TTL expired in transit and Routing Loops

[howardwen]

hello.

ISP give me 1 fiber and 3 public subnet IPs. 72.44.190.36/29 make my route WAN IP, and 74.206.101.16/28 is my second public subnet IPs.

When 1:1 NAT(74.206.101.23), not cause Routing Loops, and when make port NAT(74.206.101.22) then will cause Routing loops. why? how to fixed it?

thanks.

[Francesco Molino]

Hi

Who's is IP 70.44.190.34?

Ip 70.44.190.36 is your router right?

Could you share your routing config?

Thanks

[howardwen]

72.44.192.36 is my router IP, 72.44.192.34 and 72.44.192.35 is ISP HSRP IP, 33 is gateway.

ISP reply me 74.206.101.16/28 is route by 72.44.192.36.

I'm now use MoNowall, so I want to change to Cisco 1941. so will fixed this problem?

[Francesco Molino]

What's your config on your router.

Changing router won't solve your issue unless your routing will change... With a config of your routing setup it could help

Thanks

PS: Please don't forget to rate as correct answer if this answered your question

[howardwen]

my router is MoNowall not Cisco now.

and config Proxy ARP to second and third public subnet IPs.

[Francesco Molino]

Are you planning to change to a Cisco router? If yes what is your planned config?

If not, what is your routing table?.

Sorry can't help on commands because I don't know these 3rd party devices.

Thanks

[howardwen]

Thank you!

config is here:https://supportforums.cisco.com/discussion/13205731/single-wan-port-assign-3-subnet-public-ips-cisco-1941

[Francesco Molino]

On your config, I don't see any nat statement referring to IP 74.206.101.23 or 74.206.101.22.

Normally these IPs are routed from your ISP to your WAN interface and you just need to use them in your nat statement,

Did you configured them?

[howardwen]

I cut these NAT config but so long.

actually is :

ip nat inside source static 192.168.23.52 74.206.101.23 

ip nat inside source static tcp 192.168.23.68 80 74.206.101.22 80 

[Francesco Molino]

Ok does http access works on this public IP?

If you don't have any other nat on the IP ending by 22, modify the actual by a full static nat and retry ping/traceroute

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

[howardwen]

HTTP access sometimes slowly.

NAT is not ending by 22, full subnets of 72.44.192.48/28 and 74.206.101.16/28.all have NAT.

[Francesco Molino]

Ok let me repeat what I meant by nat ending by 22.

Today you have this nat statement for the Public IP 74.206.101.22:

ip nat inside source static tcp 192.168.23.68 80 74.206.101.22 80 

To test it, do a full nat statement like:

ip nat inside source static 192.168.23.68 74.206.101.22

Then you can test by using ICMP or even traceroute to validate. You'll see everything will work fine. If that IP is not natted for ICMP then it won't reply to you on internet.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

[Julio E. Moisa]

Hi

Could you please share your config? do you have a diagram of your topology?

[howardwen]

72.44.192.36 is my router IP, 72.44.192.34 and 72.44.192.35 is ISP HSRP IP, 33 is gateway.

ISP reply me 74.206.101.16/28 is route by 72.44.192.36.

I'm now use MoNowall, so I want to change to Cisco 1941. so will fixed this problem?