DevNet CML Sandbox Bidirectional Issue

[GabrielART]

Hello Fellas, 

I am having an issue with the DevNet CML sandbox, when trying to connect to my local Ubuntu VM inside VirtualBox. My host computer is a Windows 10. I do have connectivity from the Ubuntu VM to the nodes inside CML. I can ping them just fine, but I cannot ping from the node (i.e. R1) to the Ubuntu VM. I do have all routers inside the CML connected to unmanaged switch, which is connected to an external connector in bridge mode. I believe the issue might be related to the Cisco AnyConnect VPN client, which we need to install in order to connect to the DevNet CML sandbox. I was trying to do a telemetry, where the routers would be the clients and the Ubuntu VM in my VirtualBox would be the server where I could see the logs. I did notice that you need to install a default route on every router (10.10.20.254/24) in order to get the Ubuntu to ping the routers, but again, the routers cannot ping the Ubuntu VM, thus i cannot get any telemetry information in my Ubuntu VM server. 

[Flavio Miranda]

@GabrielART 

 It seems the problem is related to the fact that Windows is not a router. The virtual machine can reach your lab just like it would reach the internet or any external network the Windows have access to. You are probably using NAT mode on your Windows virtual adapter? 
 When the traffic is originated from outside, it reaches the Windows machine which does not have router capabilities by default. And yes, the route on the router is required because they dont know the IP address on the Virtual Machine. 
 One possible solution would be  to put the Windows virtual interface as bridge and put the Ubuntu VM on the same network as the router or the gateway in the CML. 
 You can also try to port forward on windows but you may need to deal with Windows defender.

Add-NetNatStaticMapping -NatName "YourNatNetworkName" -Protocol TCP -ExternalIPAddress 0.0.0.0 -ExternalPort 8080 -InternalIPAddress 172.16.0.2 -InternalPort 80

 Change the IP and port accordingly. 

 If you are usnig VirtualBox or VMware clients. you can make the config on the client.

1. VirtualBox: Go to VM Settings ➡️ Network ➡️ Expand Advanced ➡️ Click Port Forwarding. Add a new rule mapping your Host Port (e.g., 8080) to your Guest IP and Guest Port (e.g., 80). [1]
2. VMware: Go to Edit ➡️ Virtual Network Editor. Select the NAT network, click NAT Settings, and click Add under the Port Forwarding section. [1]

[GabrielART]

I forgot to mention that I tried to ping Google's DNS server (8.8.8.8) from the routers inside the CML sandbox, and got no reply as well. This means, my CML lab is completely isolated. Also, i did try putting my Ubuntu VM in the same network as the CML sandbox and my ping goes from successful, to blocked. 

[GabrielART]

I also just tested the NAT adapter in the external connector to see if changes anything, but again, got no reply from 8.8.8.8 or 1.1.1.1. Not sure why Cisco would leave an external connector node available to choose from if you cannot reach the outside world. 

[Flavio Miranda]

It is possible but you need to prapare it. Take a look on this video and let me know. 

https://www.youtube.com/watch?v=xK_TU-sw94E

[GabrielART]

Good video. The thing is, the lab on the video is not a Cisco sandbox, it is a local CML lab. I have a local free Cisco CML lab, and i have no problem connecting to the outside world or my virtual environment in VirtualBox. In that setup, you don't even need NAT rules, or DHCP if you know your local default gateway on the VMWare workstation Pro. However, when it comes to Cisco DevNet sandbox, we must install Cisco AnyConnect in order to have access to the CML network. The CML network is usually 10.10.20.0/24. I think Cisco VPN must have some kind of rule that blocks the traffic originating from the nodes inside CML. I can ping from my Ubuntu VM in my VirtualBox network, and a reply comes back, that is why we need the static route of 10.10.20.254 on the CML nodes, but when you try to ping from the routers inside CML, It just doesn't go out of the local network. No ping to my VM, no pings to internet, using a bridge or a NAT adapter on the external connector. 

I can try to use a DHCP ip and see if the devnet CML host machine will provide me a dynamic address, but i believe it will give an address within the 10.10.20.0/24 range, which my routers are already using statically. I also tried to enable the Cisco VPN adapter within VirtualBox, but that also failed.