Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > Using an SLA echo monitor via an ASA Site-to-Site Tunnel

Reply
Thread Tools

Using an SLA echo monitor via an ASA Site-to-Site Tunnel

 
 
TomBombadil
Guest
Posts: n/a
 
      09-24-2008
I have established a successful site-to-site VPN tunnel between two
Cisco ASA 5505's running software version 8.0(3). (The tunnel
configuration is quite standard as the tunnel was built using the ADSM
VPN Wizard). I have no problem pinging the inside address of either
unit from the other (although it is necessary to ping via the inside
interface in order to direct it through the tunnel).

I would like to be able to use the SLA monitor feature to periodically
ping via the tunnel, as:

* I would like to have a static routing table entry active (and thus
advertised via OSPF) contingent on tracking of the SLA (i.e. present
only when the tunnel is actually up).
* I would like to leave to tunnel open continuously. A periodic ping
is one way to do this.
Having successfully used the SLA tracking feature on non-tunneled
connections elsewhere, and given that I can manually ping the same
address, I was surprised to find that I can't seem to get the SLA
monitor to ping through the tunnel correctly. I have tried specifying
the inside interface, just as I have in successful pings to the same
address (i.e. the inside address of the other ASA).

In the following example 192.168.3.2 is the inside interface of the
source ASA and 192.168.5.1 is the inside interface of the destination
ASA in the attempted SLA. The config lines used on 192.168.3.2 are:

sla monitor 1
type echo protocol ipIcmpEcho 192.168.5.1 interface inside
num-packets 3
frequency 10

sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability

Checking "show track 1" reports "Reachability is down", having timed-
out.

The log reveals the following condition:
"Routing failed to locate next hop for icmp from NP Identity Ifc:
192.168.3.2/0 to inside:192.168.5.1/0"

This despite the fact that a "ping inside 192.168.5.1" from
192.168.3.2 is completely successful. (Likewise a "ping inside
192.168.3.2" from 192.168.5.1 is also completely successful.")

I also tried selecting another address at the other end of the tunnel
as a destination. The results were the same.

Is it at all possible to have an SLA monitor ping across a site-to-
site VPN tunnel on an ASA?
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Up->Down messages related to ip sla icmp-echo when there are noapparent network issues ttripp Cisco 4 10-22-2009 11:57 PM
Using an ASA's AIP SSM module to inspect traffic going into andcoming out of a VPN tunnel. dnash Cisco 0 01-22-2009 05:14 PM
Split Tunnel Blocks http through tunnel but passes http around tunnel a.nonny mouse Cisco 2 09-19-2004 12:10 AM
Termination of an IPSec VPN tunnel and a GRE Tunnel on one physical interface. John Ireland Cisco 1 11-11-2003 04:47 PM
echo echo echo craig judd Computer Support 1 09-23-2003 08:53 PM



Advertisments