Solved

Unix networking/ gateway issue

Posted on 2004-04-12
14
1,044 Views
Last Modified: 2013-12-23
I am a unix newbie and now have a job were I have to learn to administer a unix box. We have mulitple remote locations connected by frame relay. Whenever there is a clitch in the system (storm, etc), the gateway on that route changes to the wrong address. In order to fix the route we have to delete the route and then add it back correct. I would like to find the root cause of the problem. Any help would be grately appreciated. I don't know exactly what configuration info that I need to give anyone, so hopefully this is enoughto get me some help.

Thanks in advance.
0
Comment
Question by:smnphoenix
  • 6
  • 4
  • 2
  • +2
14 Comments
 
LVL 7

Expert Comment

by:fim32
ID: 10808023
what kind of unix?

odd that the gateway would change, the system must be running some sort of router discovery daemon, for solaris, that would be in.rdisc, you don't need to run it

assuming that you have a route that you wish to use, you can disable the router discovery daemon and just manually use the setting you desire.
0
 
LVL 1

Author Comment

by:smnphoenix
ID: 10808165
That is what I figured, but I cannot find it. I am using AIX.
0
 
LVL 7

Expert Comment

by:fim32
ID: 10808262
ah, aix, i believe it's called gated, a quick search on google pulls the man page:

http://www.unet.univie.ac.at/aix/cmds/aixcmds2/gated.htm
0
 
LVL 1

Author Comment

by:smnphoenix
ID: 10808296
I found that it is not using gated it is using routed, where woudl the configuration page be for that in AIX.
0
 
LVL 7

Expert Comment

by:fim32
ID: 10808607
ah, apparently aix uses both... here's the aix admin doc that deals with networking, see the routing chapter for more info on configuring the dynamic routing daemons (or killing them and applying your own static routes):

http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/commadmn/commadmntfrm.htm
0
 
LVL 7

Expert Comment

by:fim32
ID: 10808615
it's in chapter 3, under "tcp/ip routing"
0
 
LVL 1

Author Comment

by:smnphoenix
ID: 10808810
If I have all static routes does routed need to be running?
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 1

Author Comment

by:smnphoenix
ID: 10980479
I have discovered that new static routes have been showing up that I did not enter, any reason why that would be happening. I figured that may have something to do with the routes getting changed.
0
 
LVL 1

Expert Comment

by:JohnnyLingo
ID: 10998016
When you say the static routes are showing up, is this in the routing table (netstat -rn) or in the static routes list that is loaded on startup?  Static routes loaded in startup are configured in /etc/sysconfig/static-routes in Linux, don't know in AIX.  

If the routes are showing up in the routing table, they are probably being put there by routed, which is a RIP listener/advertiser.  My guess is when one of the frame relay sites goes down, the router is trying to switch to a backup route, and advertising it via RIP.  Take a look at the router's config to verify, since this would really be the root of the problem.

If static routes are getting the job done, then there is no reason to run routed.  It is very, very, common for networks to have unneccesary static routes and dynamic routing protocols (RIP, IGRP, etc) running both on routers and servers.  Most server just need an IP address, subnet mask, default gateway, and DNS servers configured and that's it.  Static routes and dynamic routing protocols should all be setup on the router, since that's its job.  
0
 
LVL 1

Author Comment

by:smnphoenix
ID: 10998611
I was speaking of netstat -rn.  Routed does produce static routes at startup, but many show up later that were not entered by routed.

I have come to the same conclusion that you reached in your second paragraph that it is the router. The problem is that I have multiple routers, and I did not do the setup on them. Therefore I am running a little blind on which particular router is doing the RIP advertising, is there a tool that would help me discover this.
0
 
LVL 1

Expert Comment

by:JohnnyLingo
ID: 11002748
I'd try getting routed to run in debug mode.  Try "killall routed", then run routed -dt.  Every 30 seconds you should see the list of networks, and which router it is coming from.  Another option is use a packet sniffer like tcpdump.  Look for UDP traffic on port 520.

If all else fails, try to physically locate the routers and console in.  On a Cisco, use "show ip route rip", "show ip rip database", and "debug ip rip database" to see what's up.  
0
 

Expert Comment

by:gc-mirada
ID: 11003788
I think your system is probably adding routes in accordance to ICMP redirect packets that it is receiving from the router that manages your Frame Relay connection - this is probably set to what ever the default gateway on the router is set to.

I would recommend disabling ICMP redirects on your router, which, in turn should resolve your issue on your AIX system.

On a Cisco Router this is accomplished globaly by the command

no ip icmp redirects

or, you can disable this on a per interface basis by the interface-configuration command

no ip redirects

It is enabled by default on Cisco routers.

Hope this is of some help.
0
 
LVL 1

Accepted Solution

by:
rvaz123 earned 500 total points
ID: 11030071

If routes on AIX box is getting changed due to clitch in the system , means routes are not permanently stored in ODM of server.
Permanent route can be set using smitty route or  by putting entries in /etc/rc.net config file.Hence when server gets rebooted , original set routes are back.
These static routes will be visible all the time using netstat -rn.

Also if you are observing large entries in routing tables. Those would include static routes which were set already and route to hosts or net which were accessed from your server.
This is so because it will access that route to specific server directly. netstat -r will show host name to which telnet/ping etc is initiated from your server.
These entries will be in routing table for certain amount of time and will go if not in used.

Hope this helps..
Reg
0
 
LVL 1

Author Comment

by:smnphoenix
ID: 11160952
Thank you Reg, this was the answer. It is working perfectly now.

0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now