×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

BVI not responding to ARP requests ?

Unanswered Question

I have a 2811 router running IOS c2800nm-adventerprisek9-mz.124-22.YB8 with a wireless module ( HWIC-AP-G-A ) configured with an ipsec vpn.


Because of the wireless module, I believe that I need to have the inside ip address on the BVI.


When I do this, my vpn clients are unable to communicate with computers on the private network.


After a lot of debugging, I believe the reason to be that the BVI does not seem to respond to ARP requests from computers on the private network.


If I put the inside ip address on f0/1, then the VPN works the way it is supposed to but my wireless clients are unable to get an ip address due the BVI not having a network presence without an ip address.


debug arp output when I ping the vpn client from a computer on the private net and the inside ip is on f0/1:

Oct  7 00:05:20.075: IP ARP: rcvd req src 10.0.0.102 001c.c0ef.dc08, dst 10.0.0.153 FastEthernet0/1

Oct  7 00:05:20.075: IP ARP: sent rep src 10.0.0.153 001e.f760.8f11,

                 dst 10.0.0.102 001c.c0ef.dc08 FastEthernet0/1


debug arp output when I ping the vpn client from a computer on the private net and the inside ip is on bvi1:


Oct  7 00:09:22.971: IP ARP: rcvd req src 10.0.0.102 001c.c0ef.dc08, dst 10.0.0.154 BVI1


and no reply is ever sent.


This config works for VPN clients but not for wireless clients:


interface FastEthernet0/1

description House LAN

ip address 10.0.0.1 255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

interface BVI1

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip virtual-reassembly


This config works for wireless clients but not for VPN clients:


interface FastEthernet0/1

description House LAN

no ip address

bridge-group 1

ip virtual-reassembly

duplex auto

speed auto

!

interface BVI1

ip address 10.0.0.1 255.255.255.0

ip nat inside

no ip redirects

no ip unreachables

no ip proxy-arp

ip virtual-reassembly


Is this a bug ?


Here's the config:




!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

!

hostname xxx-2811

!

boot-start-marker

boot-end-marker

!

logging message-counter syslog

no logging buffered

enable secret 5 $1$5OZ2$iYMxqrGokppZb91bQmD.V/

!

aaa new-model

!

!

aaa authentication login default local-case

aaa authorization network xxx-vpn local

!

!

aaa session-id common

clock timezone EST -5

clock summer-time EST recurring

!

dot11 syslog

!

dot11 ssid XXX2811

authentication open

authentication key-management wpa

guest-mode

wpa-psk ascii 7 01425F520C5353052B

!

ip source-route

!

!

ip cef

no ip dhcp use vrf connected

ip dhcp excluded-address 10.0.0.1 10.0.0.99

ip dhcp excluded-address 10.0.0.151 10.0.0.255

!

ip dhcp pool dhcppool

   network 10.0.0.0 255.255.255.0

   dns-server 75.75.75.75 75.75.76.76

   default-router 10.0.0.1

!

!

ip domain name xxx.local

ip ddns update method no-ip

HTTP

  add http:[email protected]/nic/update?hostname=[email protected]/nic/update?hostname=<h>&myip=<a>

  remove http:[email protected]/nic/update?hostname=[email protected]/nic/update?hostname=<h>&myip=<a>

interval maximum 2 0 0 0

interval minimum 1 0 0 0

!

login on-failure log

login on-success log

no ipv6 cef

!

multilink bundle-name authenticated

!

!

username xxx privilege 15 password 7 065756771B165C330F

archive

log config

  hidekeys

!

crypto logging session

!

crypto isakmp policy 1

encr aes

authentication pre-share

group 2

crypto isakmp client configuration address-pool local vpnpool

!

crypto isakmp client configuration group xxx-vpn

key xxx

dns 75.75.75.75 75.75.76.76

pool vpnpool

acl 101

include-local-lan

split-dns xxx.local

max-logins 2

!

!

crypto ipsec transform-set transform-1 esp-aes esp-sha-hmac

!

crypto dynamic-map vpnmap 10

set transform-set transform-1

reverse-route

!

!

crypto map vpnmap client authentication list default

crypto map vpnmap isakmp authorization list xxx-vpn

crypto map vpnmap client configuration address initiate

crypto map vpnmap client configuration address respond

crypto map vpnmap 10 ipsec-isakmp dynamic vpnmap

!

!

ip ssh maxstartups 3

ip ssh authentication-retries 2

ip ssh version 2

bridge irb

!

!

!

!

interface FastEthernet0/0

description Comcast WAN

ip ddns update hostname xxx.no-ip.biz

ip ddns update no-ip

ip address dhcp client-id FastEthernet0/0

ip access-group IncomingTrafficACL in

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

crypto map vpnmap

!

interface FastEthernet0/1

description House LAN

ip address 10.0.0.1 255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

interface Dot11Radio0/3/0

description House WAN

no ip address

!

encryption mode ciphers aes-ccm tkip

!

ssid XXX2811

!

speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0

station-role root

world-mode dot11d country US both

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 spanning-disabled

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

!

interface BVI1

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip virtual-reassembly

!

ip local pool vpnpool 10.0.0.151 10.0.0.160

ip forward-protocol nd

no ip http server

ip http authentication local

no ip http secure-server

!

!

ip dns server

ip nat inside source route-map RM-POLICY-NAT interface FastEthernet0/0 overload

!

ip access-list extended ACL-POLICY-NAT

remark Deny_10_Network_NAT_Permit_all_other

deny   ip 10.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255

permit ip 10.0.0.0 0.0.0.255 any

ip access-list extended IncomingTrafficACL

remark ACCEPT-ESTABLISHED

permit tcp any any established

remark ACCEPT-DNS-IN

permit udp any eq domain any

remark ACCEPT-NTP-IN

permit udp any eq ntp any

remark ACCEPT-DHCP-IN

permit udp any eq bootps any

remark ACCEPT-IPSEC-VPN

permit udp any any eq isakmp

permit udp any any eq non500-isakmp

permit esp any any

remark DENY-SSH

deny   tcp any any eq 22 log

remark DENY-ALL-OTHER

deny   ip any any log

!

logging trap debugging

logging 10.0.0.102

access-list 101 permit ip 10.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255 log

access-list 101 remark VPN Access List

!

!

!

route-map RM-POLICY-NAT permit 10

match ip address ACL-POLICY-NAT

!

!

control-plane

!

bridge 1 protocol ieee

bridge 1 route ip

!

!

!

banner login  Authorized Users only.  This is a monitored network.


!

line con 0

line aux 0

line vty 0 4

privilege level 15

transport input ssh

!

scheduler allocate 20000 1000

ntp server 18.85.44.118

end





  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion