Solved

cisco ASA - sla/track stays UP even if ping fails

Posted on 2014-10-12
6
809 Views
Last Modified: 2014-11-01
Cisco ASA 5505, 8.2
Dual ISP

I have an sla monitor configured on the backup ISP interface, configured to ping the first pingable IP in a traceroute from that interface.  (Note: I don't use the default gateway on this interface because it is also inside the building and is therefore does not indicate if the ISP is down - I can ping the cable modem even if the cable is down)

If I configure a /32 route to my sla test using the 2nd ISP link gateway, I can ping the IP using the ISP#2 interface.  If I remove the /32 route, the ISP#2 interface *cannot* ping the IP.

The sla monitor never fails and the track always shows as UP - even if I can't ping the IP.

sla monitor 2
type echo protocol ipicmp 1.2.3.4 interface isp2
num-packets 3
timeout 3000
frequency 10
sla monitor schedule 2 lifetime forever start now

track 2 rtr 2 reachability

route isp1 0.0.0.0 0.0.0.0 <isp1-gateway> 1 track 1
route isp2 0.0.0.0 0.0.0.0 <isp2-gateway> 2 track 2
route isp2 1.2.3.4 255.255.255.255 <isp2-gateway>


With the /32 route to 1.2.3.4 in place:
ping isp2 1.2.3.4  <-- WORKS
ping isp1 1.2.3.4 <-- FAILS

remove /32 route to 1.2.3.4:
ping isp2 1.2.3.4 <-- FAILS
ping isp1 1.2.3.4 <-- WORKS
0
Comment
Question by:snowdog_2112
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 

Author Comment

by:snowdog_2112
ID: 40375936
Following up...

In the case where the /32 route is *removed*, isp2 CANNOT ping 1.2.3.4, but the sla monitor/track *which uses isp2* shows as OK and UP.

How can the sla be OK when a ping fails?
0
 
LVL 18

Expert Comment

by:Akinsd
ID: 40383259
Run this commands
show run sla monitor
show ip route track-table
show ip sla statistics
show track

I hope the SLA is not tracking the local interface.
Also check the repeat frequency
0
 

Author Comment

by:snowdog_2112
ID: 40397817
As mentioned in OP, the IP in the SLA is *stops pinging*, but the track still shows as UP.

Again, as mentioned in the OP, I have to add a /32 route on ISP#2 to the SLA IP address (which is beyond the ISP#2 gateway).  With the /32 route in place, I can "ping isp2 <sla-IP>".  If I remove the /32 route, "ping isp2 <sla-ip>" *FAILS*, but the track and SLA both still show as UP.

This is an ASA - there is no "ip route track-table" or "ip sla stat" command.
0
Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

 
LVL 18

Expert Comment

by:Akinsd
ID: 40404104
show sla monitor configuration
show sla monitor operational-state
0
 

Accepted Solution

by:
snowdog_2112 earned 0 total points
ID: 40406899
I've modified the config and don't have an active instance of the route being inaccessible and not pingable, but the SLA/track still showing as Ok/Up.

I will open a new question if I see it again.  Thanks for the replies!
0
 

Author Closing Comment

by:snowdog_2112
ID: 40416989
I can't replicate the issue at the moment, so I am unable to provide additional details.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
Powerful tools can do wonders, but only in the right hands.  Nowhere is this more obvious than with the cloud.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question