Routers will not ping outside their subnet

[kbjmarch1008]

3 offices, 2 have the 861 and one has the 881. All offices are able to map drives and connect to each other. I'm having a problem w/ a Riverbed appliance and have been troubleshooting w/ them and they claim the problem is in my network. When I try to ping a router from one office to the other it times out. I've tried it from the Command Prompt and the ping tool in the routers. Clients that are in the same office can ping the router in that office but not any router outside of that office.......I can ping a server in another office and it completes.

Any ideas?

TIA

[Glenn Quesenberry]

Sounds as if you may be pinging between sites through a VPN?  You state you can ping a server on another network but not the router, correct; so is that sever in a DMZ or are you VPN to that site and then pinging it like a local device?  Another thing, is you may not be replying to the ICMP echo request at the routers which is a common security configuration to prevent DoS attacks.  Check to see if this is configured on the router and/or firewall.

[kbjmarch1008]

Yes VPN is being used.

Yes correct....can ping any server or workstation from either location except for the routers.....except on one....after posting this I double checked the office that is not a domain. That router can ping the office w/ the 881 and cannot ping the 861 in the other domain.

Firewall is not enabled on any router.

I checked both models and I don't see any security setting that turns off replying to the ICMP requests. Where would I find that?

Thanks for replying!!

[David Hornstein]

Hi,

We know from answers to Glenn's questions that the VPN works perfectly, clients on one side can ping client on remote locations.

1. So what is the riverbed wan optimization appliance not doing, that would cause you to pose a question to this community?

2. Excuse a possible dumb question, but exactly where does this appliance sit on the network, rough topology diagram would be useful ?

3. Why Is it important to be able to ping from a PC in one domain the  the remote WAN routers WAN Global IP address  at this stage of the installation?

4. related to the previous question, is there a filter or access list to stop incoming  ICMP echo on that remote 861?

5 Is the 861 providing only VPN service?

6. Is the 861 providing NAT services for the private Local Area Network or does the riverbed do that as well as firewall?

You're probably  getting the idea from the questions posed above, that I am really trying to understand the riverbed application and why riverbed say we are the cause of their problems.

regards Dave

[kbjmarch1008]

Thanks for writing....I thought I had replied until I noticed your reply in my Inbox.

1. The appliances are not communicating. Their support team says it is a network problem. I agree w/ them because they were working before installation of the routers. The appliances can not be pinged from any office.

2. Topology is as follows for all offices. Comcast Internet cable enters office and goes directly to the router. From the router to the appliances. From applicances to the switch.

3. There is really no need to be able to ping to the routers.....I found that I couldn't ping them when I was working on the appliacnes. I just found it strange you can't ping them.

4. Not that I can tell because I thought the same thing but can't find any.

5. I don't know.....I guess it is....sorry...new to this stuff....

6. Not sure what you mean......there is no firewall on the Riverbed.

The reason Riverbed says it is the router is because the appliances do not see each other after the new routers were installed. They were working fine and quit communicating at the exact moment the routers were installed. That was the only change to the network at that time. Neither appliance will ping the other and no client anywhere in the network can not ping the appliances.

Thanks for writing!!.....