06-02-2017 02:34 AM - edited 03-08-2019 10:49 AM
Hi,
this is my first time to post here that is why i don't know how to start.
we have H.Q and remote site they are connected through isp mpls. And exchange route via bgp. The problem is that one of the subnets in our remote site is not reachable in H.Q Lan. H.Q router and core switch are in OSPF. But only vlan 701 in the remote sites are not reachable other vlans are reachable.
Things we tried.
1. Check any access-list that may block the subnets for vlan 701. There is none.
2.check the routing table in h.q core switch if the subnets of vlan 701 of the remote site is available and vice versa. The route is advertise both end learned the subnets.
3.vlan 701 in the remote site is reachable from the H.Q router.
4. We tried to transfer the subnets of vlan 701 in other remote site to check if there are any filtering specific for that subnet. When we transfer it is now reachable from the H.Q Lan.
5. We tried to remove the subinterface of the remote site router for vlan 701 and return again but still not reachable. Even try to change to other subinterface but still not ok.
6.we even try to use not vlan 701 and use other subnets in remote site and still not reaching the H.Q LAN.
i attached a simple diagram for our network. Remote 1 has the reachablity issue. Remote site 2 is the working site. We tried on remote site 2 the subnets in vlan 701 of remote site 1 and it works.
i hope someone will share their opiniom abour our problem.
thanks
06-02-2017 02:40 AM
Presumably the remote sites are using different IP subnets for vlan 701 ?
What does a traceroute show ?
Jon
06-02-2017 02:46 AM
Hi jon,
Yes, vlan 701 is in different subnets and advertise using the bgp.
when i traceroute in the H.Q core switch the trace stops on H.Q router. It stops on the interface connecting HQ router and switch. But when i trace from the H.Q router it is successful.
06-02-2017 02:53 AM
What is the source IP address when you traceroute from the HQ core ?
Jon
06-02-2017 05:10 AM
I don't put the source. So i believe the exit interface connecting to the HQ router will be the source of the traceroute.
Darvin
06-02-2017 05:19 AM
It would be and are you advertising that subnet with BGP ?
If not do a extended traceroute using an IP from a subnet you know you are advertising.
Jon
06-02-2017 05:24 AM
From the core switch i can ping and reach the other subnet of the remote site. We have vlan 200 and 500 in the remote site and i can reach them from the core. Only the vlan 701 and any additional subnet are cannot reach from the HQ core switch. But the core learned the subnets of vlan 701.
06-02-2017 05:30 AM
So vlans 200 and 500 are routed on the same router as vlan 701 ?
And HQ core can ping those subnets but not 701 ?
Whereas HQ router can ping all subnets ?
Jon
06-02-2017 05:34 AM
Yes, vlan 200,500 and 701 are on the same router . The set up on the remote site is router on a stick. One router with subinterface conecting to the LAN of the remote sites.
The router in HQ can reach all the subnets in the remote side including vlan 701.
06-02-2017 05:46 AM
From HQ core do a traceroute to an IP in either vlan 200 or 500 and then one in vlan 701 and post reaults.
Jon
06-04-2017 06:02 PM
Hi jon,
attached file is the traceroute results of vlan 200 and vlan 701.
Vlan200- 10.8.120.1
vlan701- 10.8.29.161
HSO_B1B2_CS1 is the HQ core. And HSO_B1_R3 is HQ router.
10.8.61.6 and 10.8.61.21 are the 2 interface of HQ router connecting to HQ core.
I attached also the show ip route in the HQ core and router showing that it learned the subnet of vlan 701(10.8.29.160)
In the remote site . There is a default route 0.0.0.0 pointing out to the mpls.
darvin
06-04-2017 06:26 PM
It's late where I am but I'll pick this up tomorrow.
Just a quick question though.
In your first post point no. 4) is not very clear. Can you explain exactly what you did and what the results were.
Jon
06-05-2017 02:08 AM
We have other remote site. What we did is that from remote site 1, we remove subnets of vlan 701 and add it on remote site 2. The results is it is reachable from the HQ Lan.
The reason we do this is to check if there is an access list anywhere in between that blocking the subnets of vlan 701.
But since the subnets is reachable when we transfer it to remote site 2, i think there is no filtering in between.
Darvin
06-05-2017 04:48 AM
This is quite confusing :)
Can you pick a subnet that does work in terms of ping from HQ switch and then attach "sh ip route" for that subnet so I can compare with what you have already sent.
Jon
06-02-2017 03:45 AM
Does the remote have the route to the HQ LAN?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide