NetVanta 3200 T1 Branch Office Internet Access

[ranweb]

I just recently install two NetVanta 3200 on both ends of a T1 to a branch office.  I have the ability to access production network from the branch office; however, I can't get out to the internet, which is accessed via the production network.  I can ping the gateway. 

I believe I have a routing loop since when I ping from the branch office, say to Google.com, I get a TTL expired in transit.

Here is some configuration and routing

Production Network: 10.20.0.0/16 - A SIDE

Branch Office Network: 172.21.1.0/24 - B SIDE

Router (A-Side)

eth0/1:      10.20.15.45/16

ppp1          10.10.10.1/30

Routing Table

Router (B-Side

eth0/1:       172.21.1.0/24

ppp1;          10.10.10.2/30

Any assistance would be great! 

Randy

[jayh · Accepted solution]

On your A-side production network, you have your default 0.0.0.0/0 route pointed back to the PPP1 interface.  This default route should have a next-hop of your NAT firewall connected out to your ISP.

You should also have a static route to 172.21.1.0/24 with a gateway of 10.10.10.2

On your B-side router all you really need is a default route pointing to 10.10.10.1 on the other end of the PPP link because it's the only link out to both Production and the Internet.

It's best practice generally to reference the other side IP address rather than the interface.

So, you should wind up with something like this as your only static routes:

A-Side Production:

Destination          Mask                       Next-hop

0.0.0.0                    0.0.0.0                    [inside IP of firewall - 10.20.5.2 perhaps?]

172.21.1.0          255.255.255.0         10.10.10.2

B-side Branch

0.0.0.0               0.0.0.0               10.10.10.1

You will also need to configure your NAT firewall with the 172.21.1.0 network having permission to NAT out to the Internet just as the 10.20.0.0 subnet does.  And you'll have to add a static route on the firewall like this so it can get back to the branch office:

172.21.1.0          255.255.255.0  [10.20.X.Y - interface IP of Production router]

[ranweb]

jayh,

Thank you for the information.  I was over-thinking the problem and creating bigger problem for myself.  I used your input and I now have everything talking and my branch office is now on the internet.

Thank you very much!!!!!!