Unable to ping host through VPN instance (vrf)

Created: Jan 21, 2020 10:57:44Latest reply: Jan 22, 2020 11:54:30 84 3 0 0
  Rewarded Hi-coins: 0 (problem resolved)

Hi

I have 2linux boxes which are configures through VPN instance
on switch S6720.

Switch configuration is:

ip vpn-instance test
 ipv4-family
  route-distinguisher 100:1
interface Vlanif100
 ip binding vpn-instance test
 ip address 10.10.10.1 255.255.255.0
#
interface Vlanif925
 ip binding vpn-instance test
 ip address 10.0.100.0 255.255.255.254

verifications are:

<HUAWEI>display ip routing-table vpn-instance test
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: test
         Destinations : 4        Routes : 4        

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

     10.0.100.0/31  Direct  0    0           D   10.0.100.0      Vlanif925
     10.0.100.0/32  Direct  0    0           D   127.0.0.1       Vlanif925
     10.10.10.0/24  Direct  0    0           D   10.10.10.1      Vlanif100
     10.10.10.1/32  Direct  0    0           D   127.0.0.1       Vlanif100

Vlan 925 linux box verification:

 ping 10.0.100.1 -s 10.0.100.0
PING 10.0.100.1 (10.0.100.1) 10(38) bytes of data.
18 bytes from 10.0.100.1: icmp_seq=1 ttl=64
18 bytes from 10.0.100.1: icmp_seq=2 ttl=64
^C
--- 10.0.100.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1007ms
ping 10.10.10.1 -s 10.0.100.0
PING 10.10.10.1 (10.10.10.1) 10(38) bytes of data.
18 bytes from 10.10.10.1: icmp_seq=1 ttl=254
18 bytes from 10.10.10.1: icmp_seq=2 ttl=254
^C
--- 10.10.10.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1031ms
ping 10.10.10.2 -s 10.0.100.0 
PING 10.10.10.2 (10.10.10.2) 10(38) bytes of data.
^C
--- 10.10.10.2 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1000ms

But vlan 100 box sees packets:

tcpdump -nvvi enp129s0f0 icmp
tcpdump: listening on enp129s0f0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:52:17.170111 IP (tos 0x0, ttl 63, id 11024, offset 0, flags [DF], proto ICMP (1), length 38)
    10.0.100.1 > 10.10.10.2: ICMP echo request, id 19525, seq 1, length 18
12:52:17.170166 IP (tos 0x0, ttl 64, id 14543, offset 0, flags [none], proto ICMP (1), length 38)
    10.10.10.2 > 10.0.100.1: ICMP echo reply, id 19525, seq 1, length 18
12:52:18.192501 IP (tos 0x0, ttl 63, id 11173, offset 0, flags [DF], proto ICMP (1), length 38)
    10.0.100.1 > 10.10.10.2: ICMP echo request, id 19525, seq 2, length 18
12:52:18.192537 IP (tos 0x0, ttl 64, id 15126, offset 0, flags [none], proto ICMP (1), length 38)
    10.10.10.2 > 10.0.100.1: ICMP echo reply, id 19525, seq 2, length 18

Vlan 100 linux box can ping all too except vlan 925box:

[suser]#ping 10.0.100.0 -s 10.10.10.2 
PING 10.0.100.0 (10.0.100.0) 10(38) bytes of data.
18 bytes from 10.0.100.0: icmp_seq=1 ttl=254
18 bytes from 10.0.100.0: icmp_seq=2 ttl=254
^C
--- 10.0.100.0 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms

[suser]# ping 10.0.100.1 -s 10.10.10.2  
PING 10.0.100.1 (10.0.100.1) 10(38) bytes of data.
^C
--- 10.0.100.1 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 999ms

Event tcpdump on vlan 925box is empty.


But switch see and ping all hosts:

<HUAWEI>ping -a 10.10.10.1 -vpn-instance test 10.0.100.1
  PING 10.0.100.1: 56  data bytes, press CTRL_C to break
    Reply from 10.0.100.1: bytes=56 Sequence=1 ttl=64 time=1 ms
    Reply from 10.0.100.1: bytes=56 Sequence=2 ttl=64 time=1 ms
    Reply from 10.0.100.1: bytes=56 Sequence=3 ttl=64 time=1 ms
    Reply from 10.0.100.1: bytes=56 Sequence=4 ttl=64 time=1 ms
    Reply from 10.0.100.1: bytes=56 Sequence=5 ttl=64 time=1 ms

  --- 10.0.100.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 1/1/1 ms

<HUAWEI>ping -a 10.0.100.0 -vpn-instance test 10.10.10.2 
  PING 10.10.10.2: 56  data bytes, press CTRL_C to break
    Reply from 10.10.10.2: bytes=56 Sequence=1 ttl=64 time=1 ms
    Reply from 10.10.10.2: bytes=56 Sequence=2 ttl=64 time=1 ms
    Reply from 10.10.10.2: bytes=56 Sequence=3 ttl=64 time=1 ms
    Reply from 10.10.10.2: bytes=56 Sequence=4 ttl=64 time=1 ms
    Reply from 10.10.10.2: bytes=56 Sequence=5 ttl=64 time=1 ms

  --- 10.10.10.2 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 1/1/1 ms


  • x
  • convention:

Featured Answers
Popeye_Wang
Admin Created Jan 21, 2020 11:12:47 Helpful(0) Helpful(0)

Hello Dzyan,
Do not use a 31-bit mask unless the direct link is a P2P link.
please change the IP address of the Vlanif925 test again.
  • x
  • convention:

All Answers
Popeye_Wang
Popeye_Wang Admin Created Jan 21, 2020 11:12:47 Helpful(0) Helpful(0)

Hello Dzyan,
Do not use a 31-bit mask unless the direct link is a P2P link.
please change the IP address of the Vlanif925 test again.
  • x
  • convention:

chenhui
chenhui Admin Created Jan 22, 2020 03:35:49 Helpful(0) Helpful(0)

Hi @Dzyan
could you please provide the interface configuration?
  • x
  • convention:

HaseebAkhtar
HaseebAkhtar Created Jan 22, 2020 11:54:30 Helpful(0) Helpful(0)

can you please share little topology and interface configurations... it seems like an arp drop issue
  • x
  • convention:

An%20enthusiastic%20network%20Engineer%20who%20also%20wants%20to%20be%20a%20programmer

Comment

Reply
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login