IP Route - Exit interface vs Next Hop

[petenixon]

Hi guys,

I'm sure this has been asked before :) But are there any known issues when using an exit interface in a route statement as opposed to a next hop address?

I have had an issue this morning after a router change whereby some hosts were able to access a web server and some were unable to. My route statement to the web server was pointing to an exit interface and when this was changed to next hop, all users were able to access it. It is very puzzling!

The router is an ASR1001, running 15.4.

Thanks.

[Vasilii Mikhailovskii]

Hello.

Please provide you configuration with ip route via interface.

Actually it depends on the interface - if it's GRE or PPP  or FR p2p interface - that is fine, if it's Ethernet - it's a poor configuration. As router will have to resolve L2 address per destination IP-address it's sending traffic for.

[petenixon]

Thanks for the reply Vasilii.

To add further context, the circuit is ethernet WAN, but is using tunnels to protect the traffic so the tunnels were being used as the exit interface.

[Richard Burts]

I am sure that you added the information hoping that it would help us to understand your situation. But I am still not clear whether you are talking about doing something like

ip route x.x.x.x y.y.y.y Eth0/0

or

ip route x.x.x.x y.y.y.y Tun1 (and if it is Tun1 is this a point to point tunnel or a multipoint tunnel?)

As has been mentioned there are (multiple) issues with a static route which specifies only an exit interface if the interface is multipoint like Ethernet.

HTH

Rick

[petenixon]

Hi Rick,

It's a point-to-point tunnel, and the route is:

ip route x.x.x.x x.x.x.x. tunX

[Vasilii Mikhailovskii]

Hello.

If tunX is a p2p interface, then configuration is correct (and best practice).

[Richard Burts]

Thanks for the clarification that it is a point to point tunnel and that the route was ip route x.x.x.x x.x.x.x tunX. I do not see a problem with that and am puzzled at your description in the original post that some users had a problem and that the problem was resolved when you changed the static route. Is it possible that there was some kind of problem with the tunnel and that the new version of the static route was not going through that tunnel?

HTH

Rick

[petenixon]

Thanks Rick.

Yep, it is a puzzler! I was able to verify both the forwarding and reverse path of the route to the web server and there was absolutely no problems.