Solved: Re: Routing problem in a GRE Tunnel

Vangelis Komninos · ‎07-02-2012

Hi everybody,

I would appreciate your kind help in a problem that we have:

Our setup

(My mobile)----(Telecom Provider) ------GRE tunnel---------<Serial0>-(Cisco 1941)-<Giga0/0 192.168.1.28>-------------<192.168.1.10 ethernet>-(Router)-<Serial 10.20.30.53>----Frame Relay-------<10.20.30.54>-(Router)-<192.168.3.1 ehternet>--------<192.168.3.2>-(IP Camera)

The short story:

We have a GRE tunnel with a telecom provider and we access our network through our mobiles. The main network is 192.168.1.0 and our base router is 192.168.1.10. Through frame relay we have connection with one of our sites in a subnet 192.168.3.0 and the router located at 192.168.3.1.

The problem:

Something is missing from 1841 (a route ?) and although I can connect to 192.168.3.1, I cannot connect to 192.168.3.2 or any other inside address.

*** The funny thing is when I trace ip 192.168.3.2 from the command line of 1941 everything is FINE ! So something is wrong with tunnel i suspect.

1841 setup:

interface Tunnel0

ip unnumbered GigabitEthernet0/0

tunnel source 172.19.255.46

tunnel destination 94.143.177.221

!

interface GigabitEthernet0/0

description $ES_LAN$

ip address 192.168.1.28 255.255.255.0

duplex auto

speed auto

no mop enabled

!

interface Serial0/0/0

ip address 172.19.255.46 255.255.255.252

no clock rate 2000000

!

ip route 94.143.177.221 255.255.255.255 Serial0/0/0

ip route 192.168.3.0 255.255.255.0 192.168.1.10

!----- This is the mobile range

ip route 192.168.30.0 255.255.255.0 Tunnel0

Best Regards

Vangelis Komninos

Sandeep Choudhary · ‎07-03-2012

no ...you can see your tracert to 192.168.3.2 from yor mobile......

you can reach till 192.168.1.10..but not further.....so....i dont think so ..it is a problem of tunnel.

can you try with another mobile or a pc ...and then tracert 192.168.3.2 or 3.57.

Regards

please rate if it helps.

View solution in original post

Sandeep Choudhary · ‎07-03-2012

Can you try to configute this route:

ip route 0.0.0.0 0.0.0.0 172.19.255.45

If it not works..then can you please pase the config from both routers??

Regards

Please rate if it helps.

Vangelis Komninos · ‎07-03-2012

Thanks for your time but unfortunately is not working.

Here is the config for 1941

----------------------------------------------------------------------------

Current configuration

!

version 15.0

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname selwintra

!

boot-start-marker

boot-end-marker

!

enable secret 5 $1$cyuZ$I5uzCfR6fbOmwWfbuxSor/

enable password selpas

!

no aaa new-model

clock timezone PCTime 2

clock summer-time PCTime date Mar 30 2003 3:00 Oct 26 2003 4:00

!

no ipv6 cef

ip source-route

ip cef

!

no ip dhcp conflict logging

ip dhcp excluded-address 192.168.30.1 192.168.30.2

ip dhcp excluded-address 192.168.30.90

ip dhcp excluded-address 192.168.30.90 192.168.30.99

!

ip dhcp pool mypool

network 192.168.30.0 255.255.255.128

dns-server 192.168.1.1

default-router 192.168.1.1

!

ip dhcp pool poolkomn

host 192.168.30.91 255.255.255.0

hardware-address 1090.3032.7989

dns-server 192.168.1.1

default-router 192.168.1.28

!

multilink bundle-name authenticated

!

license udi pid CISCO1941/K9 sn FCZ1405C2GJ

!

username sel privilege 15 secret 5 $1$w8..$3xBjaEVqcApDqbDpwpf5r.

!

interface Tunnel0

ip unnumbered GigabitEthernet0/0

tunnel source 172.19.255.46

tunnel destination 94.143.177.221

!

interface GigabitEthernet0/0

description $ES_LAN$

ip address 192.168.1.28 255.255.255.0

duplex auto

speed auto

no mop enabled

!

interface GigabitEthernet0/1

no ip address

shutdown

duplex auto

speed auto

!

interface Serial0/0/0

ip address 172.19.255.46 255.255.255.252

no clock rate 2000000

!

ip forward-protocol nd

!

ip http server

ip http authentication local

no ip http secure-server

!

ip route 0.0.0.0 0.0.0.0 172.19.255.45

ip route 94.143.177.221 255.255.255.255 Serial0/0/0

ip route 192.168.3.0 255.255.255.0 192.168.1.10

ip route 192.168.30.0 255.255.255.0 Tunnel0

!

control-plane

!

line con 0

line aux 0

line vty 0 4

password

login

!

scheduler allocate 20000 1000

end

--------------------------------------------------------------------------------

Regarding the main router (192.168.1.10) is a Datus router and the config regarding the routing is like this:

[eth4]

ip_address 192.168.1.10 255.255.255.0

[end]

[ip_routing]

ip route 192.168.3.0 255.255.255.0 10.20.30.53

[end]

So the problem is from my mobile (192.168.30.91 this address I am getting from dhcp pool poolkomn) I cannot ping 192.168.3.2. But I CAN ping 192.168.3.1 which is the third router. Also when I do a ping or a trace ip from the command line of the 1941 towards 192.168.3.2 , everything is FINE.

Thanks in advance for you effort

Vangelis Komninos

Vangelis Komninos · ‎07-03-2012

The ip camera is actually 3.57

Here is the output:

selwintra#ping

Protocol [ip]:

Target IP address: 192.168.3.57

Repeat count [5]: 10

Datagram size [100]:

Timeout in seconds [2]: 4

Extended commands [n]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 10, 100-byte ICMP Echos to 192.168.3.57, timeout is 4 seconds:

!!!!!!!!!!

Success rate is 100 percent (10/10), round-trip min/avg/max = 24/28/56 ms

Thanks

Sandeep Choudhary · ‎07-03-2012

you can ping every ip address in subnet 3 but not 192.168.3.2?????

is it right or ?

Vangelis Komninos · ‎07-03-2012

No I just CAN ping only the router address which is 192.168.3.1. I cannot ping any other address even if it is pc or ip camera or any device on the net.

The fact that I can ping anything from the command line of the 1941 makes me believe that something wrong with the tunnel

Thanks again

Best Regards

Vangelis Komninos

Vangelis Komninos · ‎07-03-2012

So from my mobile I can ping only 192.168.3.1

From command line I can ping all addresses

Sandeep Choudhary · ‎07-03-2012

can you please show me the command out put:

sh ip route....on main router

Vangelis Komninos · ‎07-03-2012

The output from 1941 is:

selwintra#trace ip 192.168.3.57

Type escape sequence to abort.

Tracing the route to 192.168.3.57

1 192.168.1.10 12 msec 0 msec 4 msec

2 10.20.30.53 20 msec 20 msec 20 msec

3 192.168.3.57 32 msec 24 msec 20 msec

selwintra#

10.20.30.53-54 is the frame relay ip between routers

Thanks

Sandeep Choudhary · ‎07-03-2012

from the main router 1941:

just give me the output of this command:

sh ip route

Vangelis Komninos · ‎07-03-2012

Here it is:

selwintra#sh ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is 172.19.255.45 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 172.19.255.45

94.0.0.0/32 is subnetted, 1 subnets

S 94.143.177.221 is directly connected, Serial0/0/0

172.19.0.0/16 is variably subnetted, 2 subnets, 2 masks

C 172.19.255.44/30 is directly connected, Serial0/0/0

L 172.19.255.46/32 is directly connected, Serial0/0/0

192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.1.0/24 is directly connected, GigabitEthernet0/0

L 192.168.1.28/32 is directly connected, GigabitEthernet0/0

S 192.168.3.0/24 [1/0] via 192.168.1.10

S 192.168.6.0/24 [1/0] via 192.168.1.12

192.168.10.0/32 is subnetted, 2 subnets

S 192.168.10.15 [1/0] via 192.168.6.254

S 192.168.10.222 [1/0] via 192.168.1.12

S 192.168.30.0/24 is directly connected, Tunnel0

S 192.168.31.0/24 is directly connected, Tunnel0

selwintra#

Sandeep Choudhary · ‎07-03-2012

Thanks:

step 1:

enter route:

ip route 192.168.3.0 255.255.255.0 192.168.1.28(Remove 192.168.1.10 route and insert this)

step 2:

ping 192.168.1.28 from your mobile ????

step3:

tracert 192.168.3.2 from your mobile.

Regards

please rate if it helps.

Vangelis Komninos · ‎07-03-2012

Thanks for your time!

First when I enter the new command the system replied:

%Invalid next hop address (it's this router)

when I ping 192.168.1.28 from my mobile it is ok.

when I trace 192.168.3.2 from my mobile stops after successful pass from 192.168.1.28 with timeout.

Sandeep Choudhary · ‎07-03-2012

if i understing right :

this is your topology:

(router1) 192.168.1.28....................192.168.1.10.(router 2).......10.2030.53....................10.20.30.54(router 3)

If this topology is right thern please check your rote..............it shold be like this:

Roter 1 route:

ip route 0.0.0.0 0.0.0.0 172.19.255.45

ip route 94.143.177.221 255.255.255.255 Serial0/0/0

ip route 192.168.3.0 255.255.255.0 192.168.1.10

ip route 192.168.30.0 255.255.255.0 Tunnel0

Router 2:

ip route 192.168.3.0 255.255.255.0 10.20.30.54(Check yours.....)

TRY THIS:::

if this not wrks ..then i need the layout of your topolgy.

Regards

Please rate if it helps

Vangelis Komninos · ‎07-03-2012

Sorry for not being so clear but the topology is this:

my mobile (static ip 192.168.30.91) ---->

Telecom provider Router (cisco) ---->

(1) Cisco 1941 (Serial0 connected to Telecom provider) (Giga0/0 connected to internal network at 192.168.1.28) ---->

(2) Datus 3015 (ethernet connected to internal network at 192.168.1.10, serial connected in frame relay at 10.20.30.53) ---->

(3) Datus 2004 (ethernet connected to local network at 192.168.3.1, serial connected in frame relay at 10.20.30.54) ---->

IP camera connected at 192.168.3.2 or 192.168.3.57 with gateway 192.168.3.1

Indeed Router (2) has:

ip route 192.168.3.0 255.255.255.0 10.20.30.54

ip route 192.168.30.0 255.255.255.0 192.168.1.28

Also Router (3) has:

ip route 192.168.1.0 255.255.255.0 10.20.30.53

ip route 192.168.30.0 255.255.255.0 10.20.30.53

Since the trace reaching the target when I enter it from the command prompt from 1941, I think the problem is somewhere around the tunnel.

Also it is important that tracing from my mobile succeds for the router address.

Thanks again for the great help and I will be happy to send you our topology

Best Regards