Solved

cisco ASA - sla/track stays UP even if ping fails

Posted on 2014-10-12
6
745 Views
Last Modified: 2014-11-01
Cisco ASA 5505, 8.2
Dual ISP

I have an sla monitor configured on the backup ISP interface, configured to ping the first pingable IP in a traceroute from that interface.  (Note: I don't use the default gateway on this interface because it is also inside the building and is therefore does not indicate if the ISP is down - I can ping the cable modem even if the cable is down)

If I configure a /32 route to my sla test using the 2nd ISP link gateway, I can ping the IP using the ISP#2 interface.  If I remove the /32 route, the ISP#2 interface *cannot* ping the IP.

The sla monitor never fails and the track always shows as UP - even if I can't ping the IP.

sla monitor 2
type echo protocol ipicmp 1.2.3.4 interface isp2
num-packets 3
timeout 3000
frequency 10
sla monitor schedule 2 lifetime forever start now

track 2 rtr 2 reachability

route isp1 0.0.0.0 0.0.0.0 <isp1-gateway> 1 track 1
route isp2 0.0.0.0 0.0.0.0 <isp2-gateway> 2 track 2
route isp2 1.2.3.4 255.255.255.255 <isp2-gateway>


With the /32 route to 1.2.3.4 in place:
ping isp2 1.2.3.4  <-- WORKS
ping isp1 1.2.3.4 <-- FAILS

remove /32 route to 1.2.3.4:
ping isp2 1.2.3.4 <-- FAILS
ping isp1 1.2.3.4 <-- WORKS
0
Comment
Question by:snowdog_2112
  • 4
  • 2
6 Comments
 

Author Comment

by:snowdog_2112
ID: 40375936
Following up...

In the case where the /32 route is *removed*, isp2 CANNOT ping 1.2.3.4, but the sla monitor/track *which uses isp2* shows as OK and UP.

How can the sla be OK when a ping fails?
0
 
LVL 18

Expert Comment

by:Akinsd
ID: 40383259
Run this commands
show run sla monitor
show ip route track-table
show ip sla statistics
show track

I hope the SLA is not tracking the local interface.
Also check the repeat frequency
0
 

Author Comment

by:snowdog_2112
ID: 40397817
As mentioned in OP, the IP in the SLA is *stops pinging*, but the track still shows as UP.

Again, as mentioned in the OP, I have to add a /32 route on ISP#2 to the SLA IP address (which is beyond the ISP#2 gateway).  With the /32 route in place, I can "ping isp2 <sla-IP>".  If I remove the /32 route, "ping isp2 <sla-ip>" *FAILS*, but the track and SLA both still show as UP.

This is an ASA - there is no "ip route track-table" or "ip sla stat" command.
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 18

Expert Comment

by:Akinsd
ID: 40404104
show sla monitor configuration
show sla monitor operational-state
0
 

Accepted Solution

by:
snowdog_2112 earned 0 total points
ID: 40406899
I've modified the config and don't have an active instance of the route being inaccessible and not pingable, but the SLA/track still showing as Ok/Up.

I will open a new question if I see it again.  Thanks for the replies!
0
 

Author Closing Comment

by:snowdog_2112
ID: 40416989
I can't replicate the issue at the moment, so I am unable to provide additional details.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now