FlexVPN Cannot Ping From Spoke LAN only

Topology:
Hub:
(hub lan: 10.0.1.0/24) > (lan int [ip nat inside], g0/0: 10.0.1.1) > (flex interface, loopback100: 172.31.100.1) > (flex virtual interface, Virtual-Template1: ip unnumbered loopback100) > (wan int [ip nat outside], dialer0 - g0/1) > ISP
Spoke:
(hub lan: 10.0.3.0/24) > (lan int [ip nat inside], vlan1: 10.0.3.1) > (flex interface, Tunnel0 ip address negotiated, tunnel source vlan 1) > (wan int, dialer0 [ip nat inside] - f0/4) > ISP
I have full reachability from both routers.
Hub router can ping 172.31.100.x, 10.0.3.1 and hosts on 10.0.3.0/24 via standard ping, or extended and sourced from 10.0.1.1 or g0/0
Spoke router can ping 172.31.100.1, 10.0.1.1 and hosts on 10.0.1.0/24 via standard ping, or extended and sourced from 10.0.3.1 or vlan1
Partial reachability from lan hosts
Hub hosts can ping 172.31.100.x and 10.0.3.1, but not hosts on 10.0.3.0/24 (Possibly because host cannot reply to echo request?)
Spoke hosts cannot ping 172.31.100.1, 10.0.1.1 or hosts on 10.0.1.0/24
Any help would be appreciated

We've been working with these confs for a while, so they aren't as clean as they could be, but here they are
---HUB---
version 15.2
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname HUB
boot-start-marker
boot system flash:c1900-universalk9-mz.SPA.152-4.M5.bin
boot-end-marker
security authentication failure rate 3 log
security passwords min-length 6
enable secret xxxxx
aaa new-model
aaa group server radius FLEXVPN_AUTH-C_SERVER_GROUP
server-private 10.0.1.15 key xxxxx
aaa authentication login default local
aaa authentication login xxxxxVPN_VPN_XAUTH local
aaa authentication login FLEXVPN_AUTH-C_LIST group FLEXVPN_AUTH-C_SERVER_GROUP
aaa authorization exec default local
aaa authorization network default local
aaa authorization network xxxxxVPN_VPN_GROUP local
aaa authorization network FLEXVPN_AUTH-Z_LIST local
aaa session-id common
clock timezone CST -6 0
clock summer-time CDT recurring
clock calendar-valid
no ip source-route
no ip gratuitous-arps
ip cef
no ip bootp server
ip domain name xxxxx.net
ip name-server 166.102.165.13
ip name-server 166.102.165.11
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip name-server 4.2.2.1
no ipv6 cef
multilink bundle-name authenticated
vpdn enable
vpdn-group VPN_GROUP
key chain EIGRP_KEY_CHAIN
key 1
key-string xxxxx
crypto pki trustpoint FLEXVPN_RA_TP
enrollment terminal
serial-number none
fqdn vpn.xxxxx.net
ip-address none
subject-name cn=vpn.xxxxx.net
revocation-check crl
eckeypair FLEXVPN_RA_TP-Key
crypto pki certificate chain FLEXVPN_RA_TP
certificate 460000.. nvram:xxxxx#2.cer
certificate ca 59A43A15.. nvram:xxxxx#BC60CA.cer
license udi pid CISCO1921/K9 sn xxxxx
archive
path ftp://xxxxx
write-memory
username xxxxx privilege 15 password xxxxx
redundancy
crypto ikev2 authorization policy default
pool FLEX_SPOKES_POOL
route set interface
crypto ikev2 authorization policy FLEXVPN_RA_LOCAL_POLICY
pool FLEXVPN_RA_POOL
dns 10.0.1.15
netmask 255.255.255.0
def-domain xxxxx.net
route set access-list FLEXVPN_RA_ACL
crypto ikev2 proposal SHA1-only
encryption aes-cbc-256
integrity sha1
group 5
crypto ikev2 policy SHA1-only
match fvrf any
proposal SHA1-only
crypto ikev2 keyring FLEX_KEY
peer ALL
address 0.0.0.0 0.0.0.0
pre-shared-key local xxxxx
pre-shared-key remote xxxxx
crypto ikev2 profile FLEX_IKEv2
match identity remote address 0.0.0.0
authentication remote pre-share
authentication local pre-share
keyring local FLEX_KEY
aaa authorization group psk list default default
virtual-template 1
crypto ikev2 profile FLEXVPN_RA_IKEv2_PROFILE
match identity remote key-id xxxxx.net
identity local dn
authentication remote eap query-identity
authentication local rsa-sig
pki trustpoint FLEXVPN_RA_TP
dpd 60 2 on-demand
aaa authentication eap FLEXVPN_AUTH-C_LIST
aaa authorization group eap list FLEXVPN_AUTH-Z_LIST FLEXVPN_RA_LOCAL_POLICY
virtual-template 10
crypto ikev2 dpd 30 5 on-demand
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
crypto logging session
crypto isakmp client configuration group xxxxxVPN
key xxxxx
pool xxxxxVPN_POOL
acl xxxxxVPN_ACL
netmask 255.255.255.0
crypto isakmp profile xxxxxVPN_IKE_PROFILE
   match identity group xxxxxVPN
   client authentication list xxxxxVPN_VPN_XAUTH
   isakmp authorization list xxxxxVPN_VPN_GROUP
   client configuration address respond
   virtual-template 100
crypto ipsec transform-set xxxxxVPN_SET esp-3des esp-sha-hmac
mode tunnel
crypto ipsec transform-set IKEv2 esp-gcm
mode transport
crypto ipsec profile xxxxxVPN_IPSEC_PROFILE
set transform-set xxxxxVPN_SET
set isakmp-profile xxxxxVPN_IKE_PROFILE
crypto ipsec profile FLEXVPN_RA_IPSEC_PROFILE
set ikev2-profile FLEXVPN_RA_IKEv2_PROFILE
crypto ipsec profile default
set transform-set IKEv2
set ikev2-profile FLEX_IKEv2
interface Loopback100
ip address 172.31.100.1 255.255.255.255
interface Embedded-Service-Engine0/0
no ip address
shutdown
interface GigabitEthernet0/0
ip address 10.0.1.1 255.255.255.0
no ip unreachables
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
interface Virtual-Template1 type tunnel
description FlexVPN hub-to-spokes
ip unnumbered Loopback100
ip mtu 1400
ip nhrp network-id 1
ip nhrp redirect
ip tcp adjust-mss 1360
tunnel path-mtu-discovery
tunnel protection ipsec profile default
interface Virtual-Template10 type tunnel
ip unnumbered GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel protection ipsec profile FLEXVPN_RA_IPSEC_PROFILE
interface Dialer0
mtu 1492
ip address negotiated
no ip unreachables
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1450
dialer pool 1
dialer idle-timeout 0
dialer persistent
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname [email protected]
ppp chap password xxxxx
ppp pap sent-username [email protected] password xxxxx
no cdp enable
router eigrp 1
distribute-list EIGRP_SUMMARY_PFLIST out Virtual-Template1
network 10.0.1.0 0.0.0.255
network 172.30.200.0 0.0.0.255
network 172.31.100.1 0.0.0.0
passive-interface GigabitEthernet0/0
ip local pool xxxxxVPN_POOL 172.30.255.1 172.30.255.254
ip local pool FLEX_SPOKES_POOL 172.31.100.10 172.31.100.254
ip local pool FLEXVPN_RA_POOL 172.30.200.1 172.30.200.254
ip forward-protocol nd
no ip http server
no ip http secure-server
ip dns server
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 172.30.200.0 255.255.255.0 Null0
ip access-list standard FLEXVPN_RA_ACL
permit 10.0.1.0 0.0.0.255
permit 10.0.2.0 0.0.0.255
permit 10.0.3.0 0.0.0.255
permit 10.0.4.0 0.0.0.255
ip access-list standard MGMT_ACL
permit 172.30.200.0 0.0.0.255
permit 172.31.254.0 0.0.0.255
permit 10.0.1.0 0.0.0.255
ip access-list extended xxxxxVPN_ACL
permit ip 172.30.255.0 0.0.0.255 any
permit ip 10.0.1.0 0.0.0.255 any
permit ip 172.31.254.0 0.0.0.255 any
ip prefix-list EIGRP_SUMMARY_PFLIST seq 10 permit 10.0.1.0/24
ip prefix-list EIGRP_SUMMARY_PFLIST seq 20 permit 172.30.200.0/24
ip prefix-list EIGRP_SUMMARY_PFLIST seq 30 permit 172.31.100.1/32
access-list 1 permit 10.0.1.0 0.0.0.255
route-map EIGRP_SUMMARY_RMAP permit 10
match ip address prefix-list EIGRP_SUMMARY_PFLIST
control-plane
banner motd Cxxxxx
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class MGMT_ACL in
privilege level 15
transport input telnet ssh
line vty 5 15
transport input all
scheduler allocate 20000 1000
ntp update-calendar
ntp server 1.pool.ntp.org
ntp server 0.pool.ntp.org prefer
end
---SPOKE---
version 15.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname SPOKE
boot-start-marker
boot system flash:c880data-universalk9-mz.152-4.M5.bin
boot-end-marker
security authentication failure rate 3 log
security passwords min-length 6
enable secret xxxxx
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa authorization network default local
aaa session-id common
memory-size iomem 10
clock timezone CST -6 0
clock summer-time CDT recurring
clock calendar-valid
no ip source-route
no ip gratuitous-arps
no ip bootp server
ip domain name xxxxx.net
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip name-server 4.2.2.1
ip cef
no ipv6 cef
multilink bundle-name authenticated
key chain EIGRP_KEY_CHAIN
key 1
key-string xxxxx
license udi pid CISCO881-SEC-K9 sn FTX1740854N
archive
path ftp://xxxxx
write-memory
username xxxxx privilege 15 password xxxxx
crypto ikev2 authorization policy default
route set interface
crypto ikev2 keyring FLEX_KEY
peer ALL
address 0.0.0.0 0.0.0.0
pre-shared-key local xxxxx
pre-shared-key remote xxxxx
crypto ikev2 profile FLEX_IKEv2
match identity remote address 0.0.0.0
authentication remote pre-share
authentication local pre-share
keyring local FLEX_KEY
aaa authorization group psk list default default
virtual-template 1
crypto ikev2 dpd 30 5 on-demand
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
crypto ipsec transform-set IKEv2 esp-gcm
mode transport
crypto ipsec profile default
set transform-set IKEv2
set ikev2-profile FLEX_IKEv2
interface Loopback101
ip address 172.31.101.3 255.255.255.255
interface Tunnel0
description FlexVPN tunnel
ip address negotiated
ip mtu 1400
ip nhrp network-id 1
ip nhrp shortcut virtual-template 1
ip nhrp redirect
ip tcp adjust-mss 1360
delay 1000
tunnel source Vlan1
tunnel destination x.x.x.x
tunnel path-mtu-discovery
tunnel protection ipsec profile default
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface FastEthernet4
ip address dhcp
no ip unreachables
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
interface Virtual-Template1 type tunnel
description FlexVPN spoke-to-spoke
ip unnumbered Loopback101
ip nhrp network-id 1
ip nhrp shortcut virtual-template 1
ip nhrp redirect
tunnel protection ipsec profile default
interface Vlan1
ip address 10.0.3.1 255.255.255.0
ip helper-address 10.0.1.15
no ip unreachables
ip nat inside
ip virtual-reassembly in
ip forward-protocol nd
no ip http server
no ip http secure-server
ip dns server
ip nat inside source list INTERNET_BOUND_ACL interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 dhcp
ip access-list standard INTERNET_BOUND_ACL
permit 10.0.3.0 0.0.0.255
ip access-list standard MGMT_ACL
permit 172.30.255.0 0.0.0.255
permit 172.31.100.0 0.0.0.255
permit 10.0.1.0 0.0.0.255
permit 10.0.3.0 0.0.0.255
permit 172.30.200.0 0.0.0.255
access-list 99 permit 10.0.3.0
control-plane
banner motd xxxxx
line con 0
no modem enable
line aux 0
line vty 0 4
access-class MGMT_ACL in
privilege level 15
transport input telnet ssh
ntp update-calendar
ntp server 0.pool.ntp.org prefer
ntp server 1.pool.ntp.org
end

Similar Messages

Cannot ping from zone or ping zone from another server

Hi all,
I've just setup a zone, configured the OS on it and booted it.
1) From the global zone I can ping the zone
2) From another server(s) I cannot ping the zone although I can ping the global zone
3) From the zone I cannot even ping the global zone let alone anything else
Any ideas whats gone wrong. the zone xml looks like:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE zone PUBLIC "-//Sun Microsystems Inc//DTD Zones//EN" "file:///usr/share/lib/xml/dtd/zonecfg.dtd.1">

<zone name="ivcp0.lon.oss.colt.net" zonepath="/zones/ivcp0.lon.oss.colt.net" autoboot="true">
<inherited-pkg-dir directory="/lib"/>
<inherited-pkg-dir directory="/platform"/>
<inherited-pkg-dir directory="/sbin"/>
<inherited-pkg-dir directory="/usr"/>
<inherited-pkg-dir directory="/opt/sfw"/>
<filesystem special="/home" directory="/home" type="lofs"/>
<network address="212.74.77.211/25" physical="bge1"/>
</zone>
zoneadm list -vc
ID NAME STATUS PATH
0 global running /
2 ptl1.lon.oss.colt.net running /zones/ptl1.lon.oss.colt.net
3 ptl1.dev.lon.oss.colt.net running /zones/ptl1.dev.lon.oss.colt.net
7 ivcp0.lon.oss.colt.net running /zones/ivcp0.lon.oss.colt.net

Might help to send along the "ifconfig -a" and "netstat -rnv" output from both the global zone and the local zones that are having problems.
Traceroute might also help you isolate the problem

2851 router vpn to 851 router lan clients cannot ping

Greets - I'm expanding my lab experience by adding a 2851 router to my mix of 18xx and 851/871 units. Some of this infrastructure is in production, some just lab work. I have established good connectivity between 18xx's and 851/871's with IPSEC VPNs (site-to-site static and dynamic), but my problem is with adding in a 2851.
Setup: 2851 with 12.4 ADVENTK9, WAN on GE0/0 as 216.189.223.bbb/26, LAN on GE0/1 as 172.20.0.1/20 (VPN module, but no additional HWIC modules)
851 with 12.4 ADVENTK9, WAN on FE4 as 216.53.254.aaa/24, LAN on FE0..3 via BVI1 as 172.21.1.1/24
The two router WAN ports are bridged via a 3rd router (a Zywall with 216.0.0.0/8 route, with the router at 216.1.1.1) affectionately called the "InterNOT", which provides a surrogate to the great web, minus actual other hosts and dns, but it doesn't matter. As both my WAN addresses are within 216.x.x.x, this works quite well. This surrogate has tested fine and is known to not be part of a problem.
The 851 has been tested against another 851 with complementary setup and a successful VPN can run between the two.
I have good LAN-WAN connections on each router. I do have a "Good" VPN connection between the two routers.
The problem: I cannot ping from a LAN host on 172.20.x.x on the 2851 to any 172.21.1.x (eg 172.21.1.1) host on the 851, and vice versa.
From a LAN host, I can ping to my InterNOT - for example a dhcp host 172.20.6.2 on the 2851 LAN can ping 216.1.1.1 fine. I can also ping the 851's WAN address at 216.53.254.aaa.
To complicate matters, if I connect to the routers via console, I CAN ping across the vpn to the destination LAN hosts, in both directions.
This seems to indicate that there is a bridging problem between the LAN interfaces to the VPN interfaces. I suspect this is a config problem on the 2851, as I have had a similar config working on my 851 to 851 site-to-site setups. I also suspect it is in the 2851's config as I'm still just starting out with this particular router.
So some stripped-down configs:
For the 2851:
no service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname router2851
boot-start-marker
boot-end-marker
no logging buffered
no logging console
enable password mypassword2
no aaa new-model
dot11 syslog
no ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 172.20.0.1 172.20.6.1
ip dhcp excluded-address 172.20.6.254 172.20.15.254
ip dhcp pool Internal_2000
   import all
   network 172.20.0.0 255.255.240.0
   domain-name myseconddomain.int
   default-router 172.20.0.1
   lease 7
no ip domain lookup
multilink bundle-name authenticated
voice-card 0
no dspfarm
crypto pki <<truncated>>
crypto pki certificate chain TP-self-signed-2995823027
<<truncated>>
   quit
username myusername privilege 15 password 0 mypassword2
archive
log config
hidekeys
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key mysharedkey address 216.53.254.aaa
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to216.53.254.aaa
set peer 216.53.254.aaa
set transform-set ESP-3DES-SHA
match address 100
interface GigabitEthernet0/0
description $ETH-WAN$
ip address 216.189.223.bbb 255.255.255.192
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map SDM_CMAP_1
no shut
interface GigabitEthernet0/1
description $FW_INSIDE$$ETH-LAN$
ip address 172.20.0.1 255.255.240.0
ip nat inside
ip virtual-reassembly
no ip route-cache
duplex auto
speed auto
no mop enabled
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
ip http server
ip http authentication local
ip http secure-server
ip dns server
ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 172.20.0.0 0.0.15.255
access-list 100 remark CCP_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
access-list 101 remark CCP_ACL Category=2
access-list 101 remark IPSec Rule
access-list 101 deny   ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
access-list 101 permit ip 172.20.0.0 0.0.15.255 any
route-map SDM_RMAP_1 permit 1
match ip address 101
control-plane
banner motd ~This is a private computer system for authorized use only. And Stuff~
line con 0
line aux 0
line vty 0 4
privilege level 15
password mypassword
login local
transport input telnet ssh
scheduler allocate 20000 1000
end
And for the 851:
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname router851
boot-start-marker
boot-end-marker
logging buffered 52000 debugging
no logging console
enable password mypassword
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa session-id common
resource policy
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
no ip dhcp use vrf connected
ip dhcp excluded-address 172.21.1.1 172.21.1.100
ip dhcp pool Internal_2101
   import all
   network 172.21.1.0 255.255.255.0
   default-router 172.21.1.1
   domain-name mydomain.int
   dns-server 172.21.1.10
   lease 4
ip cef
ip domain name mydomain.int
ip name-server 172.21.1.10
crypto pki <<truncated>>
crypto pki certificate chain TP-self-signed-3077836316
<<truncated>>
quit
username myusername privilege 15 password 0 mypassword2
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key mysharedkey address 216.189.223.aaa
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to216.189.223.bbb
set peer 216.189.223.bbb
set transform-set ESP-3DES-SHA2
match address 100
bridge irb
interface FastEthernet0
spanning-tree portfast
interface FastEthernet1
spanning-tree portfast
interface FastEthernet2
spanning-tree portfast
interface FastEthernet3
spanning-tree portfast
interface FastEthernet4
description $ETH-WAN$
ip address 216.53.254.aaa 255.255.254.0
ip nat outside
ip virtual-reassembly
ip tcp adjust-mss 1460
duplex auto
speed auto
no cdp enable
crypto map SDM_CMAP_1
no shut
interface Vlan1
description Internal Network
no ip address
ip nat inside
ip virtual-reassembly
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
description Bridge to Internal Network
ip address 172.21.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip route 0.0.0.0 0.0.0.0 FastEthernet4
ip route 172.21.1.0 255.255.255.0 BVI1
ip http server
ip http secure-server
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overload
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 172.21.1.0 0.0.0.255
access-list 100 remark CCP_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
access-list 101 remark CCP_ACL Category=2
access-list 101 remark IPSec Rule
access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
access-list 101 remark IPSec Rule
access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.21.101.0 0.0.0.31
access-list 101 permit ip 172.21.1.0 0.0.0.255 any
route-map SDM_RMAP_1 permit 1
match ip address 101
control-plane
bridge 1 route ip
banner motd ~This is a private computer system for authorized use only. And Stuff.~
line con 0
password mypassword
no modem enable
line aux 0
line vty 0 4
password mypassword
scheduler max-task-time 5000
end
Note that the above are somewhat stripped-down configs, without firewall or WAN ACL's - interestingly my default WAN-Inbound ACLs seem to break connectivity when included, so I realize I have some more cleanup to do there, but the 2851 LAN bridging seems to be what I should concentrate on first.
I'm still googling some of the particulars with the 2851, but any assistance is appreciated.
Regards,
Ted.

Hi,
First,please delete NAT.If we configured the NAT in the RRAS,the source IP address in all packets sent to 192.168.1.0/24 would be translated to 192.168.1.224.
Second,please enable the LAN routing in RRAS server.To enable LAN routing,please follow the steps below,
1.In the RRAS server,Open Routing and Remote Access.
2.Right-click the server name,then click
properties.
3.On the General tab,select
IPv4 Router check box,and then click Local area network(LAN) routing only.
Then,announce the 172.16.0.0 network to the router.
To learn more details about enabling LAN routing, please refer to the link below,
http://technet.microsoft.com/en-us/library/dd458974.aspx
Best Regards,
Tina

Cannot ping IAS RADIUS from WLC 2504

I'm having some weird issues where I cannot ping from the WLC to the IAS RADIUS server. All of my clients cannot connect, but from the switch, router, RADIUS server, and hard wired clients, I can ping to the WLC and RADIUS server. The only thing that cannot ping the RADIUS server is the WLC itself. Nothing in the FW is blocking connectivity. Any ideas?
(Cisco Controller) >show radius summ
Vendor Id Backward Compatibility................. Disabled
Call Station Id Case............................. lower
Call Station Id Type............................. IP Address
Aggressive Failover.............................. Disabled
Keywrap.......................................... Disabled
Fallback Test:
    Test Mode.................................... Off
    Probe User Name.............................. cisco-probe
    Interval (in seconds)........................ 300
MAC Delimiter for Authentication Messages........ none
MAC Delimiter for Accounting Messages............ hyphen
Authentication Servers
Idx Type Server Address    Port    State     Tout RFC3576 IPSec - AuthMode/Phase1/Group/Lifetime/Auth/Encr
1    NM    10.10.50.63       1645    Enabled   5     Enabled   Disabled - none/unknown/group-0/0 none/none
2    NM    10.10.50.130      1645    Enabled   5     Enabled   Disabled - none/unknown/group-0/0 none/none
Accounting Servers
Idx Type Server Address    Port    State     Tout RFC3576 IPSec - AuthMode/Phase1/Group/Lifetime/Auth/Encr
1      N     10.10.50.63       1646    Enabled   5     N/A       Disabled - none/unknown/group-0/0 none/none
2      N     10.10.50.130      1646    Enabled   5     N/A       Disabled - none/unknown/group-0/0 none/none

It's in the arp cache through the default router
(Cisco Controller) >show interface detailed management
Interface Name................................... management
MAC Address...................................... d0:c2:82:df:5b:c0
IP Address....................................... 10.30.72.250
IP Netmask....................................... 255.255.255.0
IP Gateway....................................... 10.30.72.1
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. untagged
Quarantine-vlan.................................. 0
Active Physical Port............................. 1
Primary Physical Port............................ 1
Backup Physical Port............................. Unconfigured
Primary DHCP Server.............................. 10.10.10.65
Secondary DHCP Server............................ Unconfigured
DHCP Option 82................................... Disabled
ACL.............................................. Unconfigured
AP Manager....................................... Yes
Guest Interface.................................. No
L2 Multicast..................................... Disabled
(Cisco Controller) >show arp switch
Number of arp entries................................ 19
    MAC Address        IP Address     Port   VLAN   Type
50:57:A8:D6:DE:C0   10.10.19.1       1      5      Host
50:57:A8:D6:DE:C0   10.10.20.138     1      5      Host
50:57:A8:D6:DE:C0   10.10.50.63      1      5      Host
64:00:F1:08:A0:D0   10.30.72.1       1      0      Host
50:57:A8:9E:B5:CD   10.30.72.40      1      0      Host
50:57:A8:A1:7B:C5   10.30.72.44      1      0      Host
50:57:A8:9E:99:78   10.30.72.48      1      0      Host
50:57:A8:3B:66:E3   10.30.72.49      1      0      Host
00:07:7D:43:23:DA   10.30.72.58      1      0      Host
50:57:A8:9E:B6:1D   10.30.72.59      1      0      Host
50:57:A8:9E:95:C5   10.30.72.60      1      0      Host
50:57:A8:A1:7C:0D   10.30.72.61      1      0      Host
00:07:7D:65:36:DD   10.30.72.62      1      0      Host
50:57:A8:44:57:0C   10.30.72.63      1      0      Host
50:57:A8:CA:CC:01   10.30.72.64      1      0      Host

VirualBox cannot ping to Vista

Hello,
I installed an Ubuntu virtual machine (VirtualBox) on Windows Vista. My problem is that I cannot ping from Ubuntu to Vista . But from Vista, I can ping to the virtual machine.
Indeed, for the network configuration of the virtual machine, I use Access by bridge. In addition, I have fixed my IP address ubuntu.
Thank you for helping me.

Hi,
please post from your guest:
route -n
and
cat /etc/resolv.conf
And btw Firewall on Windows is deactivated?
Regards
Sebastian

Cannot ping home computers

I recently replaced my old Linksys router (BEFSR41) with a WRT150N. With my old router, all computers could access each other and share files/printers. With the new router in place, I cannot ping from one workstation to another. The workstations can access the Internet with no issues. I did not change anything on the workstations. Any ideas?

This is usually a computer firewall problem. The firewall sees the new router as a new network (which it is), and assumes that it cannot trust any other computer on the network -- therefore it blocks all pings. You will need to go into each computer firewall, and tell it to trust the other computers on your network.

I can SSH from the outside but cannot ping ISP gateway from 2911

Hello all,
I came across a rather strange issue. I am able to SSH to the device from my home but while I am consoled in, I cannot ping the ISP gateway or any other IP's. As expected, all trace-routes fail without hitting the gateway as the first hop. I have been reading about the NVI0 interface and I decided to use it. Most of the sample cofigs on here use the "old" ip nat inside / outside on the appropriate interfaces. What do you guys suggest?
Here is the running config. It is rather simple since i did not add all the access-lists except the ones I thought necessary to test the circuit. Please point out any mistakes or errors. Thanks in advance!
Current configuration : 1679 bytes
! Last configuration change at 04:05:17 UTC Fri Sep 12 2014
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname StandbyGZ-2911
boot-start-marker
boot-end-marker
enable secret 5 $1$BRaM$igChPMXLeHjgYR7EGk/Nb/
no aaa new-model
no ipv6 cef
no ip source-route
ip cef
no ip domain lookup
ip domain name StandbyGZ.local
ip name-server 211.136.20.203
ip name-server 211.139.136.68
multilink bundle-name authenticated
license udi pid CISCO2911/K9 sn FGL174410H9
username StandbyGZ secret 5 $1$CXWC$m6kqTGbf0HDLCvkfU7.RA/
ip ssh version 2
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
interface GigabitEthernet0/1
description UPLINK TO CHINA MOBILE
ip address 183.x.x.x 255.255.255.128
ip access-group REMOTE-ADMIN-ACL in
no ip redirects
ip nat enable
duplex auto
speed auto
interface GigabitEthernet0/2
description CONNECTION TO LAN SWITCH 3650-CORE
ip address 10.10.1.254 255.255.254.0
no ip redirects
ip nat enable
duplex auto
speed auto
ip forward-protocol nd
no ip http server
no ip http secure-server
ip nat source list LAN-NAT-ACL interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 183.x.x.x
ip access-list standard LAN-NAT-ACL
permit 10.10.0.0 0.0.1.255
ip access-list extended REMOTE-ADMIN-ACL
permit tcp host 68.107.195.213 any eq 22 log
control-plane
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
exec-timeout 0 0
logging synchronous
login local
transport input ssh
transport output ssh
scheduler allocate 20000 1000
end
StandbyGZ-2911# sh ip int br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES NVRAM   administratively down down
GigabitEthernet0/1 183.x.x.x YES NVRAM   up up
GigabitEthernet0/2 10.10.1.254 YES NVRAM   up up
NVI0 183.x.x.x YES unset up up
StandbyGZ-2911#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 183.233.184.129 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 183.233.184.129
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.10.0.0/23 is directly connected, GigabitEthernet0/2
L 10.10.1.254/32 is directly connected, GigabitEthernet0/2
183.233.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 183.x.x.x/25 is directly connected, GigabitEthernet0/1
L 183.x.x.x/32 is directly connected, GigabitEthernet0/1

Hi Chris,
That is what how I am used to configure the NAT, but IOS 12.3 and on introduced interface NVI0, which according to cisco documentation should make applying the NAT statements "easier". IP nat enable has to be enabled on all interfaces and then NVI0 makes the "inside" and "outside" decisions. I was hoping that someone could clarify the real use of that NVI0 interface and if it causes problems. Apparently it cannot be removed from the config.

Cannot ping LAN IP Address but can ping WAN IP Address. Please help

I have LinkSys Wireless Access Point Router, after I upgrade the firmware from another router I can ping the WAN IP ADdress but I cannot ping the LAN IP address, please help.
thanks

I have two Networks here.
1st Network (6th Floor)
-- I have Cisco VPN Concentrator, Cisco Router and 3Com Switches
-- My PDC Server also located
-- IP Range 10.11.10.x
-- Gateway 10.11.10.6
2nd Network (10th FLoor)
-- I have Linksys Wireless (WIreless G Broadband Rotuer w/4 Port Switch Model: WRT54G)
-- I have 3Com Switch
-- The Internet Port of the Linksys is connected directly to 6th floor 3com switch
-- The Lan Port of the Linksys is connected to the 10th FLoor 3com switch then the server and workstations all connected to the 10th Floor 3 Com Switch
-- IP Range 192.168.85.x
-- Gateway 192.168.85.1
-- Internet IP Address of the Wireless
  IP: 10.11.10.11
SM: 255.255.255.0
  GW: 10.11.10.6
-- Local IP Address of the Wireless
  IP: 192.168.85.1
SM: 255.255.255.0
Firmware: 4.21.1
This what happen
1) Users, SErvers, computers located at 10Th Floor dont have a problem connecting to the servers and computers at 6th Floor (10.11.10.x)
2) Users, Servers and computers located at 6th Floor CANNOT CONNECT to the Servers, computers located at 10th FLoor
3) After firmware upgrade, servers and computer can ping Linksys Internet IP of 10.11.10.11
What we require.
WE NEED TO CONNECT COMPUTERS, SERVERS FROM 6TH FLOOR TO 10TH FLOOR AS WELL. MEANING WE WANT BOTH NETWORK PING OR SEE EACH OTHER
YOUR HELP IS GREATLY APPRECIATED
THANKS A LOT
CYNTHIA

IPV6 clients cannot ping each other while getting IP from DHCP server running in windows 2008

I have two windows 7 clients and a windows 2008 server connected to a switch with static IP 172:16:5::1/64.
DHCP server is configured with static IP 172:16:5::20/64
when i statically assign IP to windows 7 clients like 172:16:5::21 & ::22, they can ping each other. if they get ip from DHCP server, they cannot ping each other.
if i configure the gateway (172:16:5::1) in the clients manually, they can ping each other.
is there any way we can make dhcp server to give gateway to the clients along with IP?

From what I have gathered:
IPv6 won't route because the DHCP server is setup in 'stateless' mode and the switches do not support IPv6. (
"But if your routers are not IPv6 supported (yet), you can
reconfigure DHCPv6 to Disable Stateless mode, and that'll issue IPv6 addresses that
will eliminate the Ping problem." -
http://www.networkworld.com/article/2228461/microsoft-subnet/setting-up-dhcpv6-to-dynamically-issue-ipv6-addresses-in-a-network.html)
So you must change to 'disable stateless' mode. Which the only way I can THINK to do this is to uninstall DHCP and reinstall DHCP and select 'disable stateless' during the installation (which I haven't confirmed). (In
case, “Disable DHCPv6 stateless mode for this server” option was selected duringrole installation" -
http://blogs.technet.com/b/teamdhcp/archive/2009/03/03/dhcpv6-understanding-of-address-configuration-in-automatic-mode-and-installation-of-dhcpv6-server.aspx)
zz.. but my understanding of DHCP is fragmented, please take what I find with a grain of salt. I am off to reinstall DHCP :] .. fun.
Mediocre Access 2010 | (Baby) Beginner C Sharp | OK at Active Directory (2012) | Fragmented understanding of DNS/DHCP | Laughable experience with Group Policy | Expert question asker on MSDN Forums

HT201077 Why can't I access my iCloud albums from apps on my mobile devices?When I go to access my albums from any app on my phone or iPad, I cannot access the iCloud albums, only the albums synced with iTunes/iPhoto manually. This is frustrating because

When I go to access my albums from any app on my phone or iPad, I cannot access the iCloud albums, only the albums synced with iTunes/iPhoto manually. This is frustrating because I cannot add to those albums from mobile device, I have to add to them during a Mac sync. I would like to be able to use my iCloud albums to organize my photos but if I cannot access them from apps it seems pointless. I will end up having to maintain both an iCloud library and a separate iPhoto library which is more work that seems necessary. I want everything easy to organize and access. It seems like in this age where most people are more likely to use their mobile devices than their Macs (and some do not even own Macs) that there should be a mobile solution. Hopefully I am simply without a clue and you folks can help me out with a fix or a source of info as a solution. I have not found answers yet.

gail from maine wrote:
Hi keriah,
When you go to Settings>Pages, do you have the "Use iCloud" option turned on?
Cheers,
GB
That was it! Thanks!!!

HT1725 I downloaded an album from itunes and only half of the songs have downloaded. The rest of the songs keep trying to download and then come up with an error saying they cannot download at this time. I'm not sure what the issue is.

I downloaded an album from itunes and only half of the songs have downloaded. The rest keep trying to download, but I keep getting a message that says, "Song cannot be downloaded at this time. Do you want to retry or be done." Each time I retry, the same thing happens. They will not download. I have restarted my phone and the same problem remains.

Other people have been having similar problems with songs over a number of days.
Depending upon what country that you are in (music can't be re-downloaded in all countries) then try deleting it from your iTunes library and redownload it via the Purchased link under Quick Links on the right-hand side of the iTunes store home page on your computer's iTunes : re-downloading.
If you aren't in a country where you can re-download music or if it re-downloads in the same state then try the 'report a problem' link from your purchase history : log into your account on your computer's iTunes via Store > View My Account and you should then see a Purchase History section with a 'see all' link to the right of it ; click on that and you should see a list of your purchases ; find that song and use the 'Report a Problem' link.

TS2634 I cannot print from my ipad. The wireless is connected, I have no trouble printing from my computer. When the ipad looks for the printer it comes back with the message. "Air printer not found" What can I do to correct this? P S Ipad2 is only 1 mont

I cannot print from my ipad. It is connected to the wireless okay. I have only had this ipad for a month and while I am not sure I think it has been okay to print before 2 days ago, when I tried to print and I got the message "Airprinter not found" Has anyone experienced this and if so what did you do about it? I have no trouble printing from my computer.

... Has anyone experienced this and if so what did you do about it?
I rebooted my Airport Extreme.
Try rebooting your router. Make sure its firmware is updated.

Cannot ping secondary IP address on subinterface from SVI interface.

Hi to all.
We have a border router with lots of subinterfaces and some of them have few secondary networks from different subnets on it. I've configured SVI interface on same VLAN in same subnet, but can't ping from this SVI the secondary address, that applied on subinterface on a router.
It seems strange, because on other subinterface, with few secondary networks - all works fine.
All links between swithes and routers are in trunk mode, all switches contains appropriate vlans on their vlan.dat, all appropriate vlans are allowed on switches, all arp entries are present on border router and on switches, all appopriate mac addresses are in mac-add table present.int v
BR conf:
int gi0/1.10
encapsulation dot1q 10
ip add 192.168.1.1 255.255.255.0
ip add 192.168.2.1 255.255.255.0 secondary
int gi0/1.20
encapsulation dot1q 20
ip add 192.168.10.1 255.255.255.0
ip add 192.168.11.1 255.255.255.0 secondary
sw101 conf:
int vlan10
ip add 192.168.1.2 255.255.255.0
no ip route-cache
int vlan20
ip add 192.168.10.2 255.255.255.0
no ip route-cache
ip default-gateway 192.168.1.1
sw102 conf:
int vlan10
ip add 192.168.1.3 255.255.255.0
no ip route-cache
int vlan20
ip add 192.168.10.3. 255.255.255.0
no ip route cache
ip default-gateway 192.168.1.1
Connection scheme is trivial: br-->sw101-----L2VPN(QinQ) ISP-->sw102
ping 192.168.1.1 from sw101 & sw102 are successful.
ping to 192.168.10.1 from sw101 & sw102 are fails (sometimes some packets reach to destination - about 1-2 from 5 sended packets)
When i remove secondary ip address from BR (192.168.11.1/24) subinterface - all works fine.
Cannot understand, what's wrong ?
br - 7206VXR (NPE-G2)
sw101 - WS-C3560X-48T-L
sw102 - WS-X45-SUP7L-E
I haven't attach the other configurations of ports (trunk port configuration, vlan database and etc) bcoz i believe the problem not in L2 Layer, i think problem as for arp entries.
P.S. Sorry guys for my english, sorry for probably a stupid question, but i really can't catch it - pls help me to understand that.

Hi sgulyamov,
did you try to debug ARP request on Br ?
Could you post the configuration of the Swtich interface connected to Br ?
Bye,
enrico

Cisco 1941w --cannot ping bvi1 from router

I have vlan 1 in 192.168.5.1 255.255.255.0 and bvi1 192.168.5.2 255.255.255.0. It was working before but something happened and I cannot figureout what. Vlan1 cannot ping bvi and viceversa. I need some help. Thank you!

Can you please lost the config of the router and AP?
Steve
Sent from Cisco Technical Support iPhone App

I cannot ping any VIP from within the ACE or from rservers

I cannot ping any VIP from within the ACE or from rservers. Is this expected? I have rservers in other serverfarms that need to be able to communicate with the VIP of other serverfarms. Any help is greatly appreciated.

Thanks for you reply. here is the config. I removed other rserver and serverfarm config that does not have to do with this issue.
logging enable
logging fastpath
logging standby
logging console 4
logging timestamp
logging trap 4
logging history 4
logging buffered 4
logging persistent 4
logging monitor 4
logging device-id hostname
logging host 172.26.254.185 udp/514
logging host 172.26.221.25 udp/514
access-list INBOUND line 8 extended permit ip any any
access-list INBOUND line 16 extended permit icmp any any
access-list INBOUND line 24 extended permit tcp any any
access-list INBOUND line 32 extended permit udp any any
access-list ORADB line 8 extended permit tcp any any
probe http CITRIX
interval 30
passdetect interval 15
passdetect count 6
open 1
probe tcp HYPERION
port 19000
interval 2
faildetect 2
passdetect interval 2
passdetect count 2
receive 2
open 1
probe icmp PROBE_SERVICE_ICMP
interval 5
passdetect interval 5
probe tcp W15SPSWFET001_PROBE
interval 5
passdetect interval 5
connection term forced
open 1
parameter-map type connection TIMEOUT
set timeout inactivity 43200
parameter-map type http test
persistence-rebalance
set header-maxparse-length 2006
rserver host w0bairwatch003
description MDM-SEG
ip address 172.20.60.73
inservice
rserver host w0bairwatch004
description MDM-SEG
ip address 172.20.60.74
inservice
rserver host w0bairwatch005
description MDM-DEVICE
ip address 172.20.60.75
inservice
rserver host w0bairwatch006
description MDM-DEVICE
ip address 172.20.60.76
inservice
rserver host w0bhamobile001
description Lotus Notes Traveler Server
ip address 172.20.60.57
inservice
rserver host w0bhamobile002
description Lotus Notes Traveler Server
ip address 172.20.60.58
inservice
serverfarm host MDMDEVICE
predictor leastconns
probe PROBE_SERVICE_ICMP
rserver w0bairwatch005
    inservice
rserver w0bairwatch006
serverfarm host MDMSEG
predictor leastconns
probe PROBE_SERVICE_ICMP
rserver w0bairwatch003
    inservice
rserver w0bairwatch004
    inservice
serverfarm host TRAVLR
predictor leastconns
probe PROBE_SERVICE_ICMP
rserver w0bhamobile001
    inservice
rserver w0bhamobile002
    inservice
class-map match-all MDMDEVICE-VIP
2 match virtual-address 172.20.48.35 any
class-map match-all MDMSEG-VIP
2 match virtual-address 172.20.48.33 any
class-map type management match-any REMOTE_ACCESS
description Remote access traffic match
201 match protocol ssh any
202 match protocol telnet any
203 match protocol icmp any
204 match protocol https any
205 match protocol http any
206 match protocol xml-https any
207 match protocol snmp any
class-map match-all TRAVLR-VIP
2 match virtual-address 172.20.48.34 any
policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
class REMOTE_ACCESS
    permit
policy-map type loadbalance first-match MDMDEVICE
class class-default
    serverfarm MDMDEVICE
policy-map type loadbalance first-match MDMSEG
class class-default
    serverfarm MDMSEG
policy-map type loadbalance first-match TRAVLR
class class-default
    serverfarm TRAVLR
policy-map multi-match CLIENTS-VIPS
class MDMDEVICE-VIP
    loadbalance vip inservice
    loadbalance policy MDMDEVICE
    loadbalance vip icmp-reply active
class MDMSEG-VIP
    loadbalance vip inservice
    loadbalance policy MDMSEG
    loadbalance vip icmp-reply active
class TRAVLR-VIP
    loadbalance vip inservice
    loadbalance policy TRAVLR
    loadbalance vip icmp-reply active
interface vlan 48
ip address 172.20.48.10 255.255.255.0
access-group input INBOUND
access-group output INBOUND
service-policy input REMOTE_MGMT_ALLOW_POLICY
service-policy input CLIENTS-VIPS
no shutdown
interface vlan 60
ip address 172.20.60.10 255.255.255.0
access-group input INBOUND
access-group output INBOUND
service-policy input REMOTE_MGMT_ALLOW_POLICY
no shutdown
ip route 0.0.0.0 0.0.0.0 172.20.48.1

FlexVPN Cannot Ping From Spoke LAN only

Similar Messages

Maybe you are looking for