Resources
    Transparent ZBF, IRB, and ...
    09 July 10

    Transparent ZBF, IRB, and VRF troubleshooting.

    Posted byINE
    facebooktwitterlinkedin
    news-featured

    "Why doesn't this PING work!?!"

    Here is a simple 3 router configuration, well at least it is simple on 2 of the 3 routers. R1 and R3 are configured quite traditionally, but R2 is a bit more involved.
    Here is the diagram.

    ZBF Transparent VRF R2

    Here are the details.

    R2 is using a VRF which includes both LAN interfaces. R2 is also acting as a Zone Based Firewall in transparent mode, allowing all ICMP traffic in both directions, as well as SSH from the inside to the outside networks. R2 has a bridged virtual interface in the 10.123.0.0/24 network. All are running OSPF, but pings issued from R2 to the loopbacks of R1 and R3 are failing.

    Can you identify why?
    Here is the relevant output:

    R1#show ip ospf neighbor
    Neighbor ID Pri State Dead Time Address Interface
    3.3.3.3 1 FULL/DR 00:00:39 10.123.0.3 FastEthernet0/0
    10.123.0.2 1 FULL/BDR 00:00:32 10.123.0.2 FastEthernet0/0
    R1#show ip route ospf
    3.0.0.0/32 is subnetted, 1 subnets
    O 3.3.3.3 [110/2] via 10.123.0.3, 00:01:33, FastEthernet0/0

    R1#ping 3.3.3.3
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 60/88/172 ms
    R1#ssh -l admin 3.3.3.3
    Password: <password>

    R3#show ssh
    Connection Version Mode Encryption Hmac State Username
    0 1.99 IN aes128-cbc hmac-sha1 Session started admin
    0 1.99 OUT aes128-cbc hmac-sha1 Session started admin
    %No SSHv1 server connections running.
    R3#exit

    [Connection to 3.3.3.3 closed by foreign host]
    R1#

    Now for R2:

    R2#show ip ospf neighbor
    Neighbor ID Pri State Dead Time Address Interface
    1.1.1.1 1 FULL/DROTHER 00:00:37 10.123.0.1 BVI1
    3.3.3.3 1 FULL/DR 00:00:35 10.123.0.3 BVI1

    R2#show ip route ospf

    R2#show policy-map type inspect zone-pair
    Zone-pair: zp-in-to-out

    Service-policy inspect : p-in-to-out

    Class-map: c-in-to-out (match-any)
    Match: protocol icmp
    4 packets, 320 bytes
    30 second rate 0 bps
    Match: protocol ssh
    3 packets, 72 bytes
    30 second rate 0 bps
    Inspect
    Packet inspection statistics [process switch:fast switch]
    tcp packets: [4:390]
    icmp packets: [0:50]

    Session creations since subsystem startup or last reset 8
    Current session counts (estab/half-open/terminating) [0:0:0]
    Maxever session counts (estab/half-open/terminating) [2:1:1]
    Last session created 00:02:23
    Last statistic reset never
    Last session creation rate 0
    Maxever session creation rate 3
    Last half-open session total 0

    Class-map: class-default (match-any)
    Match: any
    Drop (default action)
    0 packets, 0 bytes
    Zone-pair: zp-out-to-in

    Service-policy inspect : p-out-to-in

    Class-map: c-out-to-in (match-all)
    Match: protocol icmp
    Inspect
    Packet inspection statistics [process switch:fast switch]
    icmp packets: [0:20]

    Session creations since subsystem startup or last reset 2
    Current session counts (estab/half-open/terminating) [0:0:0]
    Maxever session counts (estab/half-open/terminating) [1:1:0]
    Last session created 00:25:24
    Last statistic reset never
    Last session creation rate 0
    Maxever session creation rate 1
    Last half-open session total 0

    Class-map: class-default (match-any)
    Match: any
    Drop (default action)
    4 packets, 96 bytes

    R2#ping 3.3.3.3
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
    .....
    Success rate is 0 percent (0/5)

    R2# show run
    version 12.4
    hostname R2
    !
    ip vrf myvrf
    !
    class-map type inspect match-any c-in-to-out
    match protocol icmp
    match protocol ssh
    class-map type inspect match-all c-out-to-in
    match protocol icmp
    !
    policy-map type inspect p-in-to-out
    class type inspect c-in-to-out
    inspect
    class class-default
    policy-map type inspect p-out-to-in
    class type inspect c-out-to-in
    inspect
    class class-default
    !
    zone security inside
    zone security outside
    zone-pair security zp-in-to-out source inside destination outside
    service-policy type inspect p-in-to-out
    zone-pair security zp-out-to-in source outside destination inside
    service-policy type inspect p-out-to-in
    bridge irb
    !
    interface FastEthernet0/0
    ip vrf forwarding myvrf
    no ip address
    zone-member security inside
    bridge-group 1
    !
    interface FastEthernet0/1
    ip vrf forwarding myvrf
    no ip address
    zone-member security outside
    bridge-group 1
    !
    interface BVI1
    ip vrf forwarding myvrf
    ip address 10.123.0.2 255.255.255.0
    !
    router ospf 1 vrf myvrf
    router-id 10.123.0.2
    network 0.0.0.0 255.255.255.255 area 0
    !
    bridge 1 protocol ieee
    bridge 1 route ip
    end

    Here is R3:

    R3#show ip ospf neighbor
    

    Neighbor ID Pri State Dead Time Address Interface
    1.1.1.1 1 FULL/DROTHER 00:00:32 10.123.0.1 FastEthernet0/1
    10.123.0.2 1 FULL/BDR 00:00:31 10.123.0.2 FastEthernet0/1

    R3#show ip route ospf
    1.0.0.0/32 is subnetted, 1 subnets
    O 1.1.1.1 [110/2] via 10.123.0.1, 00:29:36, FastEthernet0/1

    R3#ping 1.1.1.1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 76/117/176 ms
    R3#

    Similar configuration scenarios are included in both our RS and SC workbooks at INE.

    Take a moment, and post your ideas on why the PING from R2 is failing, and thanks for taking the time to assist!

    Best wishes.

    © 2024 INE. All Rights Reserved. All logos, trademarks and registered trademarks are the property of their respective owners.
    instagram Logofacebook Logotwitter Logolinkedin Logoyoutube Logo