+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 16
Wired Networks Thread, Sanity check my thought process - Internet Connect Cisco Issue in Technical; Hello People, I would like to sanity check my and everybody in my offices thought process on this one. We ...
  1. #1

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349

    Sanity check my thought process - Internet Connect Cisco Issue

    Hello People,

    I would like to sanity check my and everybody in my offices thought process on this one. We have a client who intermittently see's the internet connection drop, We are always able to see the router on its internal and external addresses (both public). What we are not able to see is the Watchguard firewall on the other side of the router. (see attached image - IPS are not correct but just examples).

    During a period of outage the connection between the Cisco and the Watchguard goes down - a duplex mismatch maybe... no both set to 100 Full (already tried that). EDIT: The Watchguard is set to 100 Full, the Cisco auto as when set to 100 full too we got TTL expired in transit

    But what I have noticed is that if from my office I ping the cisco on both its external and internal public IP I get a TTL of 246 (which is correct as 9 router hops to the Cisco), from my office to the Watchguard the TTL is 54! So between the Cisco and the Watchguard which is a direct connection they are losing 192 hops somewhere.

    The other strange thing is to bring the line back up you can either reset the Watchguard OR the rad unit. Both of these devices bring the line up.

    Now in my head I am pointing at the Cisco being at fault for some bizarre reason. The ISP have gone away to look as to what could be causing the issue, but the guy i've been speaking with thinks it could be the firmware on the Rad unit.


    For anybody not familiar with the Rad unit its this EFM DSL Network Termination Unit LA-210 essentially a termination unit for the EFM line which basicly provides the facility to bond the (in this case) 4 pairs.

    Any body any ideas what else it could be? Am I right in thinking this is an issue with the cisco router? (model unknown).

    EDIT: could a mod change the title to Sanity check my thought process - Internet Connection Cisco Issue
    Attached Images Attached Images
    Last edited by glennda; 12th April 2013 at 04:49 PM.

  2. #2
    jamesreedersmith's Avatar
    Join Date
    Sep 2009
    Location
    Ruskington
    Posts
    1,150
    Thank Post
    77
    Thanked 253 Times in 227 Posts
    Rep Power
    76
    Just as a FYI TTL is nothing to do with Hops its to do with DNS caching time i believe

    https://en.wikipedia.org/wiki/Time_to_live

  3. #3

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349
    Quote Originally Posted by jamesreedersmith View Post
    Just as a FYI TTL is nothing to do with Hops its to do with DNS caching time i believe

    https://en.wikipedia.org/wiki/Time_to_live
    Depends if we are talking about TTL for DNS caching or TTL on IP Packets in my case i'm talking about the latter

    The time-to-live value can be thought of as an upper bound on the time that an IP datagram can exist in an Internet system. The TTL field is set by the sender of the datagram, and reduced by every router on the route to its destination. If the TTL field reaches zero before the datagram arrives at its destination, then the datagram is discarded and an ICMP error datagram (11 - Time Exceeded) is sent back to the sender. The purpose of the TTL field is to avoid a situation in which an undeliverable datagram keeps circulating on an Internet system, and such a system eventually becoming swamped by such "immortals".
    as it says its there to stop a packet floating round the internet space for ever if it cannot be routed to its destination.
    Last edited by glennda; 12th April 2013 at 05:03 PM.

  4. #4
    jamesreedersmith's Avatar
    Join Date
    Sep 2009
    Location
    Ruskington
    Posts
    1,150
    Thank Post
    77
    Thanked 253 Times in 227 Posts
    Rep Power
    76
    So what about a trace route to find the hops?

  5. #5

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349
    Quote Originally Posted by jamesreedersmith View Post
    So what about a trace route to find the hops?
    A trace is fine which is what is strange, but occasionally you get a TTL expired in transit. In my head I think the Cisco is doing something strange with its routes but I'm not a Cisco expert!

  6. #6

    Join Date
    Mar 2013
    Location
    west sussex
    Posts
    519
    Thank Post
    74
    Thanked 26 Times in 26 Posts
    Rep Power
    14
    TTL on a Ping result is exactly as @glennda describes.

    IGNORE(what cisco is it?) re-read model unknown!
    Last edited by ConradJones; 12th April 2013 at 08:18 PM.

  7. #7

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349
    yeah its not my Cisco but i'm trying to make sure i don't look a fool to my client!

  8. #8

    Join Date
    Mar 2013
    Location
    west sussex
    Posts
    519
    Thank Post
    74
    Thanked 26 Times in 26 Posts
    Rep Power
    14
    its difficult to say with out looking at it, it could be the cisco or it could be something as simple as an iffy cable. you need to go thing each thing methodically (not always easy, you don't always have an indentically configured everything lying aroung)

  9. #9

    Join Date
    Jan 2009
    Posts
    109
    Thank Post
    3
    Thanked 21 Times in 16 Posts
    Rep Power
    15
    Bad cable.

  10. #10

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349
    Quote Originally Posted by Destinova View Post
    Bad cable.
    I thought that but would it explain the TTL count increase?

    Toby

  11. #11

    Join Date
    Jan 2009
    Posts
    109
    Thank Post
    3
    Thanked 21 Times in 16 Posts
    Rep Power
    15
    Can you post a traceroute to both the router and firewall?

    Also, have you compare the routing tables on both?

    Do a "show interfaces counters errors" on the Cisco device, and look for CRC or Frame errors.

  12. #12

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349
    Quote Originally Posted by Destinova View Post
    Can you post a traceroute to both the router and firewall?

    Also, have you compare the routing tables on both?

    Do a "show interfaces counters errors" on the Cisco device, and look for CRC or Frame errors.
    I don't have access to the Cisco - its supplied by the ISP - from what the engineer says there is no Packet errors or duplex miss matches. I am getting the cables swapped out tomorrow although they have been replaced already.

    I'm not sure if it is the config they have on there cisco's but I have just checked one of the others and it does exactly the same. Ping to router directly TTL=246 ping to firewall behind it TTL=54!

    Bizarre - the traces don't show anything out of the ordinary (not even any time outs).

  13. #13
    nelsons's Avatar
    Join Date
    May 2013
    Location
    Newcastle Upon Tyne
    Posts
    17
    Thank Post
    0
    Thanked 3 Times in 3 Posts
    Rep Power
    3
    Sounds like a routing issue, unlikely to be a loop between the router and the FW as the packet gets there eventually. You will need some output from the ISP to determine the issue. At the very least ask for a show ip int brief | ex unass and also a show ip route and show int counters errors.

    HTH

    Steve
    CCIE#10055

  14. #14

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349
    Quote Originally Posted by nelsons View Post
    Sounds like a routing issue, unlikely to be a loop between the router and the FW as the packet gets there eventually. You will need some output from the ISP to determine the issue. At the very least ask for a show ip int brief | ex unass and also a show ip route and show int counters errors.

    HTH

    Steve
    CCIE#10055
    It looks like the issue was to do with the EFM modem, it had pairs which where flakey and I think as they came up and down it was sending the router into a tizz.

    Should have updated!

  15. #15
    nelsons's Avatar
    Join Date
    May 2013
    Location
    Newcastle Upon Tyne
    Posts
    17
    Thank Post
    0
    Thanked 3 Times in 3 Posts
    Rep Power
    3
    Yip link flapping that would do it ! :-) Glad it's sorted.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Replies: 4
    Last Post: 9th September 2010, 11:59 AM
  2. My LGFL internet connection is down
    By BarriedaleNick in forum London Grid for Learning (LGfL)
    Replies: 0
    Last Post: 7th November 2009, 09:02 PM
  3. Internet Connections
    By 20RickY06 in forum General Chat
    Replies: 7
    Last Post: 6th September 2006, 08:56 AM
  4. Laptop, 2 nics, 2 networks - internet connection problem
    By WithoutMotive in forum Wireless Networks
    Replies: 3
    Last Post: 27th July 2006, 12:14 PM
  5. Unfiltered Internet Connection
    By richard in forum How do you do....it?
    Replies: 16
    Last Post: 22nd April 2006, 08:23 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •