Vlan2 is assigned an IP of 197.242.249.18 (same subnet as back up modem) and is configured on the GE0/0/0 port (which i think is a layer 2 port) using the following commands:

interface GigabitEthernet0/0/0

switchport mode access vlan 2

 I thought creating the vlan on this port would give it layer 3 abilities. But i don't think it did.

This is what show ip int brief returns:

Interface                  IP-Address      OK? Method Status                Protocol

Embedded-Service-Engine0/0 unassigned      YES NVRAM  administratively down down    

GigabitEthernet0/0         192.168.1.1     YES NVRAM  up                    up      

GigabitEthernet0/1         41.73.20.58     YES NVRAM  up                    up      

GigabitEthernet0/0/0       unassigned      YES unset  up                    up      

GigabitEthernet0/0/1       unassigned      YES unset  down                  down    

GigabitEthernet0/0/2       unassigned      YES unset  down                  down    

GigabitEthernet0/0/3       unassigned      YES unset  down                  down    

NVI0                       192.168.1.1     YES unset  up                    up      

Vlan1                      unassigned      YES unset  down                  down    

Vlan2                      197.242.249.18  YES manual up                    up

 

I have noted down your other points. This is what i can say about GE0/0/0 and Vlan2. 

 

Thanks

 

Hello,

Please looking at the information on GE0/0/0 and Vlan2. Do you have any other insights to the issue?

 

Thanks.

 

Could you post the output of show ip interface brief and of show vlan.

 

HTH

 

Rick

HTH

Rick

Okay:

show vlan returns ambigous command so i used show vlan-switch:

VLAN Name                             Status    Ports

---- -------------------------------- --------- -------------------------------

1    default                          active    Gi0/0/1, Gi0/0/2, Gi0/0/3

2    VLAN0002                         active    Gi0/0/0

10   internet                         active    

1002 fddi-default                     act/unsup 

1003 token-ring-default               act/unsup 

1004 fddinet-default                  act/unsup 

1005 trnet-default                    act/unsup 


VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1    enet  100001     1500  -      -      -        -    -        1002   1003

2    enet  100002     1500  -      -      -        -    -        0      0   

10   enet  100010     1500  -      -      -        -    -        0      0   

1002 fddi  101002     1500  -      -      -        -    -        1      1003

1003 tr    101003     1500  1005   0      -        -    srb      1      1002

1004 fdnet 101004     1500  -      -      1        ibm  -        0      0   

1005 trnet 101005     1500  -      -      1        ibm  -        0      0

 

I already posted the output of shoe ip interface brief below but here it is:

Interface                  IP-Address      OK? Method Status             Protocol

Embedded-Service-Engine0/0 unassigned      YES NVRAM  administratively down down    

GigabitEthernet0/0         192.168.1.1     YES NVRAM  up                    up      

GigabitEthernet0/1         41.73.20.58     YES NVRAM  up                    up      

GigabitEthernet0/0/0       unassigned      YES unset  up                    up      

GigabitEthernet0/0/1       unassigned      YES unset  down                  down    

GigabitEthernet0/0/2       unassigned      YES unset  down                  down    

GigabitEthernet0/0/3       unassigned      YES unset  down                  down    

NVI0                       192.168.1.1     YES unset  up                    up      

Vlan1                      unassigned      YES unset  down                  down    

Vlan2                      197.242.249.18  YES manual up                    up 

Thank you.

Thank you for the additional information. I am glad to see that it does show vlan 2 as a valid and active vlan on the switch. I am still puzzled why that subnet does not show up in the routing table and I suspect that whatever is preventing that subnet from showing up in the routing table is related to the failure to failover. Perhaps a fresh copy of the running config might show us something helpful.

 

HTH

 

Rick

HTH

Rick

I made the adjustments you suggested, did an reconfigured vlan2. Now here's the output for show ip route:

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override


Gateway of last resort is 41.73.20.57 to network 0.0.0.0


S*    0.0.0.0/0 [1/0] via 41.73.20.57

      41.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        41.73.20.56/30 is directly connected, GigabitEthernet0/1

L        41.73.20.58/32 is directly connected, GigabitEthernet0/1

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C        192.168.1.0/24 is directly connected, GigabitEthernet0/0

L        192.168.1.1/32 is directly connected, GigabitEthernet0/0

      197.242.249.0/24 is variably subnetted, 2 subnets, 2 masks

C        197.242.249.16/29 is directly connected, Vlan2

L        197.242.249.18/32 is directly connected, Vlan2

 

And the output for show run is:

 

!

! Last configuration change at 11:26:24 UTC Thu Jul 2 2015

version 15.2

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Qhotel

!

boot-start-marker

boot-end-marker

!

!

!

no aaa new-model

!

ip cef

!

!

!

!

          

          

!         

ip dhcp excluded-address 192.168.1.2 192.168.1.60

ip dhcp excluded-address 192.168.1.109 192.168.1.116

!         

ip dhcp pool Qhotel

 network 192.168.1.0 255.255.255.0

 dns-server 8.8.8.8 4.2.2.2 

 default-router 192.168.1.1 

 domain-name vhotel

 lease 0 6 30

!         

!         

!         

no ipv6 cef

multilink bundle-name authenticated

!         

!         

!         

license udi pid CISCO1941/K9 sn FTX173984WM

license boot module c1900 technology-package datak9

!         

!         

!         

redundancy

!         

!         

!         

track 10 ip sla 10 reachability

!         

!         

!         

!         

interface Embedded-Service-Engine0/0

 no ip address

 shutdown 

!         

interface GigabitEthernet0/0

 description ###LAN_SIDE###

 ip address 192.168.1.1 255.255.255.0

 ip nat inside

 ip virtual-reassembly in

 duplex auto

 speed auto

!         

interface GigabitEthernet0/1

 description ###WAN CONNECTION###

 ip address 41.73.20.58 255.255.255.252

 ip nbar protocol-discovery

 ip nat outside

 ip virtual-reassembly in

 duplex auto

 speed auto

!         

interface GigabitEthernet0/0/0

 switchport access vlan 2

 no ip address

!         

interface GigabitEthernet0/0/1

 no ip address

!         

interface GigabitEthernet0/0/2

 no ip address

!         

interface GigabitEthernet0/0/3

 no ip address

!         

interface Vlan1

 no ip address

!         

interface Vlan2

 ip address 197.242.249.18 255.255.255.248

!         

ip local policy route-map DEFAULT-ROUTE-POLICY

ip forward-protocol nd

!         

no ip http server

no ip http secure-server

!         

ip nat pool Qhotel 41.73.20.58 41.73.20.58 netmask 255.255.255.0

ip nat source list 1 interface GigabitEthernet0/1 overload

ip nat inside source list 1 interface GigabitEthernet0/1 overload

ip nat inside source list 10 pool Qhotel overload

ip route 0.0.0.0 0.0.0.0 41.73.20.57 track 10

ip route 0.0.0.0 0.0.0.0 41.73.20.57

ip route 0.0.0.0 0.0.0.0 192.242.249.17 100

!         

ip sla auto discovery

ip sla 10 

 icmp-echo 41.73.20.57

 threshold 2

 timeout 1000

 frequency 3

ip sla schedule 10 life forever start-time now

access-list 1 permit 192.168.0.0 0.0.255.255

access-list 10 permit 192.168.0.0 0.0.0.255

access-list 101 permit icmp any host 192.168.1.1 echo

access-list 101 permit icmp any host 41.73.20.57 echo

access-list 101 permit icmp any host 41.73.20.57

!         

route-map DEFAULT-ROUTE-POLICY permit 10

 match ip address 101

 set ip next-hop 41.73.20.57

!         

!         

!         

control-plane

!         

!         

!         


!         

scheduler allocate 20000 1000

!         

end       

 

Haven't been able to test it though but do you reckon it will work with this current configuration?

Recall:

41.73.20.57 is the public gateway for the primary modem AND 41.73.20.58 is the public IP address for the primary modem

192.242.249.17 is the public gateway address for the backup modem AND 192.242.249.18  is the public IP address for the backup modem

Review Cisco Networking for a $25 gift card