Internet Gateway using OSPF Issue

[oslopez]

Hello everyone,

I have a very basic lab where I'm trying to connect two Cisco routers connected to an Internet gateway (ASA5505) Please see the attached network topology.

If I console to Router A, all works fine, I'm able to ping public servers like 8.8.8.8, etc. Below is the Router configuration:

!Router A
!
interface GigabitEthernet0/0
 ip address dhcp
 duplex auto
 speed auto
!         
interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 duplex auto
 speed auto
!
!         
router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
 network 172.25.10.0 0.0.0.255 area 0
 default-information originate always
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 172.25.10.1
!
!

Internet traffic is forwarded to a default gateway:

RouterA#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
      i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 172.25.10.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 172.25.10.1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/1
L        10.1.1.1/32 is directly connected, GigabitEthernet0/1
      172.25.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.25.10.0/24 is directly connected, GigabitEthernet0/0
L        172.25.10.57/32 is directly connected, GigabitEthernet0/0
O     192.168.1.0/24 [110/2] via 10.1.1.2, 00:21:29, GigabitEthernet0/1

And I can reach public hosts:

RouterA#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/12/12 ms

Now, if I connect to Router B:

!
interface FastEthernet0/0
 ip address 10.1.1.2 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
!
router ospf 1
 log-adjacency-changes
 network 10.1.1.0 0.0.0.255 area 0
 network 192.168.1.0 0.0.0.255 area 0
!

I can get a default route for internet traffic:

RouterB#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.1.1 to network 0.0.0.0

     172.25.0.0/24 is subnetted, 1 subnets
O       172.25.10.0 [110/2] via 10.1.1.1, 00:17:07, FastEthernet0/0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, FastEthernet0/0
C    192.168.1.0/24 is directly connected, FastEthernet0/1
O*E2 0.0.0.0/0 [110/1] via 10.1.1.1, 00:16:17, FastEthernet0/0
 
I can reach Router A, But can't ping any public addresses:

RouterB#ping 8.8.8.8

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Perhaps this is a very easy answer and something is missing in the configuration, but so far I haven't had any luck fixing it.

Any clue would be appreciated.

Thank you.

[Jon Marshall]

Does the ASA have a route for the 10.1.1.0/24 subnet ?

Note also you should probably have a route on the ASA for 192.168.1.0/24 as well.

You can use statics on the ASA or run OSPF.

Jon

[oslopez]

Thanks Jon,

I added the following static route on the ASA:

route outside 0.0.0.0 0.0.0.0 66.X.X.X 1 <--- ISP Gateway address

But I still get the same results, can ping from router A but can't from Router B

Added the individual routes on the ASA:

route outside 10.1.1.0 255.255.255.0 66.x.x.x 1
route outside 192.168.1.0 255.255.255.0 66.x.x.x 1

But still no luck.

Thanks.

[Jon Marshall · Accepted solution]

The routes for the internal subnets shouldn't point to the ISP next hop. but back to router A.

You are telling your ASA how to reach those subnets.

Jon

[oslopez]

Hi John,

After adding the internal network:

route inside 10.1.1.0 255.255.255.0 X.X.X.X

All is working good.

Thanks a lot!

[fuadtelfah]

believe me my friend you need an access list to permits internal networks to reach outside network. thats all