Reverse Route Issue - Cisco Router

Ganesan Palaniappan · ‎08-06-2013

Hi All,

I just want to know about the commands to be used to find out the reverse route issue and to check the traffic flow.

I have a LAN Network behind a Firewall and my firewall is connected to Router and from there i have a connection to my counterpart network Router.

It's Very simple connection and i am not using any NAT Translations. I used only static routes for the above connections. Having a Static route in firewall towards my Router.

In Router, I am having 2 routes:

1. One default route towards my counterpart router.

2. A static reverse route for the LAN Network towards the Firewall interface.

Now the Issue is , my counterpart person haven't added route for my LAN Network and because of this i am not able to ping any of the servers from my LAN Network.

When i am trying to trace route it is getting dropped in my router itself, because of this my counterpart person is saying that the issue is not from my end. As obivious that the reverse route is missing in his router to complete the connections.

Now i need a command to find out that the traffic are hitting out my router and failing in wan interface because of the reverse route issue.So that i can send it to him to prove the same.

Also please help me in providing how the output looks and which parameter we need to check to confirm the issue.

Regards,

Gan

Joseph Nelson · ‎08-06-2013

You counterpart's router should have a route to your firewall's inside LAN. If he doesn't then the trace will stop at his equipment.

If in the trace the last hop is his equipment, check that you allow ICMP on your edge ACL

If the trace stops at your router, the next hop should be the firewall interface connected to the router (the outside interface). The ASA blocks pings ( echo-request and echo-reply) by default on outside interfaces, so you'll need to enable it to verify.

A good reference for the ASA is here:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Also, try pinging the inside interface of the firewall, assuming that your counterpart has a route to the firewall LAN side.

Can you post the following traceroutes:

From you firewall outside interface to him
From your firewall inside interface to him
From your router inside interface to him
From your router outside interface to him
From him to you

To get items 1 - 4, look at this reference on extended pings ( i.e. changing the source interface):

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080093f22.shtml

Joe

Ganesan Palaniappan · ‎08-06-2013

Hi Joe,

We know the problem is because of not having a static router for my LAN Network on the Counterpart Router.

But my query is , I need a command to find out whether the traffic is being transisted in my router on the wan interface or not like "sh conn" or "sh xlate" commands which we use in Cisco ASA where we can find the Flags and other things to find out the root cause.

I am looking for a command in Cisco Router.

Thanks for your reply and looking forward...

Joseph Nelson · ‎08-06-2013

The simplist thing you can do is watch the pings:

term mon

un all

debug ip icmp

Configure this on your WAN router and have your counterpart ping the WAN interface. If the pings are making it there, you'll see it in your console.

When you are done debugging:

term no mon

un all

Also, you should troubleshoot each segment. So repeat this excerise testing at each point.