Tunnel Troubleshooting, communication issues between routers....

[Matthew Brennan]

I have a MPLS network that uses seperate DSL lines for BGP failover. I have a tunnel that is up but protocol is down. It will not set-up isakmp phase 1 and I believe it's due to communications blocking. Here is my ping list...

Telnet Site Router: can ping site host IP and DSL provider IP, cannot ping destination IP

My PC: can ping DSL provider IP but not Site IP

Telnet Destination Router: cannot ping either the site IP or the DSL provider IP

Here are some configs and debugs.....

debugs on site router for "debug cry isa"

https://www.dropbox.com/s/27mcc28xbfb5wvk/clearfield%20debug.txt

Site config:

https://www.dropbox.com/s/gbsclvnt4kgj55t/Clearfield%20Site.txt

Destination config:

https://www.dropbox.com/s/v8civuk8qu3c1k2/Destination%20Code.txt

I just really don't know how to troubleshoot this further.

[Lei Tian]

Hi Matt,

Can you ping tunnel endpoint? Make sure the ISAKMP attributes are matching on both ends.

HTH,
Lei Tian

Sent from Cisco Technical Support iPhone App

[Matthew Brennan]

No I cannot ping the tunnel endpoint, nor ping the other side's DSL IP address. The attributes all match and I have also built another tunnel to another endpoint we have neither work with the same symptoms. Something is blocking the traffic leaving the site router, my guess is NAT or firewall in the DSL modem but this tunnel was up before with no replacement. I can ping the provider side of the DSL line on the site router through my MPLS connection just not through the DSL.

[Lei Tian]

Hi,

So the tunnel was up before? What was changed? The IP on the tunnel endpoints should be public IPs, no NAT is needed.

HTH,

Lei Tian

[Matthew Brennan]

The tunnel interface itself has a 10.0.0.0 address, the endpoint or DSL provider side of the external I cannot reach. This and 2 others are suffering from the same exact symptoms, a consultant who took over after my predecessor had left said that they were all operational but neither of us know how long they have been down. I know no NAT is needed but that doesn't mean that the ISP doesn't have one turned on, a lot of times they set up a PPPOE and have NAT and firewalls turned on. I'm just looking