Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Ping works, traceroute/ssh doesn't

Hello. Thanks in advance for read this.

It must be something very basic but somehow I can't see it. I have a couple routers connected as follows (simplified layout as there are way more routers on the FR cloud):

[Internet] <-- ATM --> [Router_A] <-- Ethernet --> [Router_B] <-- Frame Relay --> [Router_C]

On Router_A I have:

  • Vlan100 as 192.168.0.1
  • Vlan200 as 192.168.2.1
  • Gi0/0 as switchport access vlan100, no IP address
  • Gi0/1 as switchport access vlan200, no IP address

On Router_B I have:

  • Gi0/0 as 192.168.2.2
  • S0/0/0 as 192.168.255.1

On Router_C I have:

  • S0/0/0 as 192.168.255.10
  • Gi0/0 as 192.168.10.1

The ACLs on router A are very basic:

Int ATM0

ip nat outside

Int Vlan100

ip nat inside

Int Vlan 200

ip nat inside

access-list 100 permit ip 192.168.0.0 0.0.0.255 any

access-list 100 permit ip 192.168.2.0 0.0.0.255 any

access-list 100 permit ip 192.168.255.0 0.0.0.255 any

access-list 100 deny ip any any

ip nat inside source list 100 interface ATM0 overload

There are no ACLs on routers B and C.

All network routes are visible on the routers via multiple OSPF areas. Also, routers B and C use A as NTP server, and yes, clocks can sync!

- Both B and C can ping and traceroute any Internet address.

- Both B and C can talk to a netflow collector machine on Vlan100.

- Router A can SSH to B, but cannot to C.

- Router B can SSH to A.

- Router C cannot SSH to A.

- Both B and C can ping A, but none ca traceroute to A.

I tried to mirror the Vlan100 and Vlan200 traffic on router A using the "ip traffic-export" command. On the Wireshark machine all I could see were the ICMP echo request/reply packets and the traceroute UDP packets being sent, but no responses were being sent from my Vlan100 address on router A back to either B or C.

What am I missing?

3 REPLIES

Re: Ping works, traceroute/ssh doesn't

... looks like I found what was wrong, and it was indeed something very, very basic.

On Router_A:

int Vlan100

no ip unreachables

int Vlan200

no ip unreachables

That broke traceroute. Regarding SSH, it looks like the source routers I was using were running older IOS and their clients don't support SSH v2. I redid those tests from other routers running newer IOS code and it was all flawless.

Hall of Fame Super Silver

Ping works, traceroute/ssh doesn't

I am glad that you were able to solve your own problem. And the issues that you found would certainly cause the symptoms that you describe. Thank you for posting back to the forum telling us what you found and how you fixed the problems. It can be very helpful to other readers when we have this kind of information.

HTH

Rick

Re: Ping works, traceroute/ssh doesn't

On router b gi0/0 do you have encapsulation dot1q 200?

Sent from Cisco Technical Support iPad App

779
Views
0
Helpful
3
Replies
CreatePlease to create content