ISDN Up But No Ping Response

Discussion in 'Cisco' started by Darren Green, Apr 10, 2008.

  1. Darren Green

    Darren Green Guest

    Can anyone help with some ISDN advice.

    I have a router with a remote ISDN connection. The router is able to
    successfully dial and authenticate to the remote ISDN device. When a
    ping is sent from an inside server to the remote end it fails.

    Originally the ISDN solution was on an old 2600 with a PRI and this
    worked fine. I lifted the config off the 2600 and modified it slightly
    to drop onto a new 1841 router with a BRI and pings won't work. Put it
    back on the PRI router and it does.

    A traceroute from an inside machine 10.20.0.10 (see NAT statement below)
    hits 10.20.100.2 and then stops. The ISDN authenticates fine but no ping
    responses even though I am seeing hits on my 'interesting traffic' ACL.
    I assume the router is just dropping the packets even though the ISDN
    authenticates. After the idle timeout period the ISDN closes.

    Config as follows:

    interface FastEthernet0/1
    description Connection to LAN Switch
    ip address 10.20.100.2 255.255.0.0
    ip address 212.X.X.113 255.255.255.252 secondary
    no ip redirects
    ip nat inside
    ip virtual-reassembly
    speed 100
    full-duplex
    !
    interface BRI0/1/0
    description Test ISDN Link
    no ip address
    encapsulation ppp
    dialer pool-member 1
    isdn switch-type basic-net3
    no fair-queue
    no cdp enable
    ppp authentication chap
    ppp multilink
    !
    interface Dialer10
    description Test ISDN Dialer
    ip address 195.X.X.37 255.255.255.0
    ip nat outside
    ip virtual-reassembly
    encapsulation ppp
    dialer pool 1
    dialer remote-name blah
    dialer idle-timeout 30
    dialer string 0012345678
    dialer-group 2
    no cdp enable
    ppp authentication chap
    ppp multilink

    ip nat inside source static 10.20.0.10 212.X.X.114

    ip route 147.X.X.X 255.255.255.0 195.X.X.X name ISDN Test

    dialer-list 2 protocol ip list 102

    access-list 102 permit icmp host 212.X.X.113 host 147.X.X.X
    access-list 102 permit tcp host 212.X.X.X host 147.X.X.X log
    access-list 102 permit icmp host 212.X.X.114 host 147.X.X.X log
    access-list 102 permit tcp host 212.X.X.114 host 147.X.X.X log

    Regards

    Darren
    Darren Green, Apr 10, 2008
    #1
    1. Advertising

  2. Darren Green

    Merv Guest

    1. Does an extended ping using source IP address of 195.X.X.37 (i.e.
    the real source Ip address) suceed ?

    2. Are you missing some NAT statements here ?
    Merv, Apr 10, 2008
    #2
    1. Advertising

  3. Darren Green

    Darren Green Guest

    Merv wrote:
    > 1. Does an extended ping using source IP address of 195.X.X.37 (i.e.
    > the real source Ip address) suceed ?
    >
    > 2. Are you missing some NAT statements here ?
    >
    >

    Hi Merv,

    The pings have to come from 212.X.X.113 or 212.X.X.114. There is a
    secondary address on the routers F0/1 which I can source the ping from,
    it was put there as a test. The other host is the .114 address which has
    the NAT statement

    ip nat inside source static 10.20.0.10 212.X.X.114. Ethernet is inside
    and Dialer is outside.

    So strange it works on the old router with the PRI and not the BRI
    router. As I mentioned everything authenticates but a ping sourced from
    the inside host of 10.20.0.10 stops at the router Lan port and goes no
    further even though the ISDN is up.

    I thought that it could be an IOS issue or something to do with the new
    ISDN cards the 1841's run. I'll dig a bit more on the Cisco WWW site and
    see if I can turn anything up.

    I take it that if I want to route to 147.X.X.X 255.255.255.0 via
    195.X.X.1 that the router will assume it has a path to this endpoint as
    the Dialer has the ip address 195.X.X.37 255.255.255.0.

    I did take the route out and added 147.X.X.X 255.255.255.0 dialer10. I
    got some ping responses but we tried again and no joy.

    Regards

    Darren
    Darren Green, Apr 11, 2008
    #3
  4. Darren Green

    Merv Guest

    Does the far-end router have a route to 212.x.x.114 via 195.xx.xx.37 -
    i.e over the BRI link ?

    Was the same addressing that was used on the PRI moved to BRI or was a
    new address assigment for the BRI link used ?
    Merv, Apr 11, 2008
    #4
  5. Darren Green

    Darren Green Guest

    Merv wrote:
    > Does the far-end router have a route to 212.x.x.114 via 195.xx.xx.37 -
    > i.e over the BRI link ?
    >
    > Was the same addressing that was used on the PRI moved to BRI or was a
    > new address assigment for the BRI link used ?


    I will need to check the far end router setup as its not ours but as the
    config from the local router (IP addresses and all) mirrors the one
    replaced.

    So putting the PRI back in works fine. Putting the BRI route in doesn't.
    I have obviously missed something on the configs (or it is down to the
    different physical setup). I will check them again.

    Regards

    Darren
    Darren Green, Apr 12, 2008
    #5
  6. Darren Green

    Merv Guest

    On Apr 12, 5:11 am, Darren Green
    <> wrote:
    > Merv wrote:
    > > Does the far-end router have a route to 212.x.x.114 via 195.xx.xx.37 -
    > > i.e over the BRI link ?

    >
    > > Was the same addressing that was used on the PRI moved to BRI or was a
    > > new address assigment for the BRI link used ?

    >
    > I will need to check the far end router setup as its not ours but as the
    > config from the local router (IP addresses and all) mirrors the one
    > replaced.
    >
    > So putting the PRI back in works fine. Putting the BRI route in doesn't.
    > I have obviously missed something on the configs (or it is down to the
    > different physical setup). I will check them again.
    >
    > Regards
    >
    > Darren


    So if the link addressing used is the same fro both the PRI and BRI,
    then does the far end-router, which also might also be different
    router as a result of changing from PRI to BRI, have a static route
    pointing back to 212.x.x.114. You could ask for output of show ip
    route 212.x.x.114

    if you enable debug ip icmp you should be able to see if the packets
    are actually being sent out the BRI interface.
    Merv, Apr 12, 2008
    #6
  7. Darren Green

    Darren Green Guest

    Merv wrote:
    > On Apr 12, 5:11 am, Darren Green
    > <> wrote:
    >> Merv wrote:
    >>> Does the far-end router have a route to 212.x.x.114 via 195.xx.xx.37 -
    >>> i.e over the BRI link ?
    >>> Was the same addressing that was used on the PRI moved to BRI or was a
    >>> new address assigment for the BRI link used ?

    >> I will need to check the far end router setup as its not ours but as the
    >> config from the local router (IP addresses and all) mirrors the one
    >> replaced.
    >>
    >> So putting the PRI back in works fine. Putting the BRI route in doesn't.
    >> I have obviously missed something on the configs (or it is down to the
    >> different physical setup). I will check them again.
    >>
    >> Regards
    >>
    >> Darren

    >
    > So if the link addressing used is the same fro both the PRI and BRI,
    > then does the far end-router, which also might also be different
    > router as a result of changing from PRI to BRI, have a static route
    > pointing back to 212.x.x.114. You could ask for output of show ip
    > route 212.x.x.114
    >
    > if you enable debug ip icmp you should be able to see if the packets
    > are actually being sent out the BRI interface.
    >

    I will ask the maintainer of the far end kit to confirm what there set
    up is. When we try to swap this out again in a couple of days time I
    will run the debug.

    BTW the ping is always initiated from a host on my LAN 212.X.X.113. The
    213.X.X.114 address was put onto my router Fast Ethernet as a secondary
    address for testing purposes. Again this mirrored the PRI router at my
    end that I tired to swap out. The .114 address had been placed on it for
    testing also and worked OK.

    Regards

    Darren
    Darren Green, Apr 12, 2008
    #7
  8. Darren Green

    Merv Guest

    On Apr 12, 9:04 am, Darren Green
    <> wrote:
    > Merv wrote:
    > > On Apr 12, 5:11 am, Darren Green
    > > <> wrote:
    > >> Merv wrote:
    > >>> Does the far-end router have a route to 212.x.x.114 via 195.xx.xx.37 -
    > >>> i.e over the BRI link ?
    > >>> Was the same addressing that was used on the PRI moved to BRI or was a
    > >>> new address assigment for the BRI link used ?
    > >> I will need to check the far end router setup as its not ours but as the
    > >> config from the local router (IP addresses and all) mirrors the one
    > >> replaced.

    >
    > >> So putting the PRI back in works fine. Putting the BRI route in doesn't.
    > >> I have obviously missed something on the configs (or it is down to the
    > >> different physical setup). I will check them again.

    >
    > >> Regards

    >
    > >> Darren

    >
    > > So if the link addressing used is the same fro both the PRI and BRI,
    > > then does the far end-router, which also might also be different
    > > router as a result of changing from PRI to BRI, have a static route
    > > pointing back to 212.x.x.114. You could ask for output of show ip
    > > route 212.x.x.114

    >
    > > if you enable debug ip icmp you should be able to see if the packets
    > > are actually being sent out the BRI interface.

    >
    > I will ask the maintainer of the far end kit to confirm what there set
    > up is. When we try to swap this out again in a couple of days time I
    > will run the debug.
    >
    > BTW the ping is always initiated from a host on my LAN 212.X.X.113. The
    > 213.X.X.114 address was put onto my router Fast Ethernet as a secondary
    > address for testing purposes. Again this mirrored the PRI router at my
    > end that I tired to swap out. The .114 address had been placed on it for
    > testing also and worked OK.
    >
    > Regards
    >
    > Darren



    when you say " the ping is always initiated from a host on my LAN
    212.X.X.113" is that the NAT'ed or the unNAT'ed source IP address on
    the LAN ?

    So you can do an extended ping using source of 212.x.x.114
    successfully but not 212.x.x.113 - is that correct ?

    in additon to the debug ip icmp, you may also want to do a debug on
    the nat translation
    Merv, Apr 12, 2008
    #8
  9. Darren Green

    Darren Green Guest


    >
    >
    > when you say " the ping is always initiated from a host on my LAN
    > 212.X.X.113" is that the NAT'ed or the unNAT'ed source IP address on
    > the LAN ?
    >
    > So you can do an extended ping using source of 212.x.x.114
    > successfully but not 212.x.x.113 - is that correct ?
    >
    > in additon to the debug ip icmp, you may also want to do a debug on
    > the nat translation


    The host is a server on Fa0/1 (Nat inside) - IP = 10.20.0.10 and this is
    natted to the 213.x.x.114 address when exiting Dialer 10 (Nat outside).

    IP address 213.X.X.113 /30 is the secondary address on Fa0/1 and was
    used for testing purpose.

    I will give the debug ip nat translation a whirl in addition to ICMP and
    see what that tells me.

    Regards

    Darren
    Darren Green, Apr 13, 2008
    #9
  10. Darren Green

    Merv Guest

    On Apr 13, 7:22 am, Darren Green
    <> wrote:
    > > when you say " the ping is always initiated from a host on my LAN
    > > 212.X.X.113" is that the NAT'ed or the unNAT'ed source IP address on
    > > the LAN ?

    >
    > > So you can do an extended ping using source of 212.x.x.114
    > > successfully but not 212.x.x.113 - is that correct ?

    >
    > > in additon to the debug ip icmp, you may also want to do a debug on
    > > the nat translation

    >
    > The host is a server on Fa0/1 (Nat inside) - IP = 10.20.0.10 and this is
    > natted to the 213.x.x.114 address when exiting Dialer 10 (Nat outside).
    >
    > IP address 213.X.X.113 /30 is the secondary address on Fa0/1 and was
    > used for testing purpose.
    >
    > I will give the debug ip nat translation a whirl in addition to ICMP and
    > see what that tells me.
    >
    > Regards
    >
    > Darren


    So possible reasons not to receive a ping response:

    1. ICMP echo packet sourced from 10.20.0.10 does not get routed to
    outgoing ISDN dialer interface

    2. NAT does not occur properly on outgoing interface

    3. Far-end does not route ICMP echo packet properly to destination.

    4. Far-end does not know how to route ICMP echo reply back to your
    router


    Let us know how your next set of testing goes
    Merv, Apr 13, 2008
    #10
  11. Darren Green

    Darren Green Guest

    Merv wrote:
    > On Apr 13, 7:22 am, Darren Green
    > <> wrote:
    >>> when you say " the ping is always initiated from a host on my LAN
    >>> 212.X.X.113" is that the NAT'ed or the unNAT'ed source IP address on
    >>> the LAN ?
    >>> So you can do an extended ping using source of 212.x.x.114
    >>> successfully but not 212.x.x.113 - is that correct ?
    >>> in additon to the debug ip icmp, you may also want to do a debug on
    >>> the nat translation

    >> The host is a server on Fa0/1 (Nat inside) - IP = 10.20.0.10 and this is
    >> natted to the 213.x.x.114 address when exiting Dialer 10 (Nat outside).
    >>
    >> IP address 213.X.X.113 /30 is the secondary address on Fa0/1 and was
    >> used for testing purpose.
    >>
    >> I will give the debug ip nat translation a whirl in addition to ICMP and
    >> see what that tells me.
    >>
    >> Regards
    >>
    >> Darren

    >
    > So possible reasons not to receive a ping response:
    >
    > 1. ICMP echo packet sourced from 10.20.0.10 does not get routed to
    > outgoing ISDN dialer interface
    >
    > 2. NAT does not occur properly on outgoing interface
    >
    > 3. Far-end does not route ICMP echo packet properly to destination.
    >
    > 4. Far-end does not know how to route ICMP echo reply back to your
    > router
    >
    >
    > Let us know how your next set of testing goes
    >

    Will do.

    I think the next window to do this is likely to be back end of Week,
    Thursday poss Friday. Will post update then.

    Regards

    Darren
    Darren Green, Apr 13, 2008
    #11
  12. Darren Green

    Darren Guest

    Darren Green wrote:
    > Merv wrote:
    >> On Apr 13, 7:22 am, Darren Green
    >> <> wrote:
    >>>> when you say " the ping is always initiated from a host on my LAN
    >>>> 212.X.X.113" is that the NAT'ed or the unNAT'ed source IP address on
    >>>> the LAN ?
    >>>> So you can do an extended ping using source of 212.x.x.114
    >>>> successfully but not 212.x.x.113 - is that correct ?
    >>>> in additon to the debug ip icmp, you may also want to do a debug on
    >>>> the nat translation
    >>> The host is a server on Fa0/1 (Nat inside) - IP = 10.20.0.10 and this is
    >>> natted to the 213.x.x.114 address when exiting Dialer 10 (Nat outside).
    >>>
    >>> IP address 213.X.X.113 /30 is the secondary address on Fa0/1 and was
    >>> used for testing purpose.
    >>>
    >>> I will give the debug ip nat translation a whirl in addition to ICMP and
    >>> see what that tells me.
    >>>
    >>> Regards
    >>>
    >>> Darren

    >>
    >> So possible reasons not to receive a ping response:
    >>
    >> 1. ICMP echo packet sourced from 10.20.0.10 does not get routed to
    >> outgoing ISDN dialer interface
    >>
    >> 2. NAT does not occur properly on outgoing interface
    >>
    >> 3. Far-end does not route ICMP echo packet properly to destination.
    >>
    >> 4. Far-end does not know how to route ICMP echo reply back to your
    >> router
    >>
    >>
    >> Let us know how your next set of testing goes
    >>

    > Will do.
    >
    > I think the next window to do this is likely to be back end of Week,
    > Thursday poss Friday. Will post update then.
    >
    > Regards
    >
    > Darren


    Would you believe it.

    Came to cut this over again this evening and it all worked OK. Haven't
    had to modify anything, how frustrating. Upshot is I don't know what the
    issue was & never got the chance the try the various bits of
    troubleshooting suggested.

    Thanks to all who responded.

    Regards

    Darren
    Darren, Apr 23, 2008
    #12
  13. Darren Green

    Merv Guest

    On Apr 23, 4:00 pm, Darren <>
    wrote:
    > Darren Green wrote:
    > > Merv wrote:
    > >> On Apr 13, 7:22 am, Darren Green
    > >> <> wrote:
    > >>>> when you say " the ping is always initiated from a host on my LAN
    > >>>> 212.X.X.113" is that the NAT'ed or the unNAT'ed source IP address on
    > >>>> the LAN ?
    > >>>> So you can do an extended ping using source of 212.x.x.114
    > >>>> successfully but not 212.x.x.113 - is that correct ?
    > >>>> in additon to the debug ip icmp, you may also want to do a debug on
    > >>>> the nat translation
    > >>> The host is a server on Fa0/1 (Nat inside) - IP = 10.20.0.10 and this is
    > >>> natted to the 213.x.x.114 address when exiting Dialer 10 (Nat outside).

    >
    > >>> IP address 213.X.X.113 /30 is the secondary address on Fa0/1 and was
    > >>> used for testing purpose.

    >
    > >>> I will give the debug ip nat translation a whirl in addition to ICMP and
    > >>> see what that tells me.

    >
    > >>> Regards

    >
    > >>> Darren

    >
    > >> So possible reasons not to receive a ping response:

    >
    > >> 1. ICMP echo packet sourced from 10.20.0.10 does not get routed to
    > >> outgoing ISDN dialer interface

    >
    > >> 2. NAT does not occur properly on outgoing interface

    >
    > >> 3. Far-end does not route ICMP echo packet properly to destination.

    >
    > >> 4. Far-end does not know how to route ICMP echo reply back to your
    > >> router

    >
    > >> Let us know how your next set of testing goes

    >
    > > Will do.

    >
    > > I think the next window to do this is likely to be back end of Week,
    > > Thursday poss Friday. Will post update then.

    >
    > > Regards

    >
    > > Darren

    >
    > Would you believe it.
    >
    > Came to cut this over again this evening and it all worked OK. Haven't
    > had to modify anything, how frustrating. Upshot is I don't know what the
    > issue was & never got the chance the try the various bits of
    > troubleshooting suggested.
    >
    > Thanks to all who responded.
    >
    > Regards
    >
    > Darren



    maybe the network engineer at the other side reads this newsgroup
    too ;-))
    Merv, Apr 23, 2008
    #13
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?V0pQQw==?=

    Can not ping myself, but can ping others

    =?Utf-8?B?V0pQQw==?=, Dec 25, 2004, in forum: Wireless Networking
    Replies:
    6
    Views:
    5,927
    Chuck
    Dec 26, 2004
  2. Bob Simon
    Replies:
    8
    Views:
    7,082
    John Lamar
    Jan 19, 2005
  3. Mark Green

    ISDN line up but no ping

    Mark Green, Apr 7, 2004, in forum: Cisco
    Replies:
    10
    Views:
    4,020
    Mark Green
    Apr 17, 2004
  4. sync
    Replies:
    0
    Views:
    543
  5. aar78
    Replies:
    0
    Views:
    602
    aar78
    Jul 31, 2008
Loading...

Share This Page