Link to home
Start Free TrialLog in
Avatar of 1gtx
1gtx

asked on

Problem with network connectivity in one direction (pings one way not the other)

Can't seem to nail this issue down. Have a fairly simple setup

Internet-----R1-----R2------R3

R1 and R2 are Cisco 3550 EMI (L3) switches 12.2.
R3 is Cisco 3660 Enterprise 12.3

R1 is in BGP AS 100
R2 & R3 are in BGP AS 200 adn EIGRP AS 300

R1 & R2 Running BGP
R2 & R3 Running EIGRP

Can ping between all routers (R1>R2, R1>R3, R2>R1, R2>R3in all directions except R3 to R1. It appears that the packets are getting routed properly to R2, but no response is getting back to R3.

I'm pulling my hair out. Nothing fancy in the configs is going on. Any ideas for a cause?
Avatar of Don Johnston
Don Johnston
Flag of United States of America image

A ping is bidirectional. Simply put, if R1 can ping R3, then R3 can ping R1.

The only thing that will cause the behavior you're describing is either a firewall or an access-list blocking the request in one direction or blocking reply in the other direction. Since there's no firewall between the two, it must be an ACL on one of the three routers. If you look, you'll probably find an ACL that is denying ICMP echo-requests or echo-replies somewhere.
Avatar of 1gtx
1gtx

ASKER

No ACLs used.

It appears to be some kind of routing problem, where the inbound packets for R3 are getting lost between R1 and R2. Can successfully ping from R3 to the inside interface of R1, but not to the outside one (a point to point link).

Maybe it's involves the transition from BGP to EIGRP and 0.0.0.0?
SOLUTION
Avatar of Don Johnston
Don Johnston
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of 1gtx

ASKER

You're right--I was pinging the far side IP address not the inside one.

That leaves a routing problem.

I can ping R1, R2, and R3 from the internet.

I can ping the internet from R1 and R2, but not R3.

This seems to lead to a possible issue with the 0.0.0.0 route not propagating properly from BGP to EIGRP. Correct?

 
Going to have to see the routing table of R3 to go any further.
Have you tried to trace route R3 to R1??
Avatar of 1gtx

ASKER

Trace route from R3 to R1 makes the first hop to R2 but then gets lost (stars)
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of 1gtx

ASKER

Show ip route for R3:

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.127.127.178 to network 0.0.0.0

     X.X.0.0/32 is subnetted, 2 subnets
C       X.X.140.253 is directly connected, Loopback0
D       X.X.140.254
           [90/156160] via 10.127.127.178, 01:31:36, FastEthernet0/1
     10.0.0.0/30 is subnetted, 2 subnets
D       10.1.1.4 [90/30720] via 10.127.127.178, 01:31:36, FastEthernet0/1
C       10.127.127.176 is directly connected, FastEthernet0/1
D*EX 0.0.0.0/0 [170/258816] via 10.127.127.178, 00:01:33, FastEthernet0/1

X.X.140.253 is loopback for R3
X.X.140.254 is loopback for R2
10.1.1.4 is PTP addr for R2 to R1
10.127.127.176 is PTP addr for R2 to R3
Unfortunately, it's going to be rather difficult to troubleshoot without knowing the IP address you're trying to ping and what the routing table looks like.

Avatar of 1gtx

ASKER

Pinging any address on the internet will fail for R3.

Interesting enough I did a debug ip packet and noticed that the IP being used as the source was the outbound interface IP of R3 (10.127.127.178) and not the loopback address for R3 (which I thought was normal?!).

Lo and behold if you change the source IP for ping command on R3 to X.X.140.253 (the loopback addr for R3) pinging the internet from R3 works!

So I guess a quick and dirty approach would be to change the default source address for R3 to the loopback address. Though I'm not sure how to do that.

ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Once again... Impossible to say anything without knowing the addresses.