Solved

cisco ASA - sla/track stays UP even if ping fails

Posted on 2014-10-12
6
793 Views
Last Modified: 2014-11-01
Cisco ASA 5505, 8.2
Dual ISP

I have an sla monitor configured on the backup ISP interface, configured to ping the first pingable IP in a traceroute from that interface.  (Note: I don't use the default gateway on this interface because it is also inside the building and is therefore does not indicate if the ISP is down - I can ping the cable modem even if the cable is down)

If I configure a /32 route to my sla test using the 2nd ISP link gateway, I can ping the IP using the ISP#2 interface.  If I remove the /32 route, the ISP#2 interface *cannot* ping the IP.

The sla monitor never fails and the track always shows as UP - even if I can't ping the IP.

sla monitor 2
type echo protocol ipicmp 1.2.3.4 interface isp2
num-packets 3
timeout 3000
frequency 10
sla monitor schedule 2 lifetime forever start now

track 2 rtr 2 reachability

route isp1 0.0.0.0 0.0.0.0 <isp1-gateway> 1 track 1
route isp2 0.0.0.0 0.0.0.0 <isp2-gateway> 2 track 2
route isp2 1.2.3.4 255.255.255.255 <isp2-gateway>


With the /32 route to 1.2.3.4 in place:
ping isp2 1.2.3.4  <-- WORKS
ping isp1 1.2.3.4 <-- FAILS

remove /32 route to 1.2.3.4:
ping isp2 1.2.3.4 <-- FAILS
ping isp1 1.2.3.4 <-- WORKS
0
Comment
Question by:snowdog_2112
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 

Author Comment

by:snowdog_2112
ID: 40375936
Following up...

In the case where the /32 route is *removed*, isp2 CANNOT ping 1.2.3.4, but the sla monitor/track *which uses isp2* shows as OK and UP.

How can the sla be OK when a ping fails?
0
 
LVL 18

Expert Comment

by:Akinsd
ID: 40383259
Run this commands
show run sla monitor
show ip route track-table
show ip sla statistics
show track

I hope the SLA is not tracking the local interface.
Also check the repeat frequency
0
 

Author Comment

by:snowdog_2112
ID: 40397817
As mentioned in OP, the IP in the SLA is *stops pinging*, but the track still shows as UP.

Again, as mentioned in the OP, I have to add a /32 route on ISP#2 to the SLA IP address (which is beyond the ISP#2 gateway).  With the /32 route in place, I can "ping isp2 <sla-IP>".  If I remove the /32 route, "ping isp2 <sla-ip>" *FAILS*, but the track and SLA both still show as UP.

This is an ASA - there is no "ip route track-table" or "ip sla stat" command.
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
LVL 18

Expert Comment

by:Akinsd
ID: 40404104
show sla monitor configuration
show sla monitor operational-state
0
 

Accepted Solution

by:
snowdog_2112 earned 0 total points
ID: 40406899
I've modified the config and don't have an active instance of the route being inaccessible and not pingable, but the SLA/track still showing as Ok/Up.

I will open a new question if I see it again.  Thanks for the replies!
0
 

Author Closing Comment

by:snowdog_2112
ID: 40416989
I can't replicate the issue at the moment, so I am unable to provide additional details.
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question