Link to home
Start Free TrialLog in
Avatar of ErikPhilips
ErikPhilipsFlag for United States of America

asked on

Cisco How to do Source Routing using Route Map

I looked at a fiew differnet question and didn't find one that would show the basic use of Route Maps without NAT.  I have a Cisco 2811, though I doubt it makes much of a difference.  I need to properly configure outbound traffic from 2 seperate networks through the 2 seperate internet connections I have.

Lets say I have 2 local Class C subnets with internet addressable ips. (examples)
network A 65.0.0.0 255.255.255.0
network B 66.0.0.0 255.255.255.0

interface FastEthernet0/0
 ip address 65.0.0.1 255.255.255.0
interface FastEthernet0/1
 ip address 66.0.0.1 255.255.255.0

interface Serial0/0/0:0
 ip address 91.0.0.1 255.255.255.252 (otherside 91.0.0.2 *i believe*)
interface Serial0/0/1:0
 ip address 92.0.0.1 255.255.255.252 (otherside 92.0.0.2 *i believe*)

Now what is the simpiest way to route everything from network A which is physically connected to Eth0 to route over Ser0 and the Same for network B connected to Eth1 over Ser1.

In addition, as a secondary sub question, I'd like network A and network B to be able to communicate without having to go over the Serial intefaces (probably 2 simple routes).
ASKER CERTIFIED SOLUTION
Avatar of Les Moore
Les Moore
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Besides, even though you can control which T1 traffic leaves your network via, you can't control which T1 gets used for the return traffic. I'll assume that the ISP routes both 65.x.x.x and 66.x.x.x through both T1's..

Avatar of ErikPhilips

ASKER

Here is what i tried after reading your response. (slightly different as my local internet subnet mask is 255.255.255.224)

interface FastEthernet0/0
 ip address 67.111.198.129 255.255.255.224
 ip policy route-map First
 duplex auto
 speed auto
 no cdp enable
!
interface FastEthernet0/1
 ip address 65.106.82.161 255.255.255.224
 ip policy route-map Second
 duplex auto
 speed auto
 no cdp enable
!
interface Serial0/0/0:0
 ip address 65.107.56.34 255.255.255.252
 encapsulation ppp
!
interface Serial0/0/1:0
 ip address 66.237.90.230 255.255.255.252
 encapsulation ppp
!
access-list 101 permit ip 65.106.82.160 0.0.0.31 any
access-list 110 permit ip 67.111.198.128 0.0.0.31 any
!
route-map Second permit 10
 match ip address 101
 set ip next-hop 66.237.90.229
!
route-map First permit 10
 match ip address 110
 set ip next-hop 65.107.56.33

**** AND ****

ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0

Now I thought that Route-Maps override static routes (like the one above).  That is what I was told.  With the above config only the 67 network works flawlessly.  The 65 network does not.  When I remove the last static route, neither network can get out.

What am I missing ?????


Eventually I will have only 1 network, but I have to redo my contract with my service provider, and have them change the routing for incoming traffic.  But for now I just wanted both networks working (as changing IPs for DNS and having that work in 24-48 hours has been more reliable then my service provider **yeek**).

Add a second default route and see what you get, and add a higher cost metric..

ip route 0.0.0.0 0.0.0.0 Serial0/0/1:0 20

I'll try that much later tonight.
Else, change
route-map Second permit 10
 match ip address 101

to
route-map Second permit 10
 set default interface serial0/0/1:0


Have you verified with the ISP that they even have routing enabled for your new 65.x subnet?

FYI, a traceroute from me to your 65.106.82.161 interface stops at XO
207.88.81.86, the same ip that is one hop away from 67.111.198.129

Nor can I get a complete traceroute to your serial 66.237.90.230

What is the status of serial 0/0/1:0 ?
(show interface)
Is there a way to use a fixed font here.. this looks ugly.

inetrouter#show ip int bri
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            67.111.198.129  YES NVRAM  up                    up
FastEthernet0/1            65.106.82.161   YES NVRAM  up                    up
Serial0/0/0:0              65.107.56.34    YES NVRAM  up                    up
Serial0/0/1:0              66.237.90.230   YES NVRAM  up                    up
inetrouter#ping 65.107.56.33

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 65.107.56.33, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
inetrouter#ping 66.237.90.229

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 66.237.90.229, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
Try an extended ping to 66.237.90.229 using Fast 0/1 IP address as source
I still can't ping you. Trace still stops just short..
At this hop
17 65.106.5.34  
18 *
19 *

But, I can trace to .229....
How do I do a ping with a specified source Ip/Interface?
Anything in brackets [x] is default, so just hit enter on each line, except for the Extended commands.


R111#ping
Protocol [ip]:
Target IP address: 66.237.90.229
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 65.106.82.161
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 66.237.90.229, timeout is 2 seconds:
...
Success rate is 0 percent (0/3)
R111#

I still think this is a telco issue that they are not routing back to your subnet through the proper interface...
inetrouter#show run
Building configuration...

Current configuration : 2433 bytes
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
no aaa new-model
ip subnet-zero
no ip source-route
ip tcp synwait-time 10
!
!
ip cef
!
!
no ip bootp server
ip domain name yourdomain.com
no ftp-server write-enable
!
!
!
controller T1 0/0/0
 framing esf
 linecode b8zs
 channel-group 0 timeslots 1-24 speed 64
!
controller T1 0/0/1
 framing esf
 linecode b8zs
 channel-group 0 timeslots 1-24 speed 64
!
!
interface FastEthernet0/0
 ip address 67.111.198.129 255.255.255.224
 ip policy route-map First
 duplex auto
 speed auto
 no cdp enable
!
interface FastEthernet0/1
 ip address 65.106.82.161 255.255.255.224
 ip policy route-map Second
 duplex auto
 speed auto
 no cdp enable
!
interface Serial0/0/0:0
 ip address 65.107.56.34 255.255.255.252
 encapsulation ppp
!
interface Serial0/0/1:0
 ip address 66.237.90.230 255.255.255.252
 encapsulation ppp
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0
ip http server
ip http authentication local
!
!
logging trap debugging
access-list 101 permit ip 65.106.82.160 0.0.0.31 any
access-list 110 permit ip 67.111.198.128 0.0.0.31 any
no cdp run
route-map Second permit 10
 match ip address 101
 set ip next-hop 66.237.90.229
!
route-map First permit 10
 match ip address 110
 set ip next-hop 65.107.56.33
!
!
control-plane
!
scheduler allocate 20000 1000
!
end



inetrouter#ping
Protocol [ip]:
Target IP address: 128.138.213.13
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 67.111.198.129
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 128.138.213.13, timeout is 2 seconds:
Packet sent with a source address of 67.111.198.129
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 48/51/56 ms


inetrouter#ping
Protocol [ip]:
Target IP address: 128.138.213.13
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 65.106.82.161
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 128.138.213.13, timeout is 2 seconds:
Packet sent with a source address of 65.106.82.161
.....
Success rate is 0 percent (0/5)




inetrouter#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
inetrouter(config)#ip route 0.0.0.0 0.0.0.0 Serial0/0/1:0 20
inetrouter(config)#^Z




inetrouter#ping
Protocol [ip]:
Target IP address: 128.138.213.13
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 67.111.198.129
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 128.138.213.13, timeout is 2 seconds:
Packet sent with a source address of 67.111.198.129
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 48/48/52 ms


inetrouter#ping
Protocol [ip]:
Target IP address: 128.138.213.13
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 65.106.82.161
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 128.138.213.13, timeout is 2 seconds:
Packet sent with a source address of 65.106.82.161
.....
Success rate is 0 percent (0/5)



inetrouter#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
inetrouter(config)#no ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0
inetrouter(config)#^Z




inetrouter#ping
Protocol [ip]:
Target IP address: 128.138.213.13
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 67.111.198.129
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 128.138.213.13, timeout is 2 seconds:
Packet sent with a source address of 67.111.198.129
.....
Success rate is 0 percent (0/5)


inetrouter#ping
Protocol [ip]:
Target IP address: 128.138.213.13
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 65.106.82.161
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 128.138.213.13, timeout is 2 seconds:
Packet sent with a source address of 65.106.82.161
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 48/50/52 ms




inetrouter#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
inetrouter(config)#ip route 0.0.0.0 0.0.0.0 Serial0/0/0:0
inetrouter(config)#^Z
inetrouter#exit
So basically:

Ip Route 0.0.0.0 0.0.0.0 Serial0/0/0:0   Makes only the 67.111.198.128 network function.

and

Ip Route 0.0.0.0 0.0.0.0 Serial0/0/1:0   Makes only the 67.111.198.128 network function.

Its definitely on my end, but I don't understand why what is happening is happening.


Please provide output of "sho interface serial 0/0/1:0"
 
What happens if you have both routes, no extra cost on the 2nd one?

ip route 0.0.0.0 0.0.0.0 serial0/0/0:0
ip route 0.0.0.0 0.0.0.0 serial0/0/1:0

I changed my route maps to:

route-map Second permit 10
 match ip address 101
 set interface Serial0/0/1:0
!
route-map First permit 10
 match ip address 110
 set interface Serial0/0/0:0
!

Still the same problem with pinging from the router.  However, I decided to hook up a computer to the 65 network.  And everything is working perfectly.  I can ping (from an external source) to the 65 network except the routers IP, and I can ping (from an external source) all the devices on the 67 network including the router.  So why is ping on the cisco router not functioning the way we expect it to?  Well I don't really care at this point as everything but the 65 IP on the router is routing perfectly.  I'm going to change my route-maps back to the original values at the very top (described below), and if those work, then I believe this case is closed.

route-map Second permit 10
 match ip address 101
 set ip next-hop 66.237.90.229
!
route-map First permit 10
 match ip address 110
 set ip next-hop 65.107.56.33
Yes everyting is working.
lrmoore,

Just so you understand the circumstances, I had a T1.  It went down for 2 weeks, and what it came down to was Sprint not being helpful in the matter (the local carrier).  So to bypass Sprint's crappy repair department, my ISP just ordered me a new T1, and I got it about 2 weeks before Sprint came by to fix the down T1 (it would have been 4 weeks!!!!!).  At the time, the T1 was so cheap we got 2 (and stopped service on the original T1), and were going to implement load-balancing.  However, our contract is only for 2 seperate T1's, so I’m waiting for the new contract, to go to load balancing.  In the mean time, the T1 went down, and I had to switch everything manually (DNS/Firwall NAT) to the other T1.  Yeah, what a pain.  Now I have to switch everything back, but I want both T1 routes working so it will be less painful.  They both are, and I’m very happy.
Glad to hear it's working!
Whew!
lrmoore,

We finally finished binding the two t1's via packet load balancing.  Now both subnets run at 2x T1 speeds.  See how long it took for that too happen!!!!??? It's crazy.  I'm so glad we could get a solution between then and now working so quickly.