cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
481
Views
0
Helpful
3
Replies

Packets not flowing like i think they should

benningtonr
Level 1
Level 1

Using PT 7.0 on a windows 10 PC

I have built a small network of 6 end nodes all on different subnets on a 3560 switches, out of the box I would not think they should be able to talk to each other, due to no ACL allowing them too.

Yet they can,

Next

I have an asa5505 hanging off the 3560 and a 2911 router off that, and another 2911 off that with a server off the last router.

the switch can ping the inside firewall, but not through it, fine, no ACL allowing it. 

All the end nodes can ping the 3560 interface going to the FW but not the Inside FW interface.

I have a static route 0.0.0.0 0.0.0.0 192.168.1.2

3 Replies 3

Jon Marshall
Hall of Fame
Hall of Fame

First question, you do not need acls to allow traffic, it is the opposite ie. acls filter traffic.

Second question, you need to add routes to firewall eg. -

"route inside 192.168.97.0 255.255.255.0 192.168.1.2"

you need a route for each internal subnet using the same next hop IP.

Jon

okay, i added the followign

route inside 192.168.96.0 255.255.255.0 64.5.141.1

that would be the next hop outbound, I am still unable to ping R0

coming from the outside i have server2  so it can ping R1 and R0, well the outside interface anyway of R0 

I have BGP setup between R1 and R0

Router#sho ip bgp nei

BGP neighbor is 216.54.0.109, remote AS 11222, external link

BGP version 4, remote router ID 216.54.0.109

BGP state = Established, up for 00:05:15

Last read 00:05:15, last write 00:05:15, hold time is 180, keepalive interval is 60 seconds

Neighbor capabilities:

Route refresh: advertised and received(new)

Address family IPv4 Unicast: advertised and received

Message statistics:

InQ depth is 0

OutQ depth is 0

Sent Rcvd

Opens: 1 1

Notifications: 0 0

Updates: 0 0

Keepalives: 6 6

Route Refresh: 0 0

Total: 7 7

Default minimum time between advertisements runs is 30 seconds

For address family: IPv4 Unicast

BGP table version 1, neighbor version 6/0

Output queue size : 0

Index 1, Offset 0, Mask 0x2

1 update-group member

Sent Rcvd

Prefix activity: ---- ----

Prefixes Current: 0 0 (Consumes 0 bytes)

Prefixes total: 0 0

Implicit Withdraw: 0 0

Explicit Withdraw: 0 0

Used as bestpath: n/a 1

Used as multipath: n/a 0

Outbound Inbound

Local Policy Denied Prefixes: -------- -------

Total: 0 0

Number of NLRIs in the update sent: max 3, min 1

Address tracking is enabled, the RIB does have a route to 216.54.0.109

Connections established 1; dropped 1

Last reset never

Transport(tcp) path-mtu-discovery is enabled

Connection state is ESTAB, I/O status: 1, unread input bytes: 0

Connection is ECN Disabled, Minimum incoming TTL 0, Outgoing TTL 1

Local host: 216.54.0.110, Local port: 179

Foreign host: 216.54.0.109, Foreign port: 1025

Connection tableid (VRF): 0

Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes)

Event Timers (current time is 0xC69F4):

Timer Starts Wakeups Next

Retrans 0 0 0x0

TimeWait 0 0 0x0

AckHold 6 0 0x0

SendWnd 0 0 0x0

KeepAlive 6 0 0x0

GiveUp 0 0 0x0

PmtuAger 0 0 0x0

DeadWait 0 0 0x0

Linger 0 0 0x0

ProcessQ 0 0 0x0

iss: 2057115318 snduna: 2057115748 sndnxt: 2057115748 sndwnd: 15955

irs: 3480424370 rcvnxt: 3480424751 rcvwnd: 16004 delrcvwnd: 380

SRTT: 259 ms, RTTO: 579 ms, RTV: 320 ms, KRTT: 0 ms

minRTT: 16 ms, maxRTT: 300 ms, ACK hold: 200 ms

Status Flags: passive open, gen tcbs

Option Flags: nagle, path mtu capable

IP Precedence value : 6

Datagrams (max data segment is 1460 bytes):

Rcvd: 7 (out of order: 0), with data: 0, total data bytes: 0

Sent: 7 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 0, total data bytes: 0

Packets received in fast path: 0, fast processed: 0, slow path: 0

fast lock acquisition failures: 0, slow path: 0

R0 can ping the outside server Server 2

just cant get from my inside to pass traffic to the outside through the switch, it stops at the switch

I gave you the next hop IP based on your switch configuration so why have you used a completely different one ?

Your firewall needs to know how to reach the subnets on your 3560 so the next hop IP has to be on the 3560.

Jon

Review Cisco Networking products for a $25 gift card