Can ping internet from router, but not from behind router

[John Faltys]

Ping 8.8.8.8 from 3925 works fine.

Ping 8.8.8.8 from laptop (172.16.0.10) connected to 3560 does not work.

Ping the gw @172.16.0.1 from the laptop works fine.

CO-Router1#traceroute ip 8.8.8.8

Type escape sequence to abort.

Tracing the route to google-public-dns-a.google.com (8.8.8.8)

  1  *  *  *

  2  *  *  *

  3  *  *  *

  4  *  *  *

  5  *  *  *

  6  *  *  *

  7  *  *  *

Debug on router, when trying to ping 8.8.8.8 from 172.16.0.10

Jul 13 21:50:18.918: IPpacketQ deq s=172.16.0.10 (GigabitEthernet0/0.2), d=8.8.8.8, flags=0xA00, tos=0x0, frag_offset=0

Jul 13 21:50:18.918:     UDP src=59270, dst=53

Jul 13 21:50:18.918: IP: s=172.16.0.10 (GigabitEthernet0/0.2), d=8.8.8.8, len 69, dispose ip.notgateway

I have a route on the ASA for 172.168.0.0/23 to 192.168.0.2

On router

CO-Router1#sh ip route

Default gateway is 192.168.0.1

[Harsha A.]

Hello John,

Do you have a rule on your ASA that allows traffic from your Internal Network to External Network ? 

Check your ASA logs for traffic to Internet, that should give you an idea if there is any rule/ACL that is blocking your access to Internet.

Another thing to check is the NAT. 

-Harsha

[John Faltys]

Thank you for the response.

When I ping 8.8.8.8 from router, I see the traffic going through the ASA.

When I ping 8.8.8.8 from laptop on 172.16.0.10, I never see any traffic making it to ASA.

So I assume that the laptop traffic is not making it to the ASA.

The laptop can ping the gw at 172.16.0.1

[Harsha A.]

From the laptop, are you able to ping Gi0/1 of the Router ? 

Are you able to ping the Interface of the Firewall that is connecting your Router ? 

Can you also share the tracert output from your laptop.

-Harsha

[John Faltys]

C:\Users\Administrator>ping 172.16.0.1

Pinging 172.16.0.1 with 32 bytes of data:
Reply from 172.16.0.1: bytes=32 time=1ms TTL=255
Reply from 172.16.0.1: bytes=32 time<1ms TTL=255
Reply from 172.16.0.1: bytes=32 time<1ms TTL=255
Reply from 172.16.0.1: bytes=32 time<1ms TTL=255

Ping statistics for 172.16.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms

C:\Users\Administrator>ping 192.168.0.2

Pinging 192.168.0.2 with 32 bytes of data:
Reply from 192.168.0.2: bytes=32 time<1ms TTL=255
Reply from 192.168.0.2: bytes=32 time<1ms TTL=255
Reply from 192.168.0.2: bytes=32 time<1ms TTL=255

Ping statistics for 192.168.0.2:
Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
Control-C
^C
C:\Users\Administrator>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.0.1:
Packets: Sent = 3, Received = 0, Lost = 3 (100% loss),
Control-C
^C
C:\Users\Administrator>tracert 8.8.8.8

Tracing route to 8.8.8.8 over a maximum of 30 hops

1 * * * Request timed out.
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * ^C
C:\Users\Administrator>

[mlund · Accepted solution]

Hi John

CO-Router1#sh ip route

Default gateway is 192.168.0.1

This output shows that the device is not routing enabled. The 3560 is by default a switch with no routing capabilities. I'm not sure about 3560, but can you try with the command "ip routing".

Maybe You have to do "sdm prefer routing" first.

/Mikael

[John Faltys]

Thank you.  I enabled ip routing on the 3925.

That was certainly half the answer.  I can now ping 192.168.0.1(ASA gw) from the laptop on 172.16.0.10.

However, I cannot ping 8.8.8.8. Here is some additional debug info.

CO-Router1#traceroute 8.8.8.8

Type escape sequence to abort.
Tracing the route to 8.8.8.8

1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 *
CO-Router1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

172.16.0.0/24 is subnetted, 2 subnets
C 172.16.0.0 is directly connected, GigabitEthernet0/0.2
C 172.16.1.0 is directly connected, GigabitEthernet0/0.1
C 192.168.0.0/24 is directly connected, GigabitEthernet0/1
S* 0.0.0.0/0 is directly connected, GigabitEthernet0/1
CO-Router1#

[Harsha A.]

Make sure that the default gateway like below:

For Switches ---> Router 

For Router --> Firewall 

-Harsha