No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Some Services Are Unavailable Due to the Conflict of the IP Mask Ranges

Publication Date:  2012-07-27 Views:  37 Downloads:  0
Issue Description
The networking diagram is as follows:
                     AR2811
                                          |
NE40A------NE40B
           \                         /
               \                   /
                   S2403
As shown in the preceding figure, two NE40 routers realize Layer 3 interconnection through links. VRRP is enabled for the subnet services provided by the terminals connected to the S2403. NE40A is the master router. The AR2811 router is connected with NE40B through a single link. At first, the subnet users attached to the S2403 could access the services under the AR2811. After a while, the users reported that they could not access the network segments attached to the AR2811 again, but they could access services of other network segments normally. That is, the S2403 users could not successfully ping any IP address in the segment attached to the AR2811. The AR2811 users could not successfully ping any IP address in the segment attached to the S2403, but they could successfully ping the VRRP gateway address of the segment attached to the S2403 on the NE40. The AR2811 users can access services of other network segments normally. 
 
Alarm Information
Null
Handling Process
1. From the symptom, the problem occurred only between the segment at the side of the S2403 and the segment at the side of the AR2811. The engineer initially judged the problem was caused by the route.
2. The AR2811 users could successfully ping the VRRP gateway address of the NE40, indicating that the route between the AR2811 and S2403 was normal.
3. The IP addresses of the subnet at the side of the AR2811 could be successfully pinged on NE40A with the VRRP physical IP address, indicating that no problem was with the route between the network segment attached to the S2403 and the segment attached to the AR2811.
4. Further check found no problem with the links between NE40B and the AR2811 and between NE40B and the S2403 or with the status information of the routing table. Thus, the problem may arise at the side of the PCs attached o the NE40 and S2403.
5. The PC attached to the S2403 could successfully ping the IP address of the gateway and IP addresses of other network segments.
6. Mount a PC directly to the S2403 for the test. It was found that the PC could successfully ping the IP addresses of the terminals attached to the AR2811, indicating that the problem must exist on the PC attached to the S2403.
7. Check carefully the network configuration of the PC attached to the S2403. It was found that the mask range of the IP addresses of the PC was set too large, causing the segment conflict.
8. Reset the IP masks of the PC. The problem was thus solved. 
 
Root Cause
In this case, the IP addresses of the S2403 users and those of the AR2811 users were assigned continuously, the former being 10.199.X.32/28 and the latter being 10.199.X.48/28. When the customer set all the terminal masks to 26 bits for S2403 users by mistake, this network segment contained the IP addresses of the subnet users at the side of the AR2811. Thus, the PCs attached to the S2403 could not send any packet whose destination IP address was the same as that of the subnet user at the side of the AR2811. When the PCs processed the packets whose source IP addresses were in the same segment as the PCs were in, the PCs sent the corresponding ARP requests. For the AR2811, the IP addresses of the subnet did not exist at the side of the S2403. Therefore, the AR2811 would not respond to the ARP requests and the PCs would directly discard such packets. For packets whose destination IP addresses are in other segments, the PCs directly sent the packets to the NE40 through the default gateway. That was why the PCs could access other services normally. In addition, because the masks of VRRP addresses on the NE40 were correctly set, the AR2811 users could successfully ping the VRRP gateway address on the NE40. The NE40 with the VRRP gateway address could also successfully ping the IP addresses of the subnet at the side of the AR2811.  
Suggestions
Null

END