Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Tunnel Troubleshooting, communication issues between routers....

I have a MPLS network that uses seperate DSL lines for BGP failover. I have a tunnel that is up but protocol is down. It will not set-up isakmp phase 1 and I believe it's due to communications blocking. Here is my ping list...

Telnet Site Router: can ping site host IP and DSL provider IP, cannot ping destination IP

My PC: can ping DSL provider IP but not Site IP

Telnet Destination Router: cannot ping either the site IP or the DSL provider IP

Here are some configs and debugs.....

debugs on site router for "debug cry isa"

https://www.dropbox.com/s/27mcc28xbfb5wvk/clearfield%20debug.txt

Site config:

https://www.dropbox.com/s/gbsclvnt4kgj55t/Clearfield%20Site.txt

Destination config:

https://www.dropbox.com/s/v8civuk8qu3c1k2/Destination%20Code.txt

I just really don't know how to troubleshoot this further.

4 REPLIES
Cisco Employee

Re: Tunnel Troubleshooting, communication issues between routers

Hi Matt,

Can you ping tunnel endpoint? Make sure the ISAKMP attributes are matching on both ends.

HTH,
Lei Tian

Sent from Cisco Technical Support iPhone App

New Member

Tunnel Troubleshooting, communication issues between routers....

No I cannot ping the tunnel endpoint, nor ping the other side's DSL IP address. The attributes all match and I have also built another tunnel to another endpoint we have neither work with the same symptoms. Something is blocking the traffic leaving the site router, my guess is NAT or firewall in the DSL modem but this tunnel was up before with no replacement. I can ping the provider side of the DSL line on the site router through my MPLS connection just not through the DSL.

Cisco Employee

Re: Tunnel Troubleshooting, communication issues between routers

Hi,

So the tunnel was up before? What was changed? The IP on the tunnel endpoints should be public IPs, no NAT is needed.

HTH,

Lei Tian

New Member

Tunnel Troubleshooting, communication issues between routers....

The tunnel interface itself has a 10.0.0.0 address, the endpoint or DSL provider side of the external I cannot reach. This and 2 others are suffering from the same exact symptoms, a consultant who took over after my predecessor had left said that they were all operational but neither of us know how long they have been down. I know no NAT is needed but that doesn't mean that the ISP doesn't have one turned on, a lot of times they set up a PPPOE and have NAT and firewalls turned on. I'm just looking

217
Views
0
Helpful
4
Replies
CreatePlease login to create content