WAN Int Ping issue

[Najib Akbari]

Stupid issue struggling to figure out!!!

I have an ISR and working fine, just wanted to enable ping to the WAN Link from outside and I feel bad Im not able to do it. there is no config on the Interface seems blocking it so what should I check???!!!!

[balaji.bandi]

As per the information provided, should that be working - we may need more information as below  

is this Public routable IP address ?

where are you trying to ping from ?

[Najib Akbari]

Yes it is a routable Public IP, all outgoing traffic are working, but if I ping or SSH to the public IP of the WAN interface from anywhere ( somewhere not inside the router, any traffic initiate from outside thru ISP to the WAN int) then no luck.

[balaji.bandi]

Not sure if the ISP is blocking it. Initiate some debugging and try to ping from outside to see if you can view the connection in your router's debug logs.

[srimal99]

By the sound of it, looks like ISP blocking or discarding ICMP . You can verify with ISP to ensure any security measures in place.

[Najib Akbari]

for ICMP debug to see if the traffic coming to the router:
I picked this router ( no ping) and another router ( ping works ) and run a -t ping to each one's WAN public IP and I see no logs indicating ICMP traffic:

1)

access-list 101 permit icmp any any

debug ip packet details 101

apparently since CEF is enabled and ICMP echo only processed via router CPU then unable to see the logs for it? so i run the second option and no luck either:

2)

access-list 101 permit icmp any any

debug ip cef packet gigabitEthernet 0/0/0 input 101 rate 0

no output either. and of course i ran term mon on both routers and see other logs

I can conract the ISP but first i need to make sure the traffic is not coming to the router

[balaji.bandi]

Another quick option, if you get a chance, is to use the same IP address on your Laptop and see if you can ping it. If you suspect the Router, try this.

I do not see any issue with the Router at all based on the information.

[Najib Akbari]

I will see if I can do that.

[Najib Akbari]

why Im not seeing ICMP incoming traffic on any router with debug even on a router that ping works? what am I missing on the debug command?

[MHM Cisco World]

Are this issue solve or not?

MHM

[Najib Akbari]

still there

[Jan Rolny]

Hi Najib,

if standard "debug ip icmp" does not work you can try to run Embeded Packet Capture(EPC).

This works pretty well. It depends on IOS version you are running but here is example:

monitor capture CAP interface gigabitEthernet 0/0/0 both
monitor capture CAP match ipv4 protocol 1 any any   <<<< Here protocol 1 means ICMP.

monitor capture CAP start   <<<< once you start capture initiate ping from outside and wait until ping finished
monitor capture CAP stop   <<<< after ping is done stop capture

show monitor capture CAP buffer brief  <<<< here it will display what was captured

monitor capture CAP export flash:ICMP.cap   <<<< if you like you can export capture where you need. Local flash or remote ftp.

Hope this helps.

Jan

[Najib Akbari]

Thanks Jan!

i ran monitor capture on a pinngable router and this router. there output on the pingable router but this router has no output when run "sh monitor cap cap buffer brief". does this means the ICMP traffic got blocked on ISP site or it has anything to do with the router?

[Najib Akbari]

I managed to get someone connect the link to his laptop, assigned the same IP and disabled firewall and still not pingable, then it means ISP or an intermediary device there filtering ICMP

[balaji.bandi]

Sure have you got chance to talk to ISP, rather we going circle for simple issue.