Hi all,
We have a hub and spoke network with all spoke routers connecting to two hubs (for redundency) over Tunnel0 and Tunnel1.
Each hub is connected to one another via a common switch.
Hub 1's Tunnel IP is 10.10.200.1 /24
Hub 2's Tunnel IP is 10.10.201.1 /24
We have our Cisco Secure ACS server (IP 172.18.120.230/24) connecting to the same common switch (Layer 3 stack) between the 2 hubs.
Each hub can ping the IP address of this server and knows it via the interface connecting to the switch.
On the spoke side, a show ip eigrp topology identifies Hub on Tunnel0 to be the successor and Tunnel1 to be the Feasible Successor to network 172.18.120.0/24
Also on the spoke side, a show ip route 172.18.120.230 returns that it has a route to this host via Tunnel0 which validates the previous statement.
Now here is the problem. I can't ping 172.18.120.230 from the spoke router. I tried to source the ping from Tunnel0 and Tunnel1 but it still fails.
I CAN ping 172.18.120.230 from each hub without an issues.
There are no filters or ACLs in place on the hubs or the spoke that would block this connection.
Although sometimes it works where I can ping without any issues. Also this is not the case with every spoke where I CAN successfully ping the host from them without any issues.
Below is a capture of the configuration from spoke side and ping from both hubs. I would really appreciate any help anyone can provide.
r-exp-lab-1#sh ip route 172.18.120.230
Routing entry for 172.18.120.0/24
Known via "eigrp 1", distance 170, metric 2560256, type external
Redistributing via eigrp 1
Last update from 10.10.200.1 on Tunnel0, 21:18:24 ago
Routing Descriptor Blocks:
* 10.10.200.1, from 10.10.200.1, 21:18:24 ago, via Tunnel0
Route metric is 2560256, traffic share count is 1
Total delay is 50010 microseconds, minimum bandwidth is 2000 Kbit
Reliability 255/255, minimum MTU 1400 bytes
Loading 1/255, Hops 1
r-exp-lab-1#
r-exp-lab-1#
r-exp-lab-1#
r-exp-lab-1#
r-exp-lab-1#sh ip eigrp nei
EIGRP-IPv4 Neighbors for AS(1)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
1 10.10.200.1 Tu0 10 22:27:47 169 1014 0 244617
0 10.10.201.1 Tu1 14 22:27:49 14 138 0 49093
r-exp-lab-1#
r-exp-lab-1#
r-exp-lab-1#
r-exp-lab-1#sh ip eigrp top 172.18.120.0/24
EIGRP-IPv4 Topology Entry for AS(1)/ID(1.1.1.150) for 172.18.120.0/24
State is Passive, Query origin flag is 1, 1 Successor(s), FD is 2560256
Descriptor Blocks:
10.10.200.1 (Tunnel0), from 10.10.200.1, Send flag is 0x0
Composite metric is (2560256/2816), route is External
Vector metric:
Minimum bandwidth is 2000 Kbit
Total delay is 50010 microseconds
Reliability is 255/255
Load is 1/255
Minimum MTU is 1400
Hop count is 1
External data:
Originating router is 1.1.1.1
AS number of route is 0
External protocol is Static, external metric is 0
Administrator tag is 0 (0x00000000)
10.10.201.1 (Tunnel1), from 10.10.201.1, Send flag is 0x0
Composite metric is (3840256/2816), route is External
Vector metric:
Minimum bandwidth is 1000 Kbit
Total delay is 50010 microseconds
Reliability is 255/255
Load is 1/255
Minimum MTU is 1400
Hop count is 1
External data:
Originating router is 1.1.1.2
AS number of route is 0
External protocol is Static, external metric is 0
Administrator tag is 0 (0x00000000)
r-exp-lab-1#ping
Protocol [ip]:
Target IP address: 172.18.120.230
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: Tunnel0
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.18.120.230, timeout is 2 seconds:
Packet sent with a source address of 10.10.200.150
.....
Success rate is 0 percent (0/5)
r-exp-lab-1#
r-exp-lab-1#ping
Protocol [ip]:
Target IP address: 172.18.120.230
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: Tunnel1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.18.120.230, timeout is 2 seconds:
Packet sent with a source address of 10.10.201.150
.....
Success rate is 0 percent (0/5)
R-HUB-1#ping 172.18.120.230
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.18.120.230, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
R-HUB-2#ping 172.18.120.230
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.18.120.230, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
R-Q9-2#
