Solved

cisco ASA - sla/track stays UP even if ping fails

Posted on 2014-10-12
6
782 Views
Last Modified: 2014-11-01
Cisco ASA 5505, 8.2
Dual ISP

I have an sla monitor configured on the backup ISP interface, configured to ping the first pingable IP in a traceroute from that interface.  (Note: I don't use the default gateway on this interface because it is also inside the building and is therefore does not indicate if the ISP is down - I can ping the cable modem even if the cable is down)

If I configure a /32 route to my sla test using the 2nd ISP link gateway, I can ping the IP using the ISP#2 interface.  If I remove the /32 route, the ISP#2 interface *cannot* ping the IP.

The sla monitor never fails and the track always shows as UP - even if I can't ping the IP.

sla monitor 2
type echo protocol ipicmp 1.2.3.4 interface isp2
num-packets 3
timeout 3000
frequency 10
sla monitor schedule 2 lifetime forever start now

track 2 rtr 2 reachability

route isp1 0.0.0.0 0.0.0.0 <isp1-gateway> 1 track 1
route isp2 0.0.0.0 0.0.0.0 <isp2-gateway> 2 track 2
route isp2 1.2.3.4 255.255.255.255 <isp2-gateway>


With the /32 route to 1.2.3.4 in place:
ping isp2 1.2.3.4  <-- WORKS
ping isp1 1.2.3.4 <-- FAILS

remove /32 route to 1.2.3.4:
ping isp2 1.2.3.4 <-- FAILS
ping isp1 1.2.3.4 <-- WORKS
0
Comment
Question by:snowdog_2112
  • 4
  • 2
6 Comments
 

Author Comment

by:snowdog_2112
ID: 40375936
Following up...

In the case where the /32 route is *removed*, isp2 CANNOT ping 1.2.3.4, but the sla monitor/track *which uses isp2* shows as OK and UP.

How can the sla be OK when a ping fails?
0
 
LVL 18

Expert Comment

by:Akinsd
ID: 40383259
Run this commands
show run sla monitor
show ip route track-table
show ip sla statistics
show track

I hope the SLA is not tracking the local interface.
Also check the repeat frequency
0
 

Author Comment

by:snowdog_2112
ID: 40397817
As mentioned in OP, the IP in the SLA is *stops pinging*, but the track still shows as UP.

Again, as mentioned in the OP, I have to add a /32 route on ISP#2 to the SLA IP address (which is beyond the ISP#2 gateway).  With the /32 route in place, I can "ping isp2 <sla-IP>".  If I remove the /32 route, "ping isp2 <sla-ip>" *FAILS*, but the track and SLA both still show as UP.

This is an ASA - there is no "ip route track-table" or "ip sla stat" command.
0
Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

 
LVL 18

Expert Comment

by:Akinsd
ID: 40404104
show sla monitor configuration
show sla monitor operational-state
0
 

Accepted Solution

by:
snowdog_2112 earned 0 total points
ID: 40406899
I've modified the config and don't have an active instance of the route being inaccessible and not pingable, but the SLA/track still showing as Ok/Up.

I will open a new question if I see it again.  Thanks for the replies!
0
 

Author Closing Comment

by:snowdog_2112
ID: 40416989
I can't replicate the issue at the moment, so I am unable to provide additional details.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

790 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question