Static routing in MPLS VPN CE - PE

Similar Questions

• Next hop for the static route on the VPN site to site ASA?

  Hi all

  I would be grateful if someone could help me with my problem ASA/misunderstanding. I have a VPN site-to site on a SAA. I want to add a floating static route to point to the VPN on the ASA. Note that the traffic in this way is not with in subnets cryptographic ACL that is used to bring up the VPN. This VPN is used only as a backup.

  The static route with the next hop add local public address or the remote public address of the VPN? The next break maybe local ASA isp internet facing interface? I intend to do on the ASDM. I'm sorry if it's a simple question but I found no material that explains this?

  Concerning

  Ahh, ok, makes sense.

  The next hop should be the next jump to the interface that ends the VPN connection, essentially the same as your Internet connection / outside the next hop interface.

  Example of topology:

  Site B (outside interface - 1.1.1.1) - (next hop: 1.1.1.2) Internet

  The static route must tell:

  outdoor 10.2.2.2 255.255.255.255 1.1.1.2 200

  I hope this helps.

• Static route of VPN in EIGRP redistribution (FD is Inaccessible)

  Hi all

  I redistribute the site to site VPN static route in EIGRP, but what I noticed on the 6509 when I sh ip eigrp 200 topol, the static route to the ASA "FD is inaccessible."

  6509 output:

  Topology EIGRP-IPv4 for AS(200)/ID(10.33.95.34 table)

  Code: P - passive, A - Active, U - update, Q - Query, R - reply,.

  r response status, s - AIS status

  P 199.x.x.240/28, successors 1, FD 53760, tag is 36539

  through reallocation (53760/0)

  P 10.64.129.0/24, successors 1, FD is 28416

  Via 10.210.98.200 (28416/28160), Vlan98

  P 10.1.2.0/24, 0 successors, FD is Inaccessible

  Via 10.210.98.200 (28416/28160), Vlan98

  P 10.210.98.0/24, successors 1, FD is 2816

  Via connected, Vlan98

  ASA5510 output:

  Topology EIGRP-IPv4 for AS(200)/ID(10.64.129.253 table)

  Code: P - passive, A - Active, U - update, Q - Query, R - reply,.

  r response status, s - AIS status

  P 10.1.2.0 255.255.255.0 successors 1, FD is 28160

  Via Rstatic (28160/0)

  P 10.64.129.0 255.255.255.0 successors 1, FD is 28160

  Via connected, Ethernet0/0

  P 199.x.x.240 255.255.255.240, successors 1, FD 79360, tag is 36539

  Via 10.210.98.254 (79360/53760), Ethernet0/1

  P 10.210.98.0 255.255.255.0 successors 1, FD is 28160

  Via connected, Ethernet0/1

  The ASA config:

  200SW_EIGRP list standard access allowed 10.1.2.0 255.255.255.0

  permissible static in eigrp route map 10

  200SW_EIGR match ip address

  Router eigrp 200

  redistribute static static in eigrp route map

  external route 10.1.2.0 255.255.255.0 x.x.x.

  Thank you

  Thomas,

  When the flight director is not accessible in the EIGRP topology table, the router does not use this EIGRP route in its routing table.

  Probably, the road is overridden by any other routing protocol that has the lowest administrative distance.

  Could you please share the routing table?

  Thank you.

• Static routing LRT214 does not

  Hello

  I have a hard time with a static routing on LRT214.

  My configuration:

  * LRT214 (recently purchased), acting as a gateway to the internet, local subnet is 192.168.28.0/24

  * There is a local VPN (192.168.28.98) server on the local network, serving a LAN tunnel with subnet 192.168.29.0/24. on LRT214 port forwarding is configured

  I can connect to my VPN server on the internet, and I can access the machine running on the VPN server (for example via ssh).

  However, I can not connect to any other computer on my LAN, although I tried

  adding another subnet under Configuration > network > LAN settings

  * setting up a static route under Setup > Advanced Routing (kind of route add - net 192.168.29.0/24 gw 192.168.28.98)

  of course, when I add the itinerary of statitc over any computer on the local network, I can connect via VPN tunnel to the machine, so its clearly a problem of LRT214.

  Please help, how can I configure a static route for this scenario in the user Web interface?

  The SPI Firewall, intercept traffic.

  As far as I understand, it could be that when the VPN server sends data to another machine on the local network, this happens on layer 2 (where the SPI Firewall not listening), while the return on the VPN server traffic is routed higher up in the stack, where the SPI listening and intercept.

  So, I will use the above workarounds, or put the OpenVPN server on a different subnet or VLAN, which I do anyway. I tried a basic configuration of VLAN yesterday (just put the Server full VPN with all interfaces in one VLAN separated), with InterVLAN routing enabled, but there seems to be some particularities with it (like the ping works, but not ssh). In any case, it's another story. Thanks for you support.

• Remove the static route by default

  Hello

  I have a switch L3 which has a static default route pointing to a FW that is connected to a circuit of the Internet. The same L3 switch made EIGRP routers on our MPLS network. If this default static route disappears EIGRP will inject a default route, and users will receive their Internet traffic through the MPLS cloud as a backup.

  My question is how to remove this static road by default with a mechanism that is unique on the Internet circuit. I can't count on line protocol because it almost never goes down. I can't rely on Internet ping IP SLA addresses because if they descended through the Internet channel available on the circuits quickly and create a loop of the SLA of intellectual property.

  I wish I could do BGP with the Internet provider but this circuit is in a country where it would be difficult.

  Any ideas on how to remove this default static route based on something that is unique to this tour of the Internet.

  Thank you

  P.

  "I can't rely on Internet addresses ping IP SLA because if they descended through the Internet channel available on the circuits quickly and create a loop IP SLA."

  To remedy this situation, you must add a route with the 'permanent' switch at the end of any IP you track on your IPSLA... In this way, if this interface is down, your ping IPSLA would stop and IPSLA would be the move and change your default route.

  Example:

  Route IP 1.1.1.1 255.255.255.255 2.2.2.2 Permanent

  where 1.1.1.1 is the IP address, you are followed and 2.2.2.2 is your 'usual' default gateway

• Adding static route to the ACS

  How can I add a static route to my device SE ACS?

  I try to get AAA works on a Cisco 871 is an end of distance of a vpn s2s ASA to 871. On the router, I use as the source for Ganymede interface vlan1.

  My ACS server is on the subnet for my ASA management, but the GBA to the Remote LAN road is via its default gateway and interface from the INSIDE of the SAA. I need to get the traffic of Ganymede ACS to return through the management interface of ASA.

  Thanks in advance.

  John

  John,

  There is no way to set a static route in the GBA unit. The only network settings, you can set are the ip address/subnet, default gateway and dns servers.

  Kind regards

  ~ JG

  Please mark it is resolved so other can benefit from

• AnyConnect customers not to follow the internal static routes on ASA5505

  I just bought an ASA 5505 for my remote access to our internal network users.  I followed all the installation instructions, that I can find.  I am able to establish a VPN connection by using the Anyconnect client and can see some of my internal network. (In fact, only the subnet of the interface internal)  However, I have several subnets inside of my LAN which are then sent by another switch inside my LAN.  I have built in the correct static routes so that the ASA will send traffic to this internal routing for all subnets switch doesn't do not part of it is inside the subnet of the interface.  I can see and ping these subnets of the SAA itself but the AnyConnect client cannot.  Any suggestions on how to solve this problem would be greatly appreciated.

  Hello

  Please, add these lines and give it a try:

  inside_nat0_outbound list of permitted access 192.168.0.0 255.255.0.0 192.168.1.0 255.255.255.0

  access-list allowed inside_nat0_outbound 203.250.0.0 255.255.0.0 192.168.1.0 255.255.255.0

  inside_nat0_outbound to access extended list ip 172.100.0.0 255.255.0.0 allow 192.168.1.0 255.255.255.0

  inside_nat0_outbound to access extended list ip 210.105.0.0 255.255.0.0 allow 192.168.1.0 255.255.255.0

  Kind regards

  Note the useful messages!

  Julio

• I can't add/subnet mask 31 255.255.255.254 ISP WAN > static IP setting in VPN Firewall SRX5308

  Hello

  I can't add/subnet mask 31 255.255.255.254 ISP WAN > static IP setting in VPN Firewall SRX5308. When I try to apply it, I get the popup error message like "invalid IP subnet mask. Please enter 0/128/192/224/240/248/252 for octet 4 ". I try to add provider NTU fiber optic internet service in one of the 4 WAN settings. The vendor gave me a 31 block IP and the subnet as 255.255.255.254 mask. It is a limitation in this firewall? I have to ask the provider to give me a 30 block the IP instead? With 30 block IP subnet mask will be 255.255.255.252 who is authorized by this firewall setting. I tried this on another (SnapGear SG560) firewall and it works without any problem. See the screenshots below. Can someone please?

  

  

  concerning

  Ridwan

  / 31 would be used in specific scenarios where you * really * need to keep the address space and on links only point to point. To be honest I've never met anyone, or any ISP that uses it. It works on point to point, because, well, there no need to broadcast address because there are only two devices on the link (one on each side of the cable)... IP address ranges would be;. 0-. 1,.2-. 3, etc.

  Most (if not all) Netgear devices will prevent you from setting 31, but you will probably be able to use without problem in all 30 cases, according to the setup of the ISP I do not think that it would cause you problems really. But if you can, I would certainly ask a 30 instead.

• Static route / network Configuration?

  I have a cable modem that connects via Ethernet (eth0) of a configuration for NAT and Firewall Linux box.  Another card (eth1) connects to a switch for my cable network (192.168.1.1/24).  I added a third adapter (eth2 - 192.168.2.1/24) which is connected to a M20 (192.168.2.2).  The server DHCP M20 has been implemented to serve the 192.168.3.1/24 network.

  Is there a configuration more simple than that?

  Problems reported with the current configuration:

  (1) I think the M20 NAT function must be disabled because the Linux machine is.  However, disable NAT causes machines on 192.168.3 bad connection to the internet.

  (2) I want the machines wirelessly on 192.168.3 to see shared windows on 192.168.1 and vice versa.  Currently they do not see each other.  If I remove M20 and plug a PC eth2 and set as 192.168.2.2, this machine can see actions on 192.168.1 and vice versa.  I think a static route must be set on the M20 so that he knows what to do with traffic to 192.168.1.  However, I don't properly because he always tells me I have an invalid route when I try to enter.

  (3) is there one another device other than on the M20 motorway which would better suit my needs (adding a wireless to my private/internal network segment)?

  Kind regards

  Case No.

  OK, I just saw the previous thread on this question pop up on the first page,

  Valet parking can be defined as an access point only?

  I'll try the posted instructions here.

• Help! Static route between two router WRT160NL

  Hi all

  I have my internet connection to connect to my main router from Linksys WRT160NL (192.168.1.1) with 192.168.1.x.

  My 2nd Linksys router to connect to the first gateway as well.
  The 2nd router has the ip 192.168.1.100 WAN and it's a local subnet as 192.168.2.x.

  My 192.168.2.x machines can access the internet and connect to all the machines in the network 192.168.1.x.

  However, the 1.x network cannot access the machines on the network of the 2. And because of that, I can't share or print between two networks.

  I try to add static routes on my main router (192.168.1.1) with the road: 192.168.2.0 mask 255.255.255.0 and default gateway 192.168.1.100

  However, the road does not work yet.

  in any case to ensure that the 1.x network able to access the network 2.x and 2.x access 1.x file and print sharing.

  Thanks for your help!

  Gateway of the router does NAT who made the side inaccessible side LAN WAN, unless you configure port forwarding automatic or similar. If she would not make your LAN 192.168.1 would be accessible from the internet. Static routing will not change that.

  You will need to disable NAT (aka switch to router mode) on the second router. You must configure a static route on the main router then. However, most likely your network 192.168.2 * will not have Internet more because the main router will NAT for 192.168.1. * and no 192.168.2. *.

  If possible set up the second router as access point only and run a LAN.

• Connecting two routers via a static route

  I have a relatively simple configuration involving a Wireless-N Router and a wireless-B router (several years).  The N wireless router is connected to the internet (via DSL modem) and accepts several DHCP clients without problem.  Wireless - b router is connected to the Wireless-N router.  To do this, I connected the WAN port on the router wireless - b to a port on the router Wireless N ethernet (did not use the uplink). I have a PC connected to the router wireless - b, so I want him to be able to hit the internet, but also be accessible to DHCP clients on the Wireless N router.  The PC connects to the internet successfully, but it does not find clients on the network supported by the Wireless-N router.  It's about my setup:

  B 192.168.55.1 wireless router (LAN) 192.168.56.102 (WAN)

  PC 192.168.55.10 (active dhcp)

  Wireless N 192.168.56.1 (LAN) x.x.x.x (internet)

  (several clients dhcp... 192.168.56.100...)

  I've added a static route in the hope that a computer on the network of the Wireless N router would be able to hit the PC, but nothing helped. I've added a static route as such, on the Wireless-N router, which was the only way that that would enable the web interface:

  Destination LAN 192.168.55.0

  Subnet mask 255.255.255.0

  Gateway 192.168.56.102

  I tried to place the router without wireless - B gateway mode, then router and changed mode, then return.  I can connect to the web interface of the router wireless - b from the PC, and I can connect to the internet from the PC.  Also, the PC is able to reach customers on Wireless N, but the reverse is not true, i.e. clients on Wireless N can't find clients on the wireless - B network. Also, I turned on the port forwarding on the router wireless - B so that it points to the PC, in the hope he would lead all traffic to the PC, but still cannot access PC.  How to configure both routers (or both set up as access point?) so that clients on the Wireless N Router can talk to customers on the wireless router - B?  For now, all customers are on DHCP, but finally, I would like to create static entries for at least two or three of them.

  Thanks in advance

  Are Linksys routers teas? If so what model is router B? It may not supported for a DHCP client port forwarding. Even if you can get the port forwarding to work for a client on router B, it will not work for several clients.

  In addition, if you have the option in router B, disable the SPI Firewall. It is the cause of the problem, in my opinion. If you do this, you should port forward.

  Is there a reason that you connect the routers via the WAN port on the router B? You could uplink using an ethernet port on the B to an ethernet port on the N and avoid all this... You can always configure router B as a point of wireless access for specific customers.

• Add a static route to a RV042

  I have configured the RV042 dual WAN port for backup smart link connected to two different ISPS.  The subnet behind this is 192.168.2.xxx.  I have a second router linksys Garland with the 192.168.2.250 WAN port and subnet behind it is 192.168.20.xxx.  My problem is that I have a not able to route traffic fron 192.168.2.xxx to 192.168.20.xxx.  How can I add a static route so that clients on 192.168.2.xxx can access resources on 192.168.20.xxx?

  1. the second Linksys router must be changed of gateway (active NAT) in router mode (NAT disabled) mode. With NAT the LAN behind the second Linksys will be not accessible from the outside unless you configure port forwarding.

  2. on the RV042 set up a static route for the subnet 192.168.20.0/255.255.255.0 to the gateway IP address 1921.68.2.250 on the LAN interface.

  3. Ideally, you must configure the same static route on all clients connected to the RV042. If you don't want to do this, you must configure the firewall on all clients on the RV042 accept ICMP redirect messages. This is important because otherwise all traffic from 192.168.2. * to * 192.168.20 would be sent to the RV042 and from there to the second Linksys that is unnecessary and could create a bottleneck.

• Static routing question

  I just took a WRT610N and configure a few static routes for my network.

  I have the router connected to a cable modem WAN and the interface of local network connected to my LAN via 192.168.0.1.

  I have three other LAN subnets in a test environment, they are:-

  172.16.0.0/24

  172.16.100.0/24

  172.16.200.0/24

  I tried to add the following to the first subnet:

  Destination = 172.16.0.0 LAN IP address

  Subnet mask = 255.255.255.0

  Gateway = 172.16.0.1

  Interface = LAN

  No matter what I try, I get a message saying route static invalid, and I can't get anything to stick.  Everyone can't see what I'm doing wrong?

  Thank you guys!

  Gary

  The IP address of the gateway in a static route is the IP address of the connected device directly on each side of the router, either on the ethernet LAN or WAN side.

  In particular you cannot route a subnet of an IP address of the gateway inside the target IP subnet. The static route example you deposited directions where to send traffic destined to 172.16.0.0/255.255.255.0. It is impossible to set the address of the gateway as 172.16.0.1 because the router doesn't know where to send the traffic to 172.16.0.1.

  In other words, the IP address of the gateway must in most cases be a 192.168.0. * IP address that you use these IP addresses in the local network of the WRT. The IP address of the gateway should be the IP address of the router on the subnet specific target within your local network.

  For example, if your second router with address 172.16.0.1/255.255.255.0 IP LAN has an IP 192.168.0.2, then the 192.168.0.2 is the IP address of the gateway for the static route to 172.16.0.0/255.255.255.0.

• Redistribution of static routes in OSPF

  Hi all

  It seems that the static routes can still live even if the designated interface went down.

  I added a description for this problem file.

  Stephen,

  I don't know why the distribution list did not work. Did you include the permit all at the end of the access list? Without it, you wouldn't get the external routes, as you journey.

  I have just re-read the documentation for the ip route, 12.2 and 12.4, ' cos I wasn't aware of the useful form of the command that Rick suggested. Here is an excerpt:

  Specifying a next digital jump which is on a directly connected interface will prevent the router to use Proxy ARP. However, if the next hop interface breaks down and the digital next hop can be reached by a recursive route, you can specify hop and the following interface (for example "ip route 0.0.0.0 0.0.0.0 Ethernet1/2 10.1.2.3") with a static route to avoid the roads pass through an unintentional interface.

  Which describes your problem exactly, I think. He comes:

  http://www.Cisco.com/en/us/products/SW/iosswrel/ps1835/products_command_reference_chapter09186a00800ca75a.html#wp1018065

  Therefore, the interface specification that force the static route to use only a local next hop.

  Kevin Dorrell

  Luxembourg

• By default static route with recevied BGP default route

  Hi guys;

  I have a problem and I don't know how to find or solve it.

  My chart is attached, please check everything first.

  Secondly, I have a multihomed BGP with two Internet service providers, I received two ISPS via BGP default route.

  Now, I have two types of IP addresses as follows:

  1 - my own prifixes, who has recorded with my ACE

  2 - iPs purchased ISP2.

  I have two networks, the first will contain my own prefixes and second will contain my prifixes ISP2. so I have to go on the internet, static route by default to the ISP2 need and that's fine, now the problem that carry the second defect I received two ISPS in routing however my table if I show ip bgp I see that I received it, but because of favorite and distancing China he disappear the default road statistics.

  so now a network is already online and the second network that contain my own IPs is out of service, of course this second network I need to routed to my isps1 via bgp and when isps1 down, go through ISP2 and I do using weight and as path prefix.

  Thank you

  Hi Nathan,

  With ACB option, you config-route map is your own prefix and set its next hop ISP 1 and 2 PSI when ISP 1 IP is not accessible. Apply the road map to interface with Network1. ACB is processed before routing.

  With option VRF, put the Network1 interface and isps1 VRF1, so it will have separate routing table. Under the vrf1 you static default config with higher AD and the next hop pointing to ISP2 in the global routing table. This will be used when you lose by default isps1. Because separate ridges VRF table routing, so netwoek1 will use the default route in vrf1 to isps1 as primary, the Network2 use ISP2.

  HTH,
  Lei Tian

  Sent by Cisco Support technique iPhone App