Routing Issue

[js358]

Hello:

Segmented our LAN 10.0.1.x and 10.0.2.x with a 3660 in the middle running IOS 12. something.Mixture of NT and Linux boxes both sides.

Since the segmentation, we cannot ftp from 10.0.2.x into the 1.x NT ftp server with any linux boxes. We can however ftp into the NT ftp server with NT clients from 2.x to 1.x

The consultant who is in charge of this is struggling for a reason why which has prompted this email. He's claiming DNS but I cannot see why as we are ftping using IP. Odd thing is though, when we placed a line in the hosts file on one of the linux boxes <simply 10.0.1.101 ftp> it worked more often that not.

Can anyone explain why this is happening or offer any suggestions? Thanks

[peterbe]

Is the default gateway set correctly on the linux boxes? Can the linux boxes ping anything on the 10.0.1.0 network? If not, can they ping the default gateway?

Not sure why the entry in the host table made any difference.

Peter

[js358]

Peter:

Gateways are correct and can ping everywhere. FTP linux to NT across the router is a problem. I have no idea why the host entry affected anything. It makes no sense.

[Harold Ritter]

Is there any access-list configured on the router?

[rjackson]

Does it break down before the login or after? If after then the Linux box is probably doing reverse DNS lookups as the NT box tries to open data connections back to the Linux box. The host table entry lets it resolve the address to a name. I have not seen that break things before, just slow it down while the lookup fails. This box may be configured to fail if the lookup fails.

[js358]

Did some packet captures and found on successful attempts from the same subnet, the first packet out of the chute were ARP request and reply source and detination. The router would drop this if the source and destination were on different subnets as is my case.

How to get around this?? Even if an entry is amde in reverse lookup zone on the DNS server, the connection still fails. I wathced successful query and response packets and yet it fails. No ARP and no connection. I am open for suggestions.

[rjackson]

If you are seeing arp requests from the linux box for the destination address then it has to have a bad mask. it should never arp for something that is not in its network. it should recognize the destination is in another network and , if necessary, arp for the gateway router. Then it will forward traffic to the gateway.

[rjackson]

now that I think about it, the router should handle it even if the linux box is arping. it should recognize the arp is for a different network and answer it using proxy arp. Do a show ip int to verify that proxy arp is enabled on both interfaces of the router. it sounds more like one of the host doesn't think it needs to arp.

Did the address of both servers change or are they (one or both) the same with a router now in between? Look at the arp entries in each box. I'll bet one of them still has the old arp entry for the other. They should both have the mac address of their gateway router and no arp entry for the other host.

Command is arp -a

To remove an entry use arp -d x.x.x.x

If that doesnt work look at the arp entry in the router for the linux box. See if it has the correct mac address. Clear it then see if the ftp works. There may be a dup address for the linux box.

[js358]

We just brought the router up. I came to the ssame conclusion about proxy-arp. I checked to ensure proxy-arp wasn't diabled on the interfaces and it is in fact enabled.

The router guy is stumped. This has been an issue for over 2 weeks now. It's strange because if you ping prior to attempting FTP connection, it's ok. Once the arp cache on the local linux box refreshes and you try to connect, it fails.

I guess my next question would be....ping seems to satisfy the ip to mac addressing. Why? If I run ARP -a from the linux box, I get a reply back for the router interface (gateway) as I should even during the instance when the FTP connection fails.

If I ping it and then connect ftp, I'm good to go.

Thanks for your responses. It helps to know that I am at least on the right track. This is really an odd issue.