Uploaded image for project: 'Help-Desk'
  1. Help-Desk
  2. HELP-57

FIWARE.Request.Lab.Spain.MD-VPN issues at FI-LAB 10.0.3.45/21

    Details

    • Type: extRequest
    • Status: Closed
    • Priority: Major
    • Resolution: Done
    • Fix Version/s: Sprint 4.1.1
    • Component/s: FIWARE-LAB-HELP
    • Labels:
      None
    • HD-Node:
      Spain

      Description

      Hi,
      I created a testing VM in the FI-LAB region. The VM got assigned a private
      IPv4 address of 10.0.3.45, and I also added a floating IP 130.206.83.11. I
      can access the public IPv4 just fine, but it seems that the private,
      XIFI-federated IPv4 range is having some troubles.

      Here's how a tracepath looks from one of our nodes at CESNET:

      [root@potemkin02 ~]# tracepath 10.0.3.45

      1: 10.0.96.132 (10.0.96.132) 0.138ms pmtu
      9100

      1: no reply

      2: 62.40.124.41 (62.40.124.41) 1.049ms

      3: 62.40.124.41 (62.40.124.41) 0.983ms pmtu
      1488

      3: no reply

      4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.677ms asymm
      17

      5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 34.591ms asymm
      16

      6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.565ms asymm
      15

      7: ae7.mx1.dub.ie.geant.net (62.40.98.92) 34.530ms asymm
      14

      8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.546ms asymm
      13

      9: 62.40.102.15 (62.40.102.15) 34.323ms asymm
      11

      10: 10.0.0.1 (10.0.0.1) 34.403ms

      11: no reply

      12: no reply

      13: no reply

      14: no reply

      15: no reply

      16: no reply

      17: no reply

      18: no reply

      19: no reply

      20: no reply

      21: no reply

      22: no reply

      23: no reply

      24: no reply

      25: no reply

      26: no reply

      27: no reply

      In contrast, this is how a testing tracepath looks from the VM I launched:

      [root@test-el6-1 ~]# traceroute 10.0.96.1
      traceroute to 10.0.96.1 (10.0.96.1), 30 hops max, 60 byte packets
      1 10.0.0.1 (10.0.0.1) 20.300 ms 20.272 ms 20.243 ms
      2 130.206.82.1 (130.206.82.1) 29.885 ms 29.851 ms 29.832 ms
      3 130.206.82.1 (130.206.82.1) 2936.241 ms !H 2936.227 ms !H 2936.205
      ms !H

      Could you please confirm that this is expected to work? Unfortunately, the
      information about the allocation and utilization of the XIFI-wide federated
      IPv4 space is rather scarce in varioud public deliverables. It's well
      possible that this use case is not supposed to work at all. Could you
      please clarify that?

      With kind regards,
      Jan


      Trojitá, a fast Qt IMAP e-mail client – http://trojita.flaska.net/
      _______________________________________________
      Fiware-lab-help mailing list
      Fiware-lab-help@lists.fi-ware.org
      https://lists.fi-ware.org/listinfo/fiware-lab-help

        Activity

        Hide
        FIWARE-LAB-HELP FIWARE-LAB-HELP added a comment -

        I don't think that "ping" is a reliable tool in this case, anyway. —
        Yes, I can admit you can ping a 10.0.0.1 from your IP, but FI-LAB's
        10.0.0.1 doesn't respond to ping from 10.0.0.0/8 – In fact, it drops
        those packages.

        BR,
        José Ignacio.

        El 19/05/14 12:39, Jan Kundrát escribió:
        > On Monday, 19 May 2014 12:32:37 CEST, José Ignacio Carretero Guarde
        > wrote:
        >> It seems that somewhere in the european Backbone (62.40.102.15) didn't
        >> find FI-LAB's 10.0.0.1
        >
        > I don't think that the problem is in the GEANT's infrastructure
        > because the CESNET node can reach 10.0.0.1 just fine:
        >
        > [root@potemkin02 ~]# tracepath 10.0.0.1
        > 1: 10.0.96.132 (10.0.96.132) 0.102ms
        > pmtu 9100
        > 1: no reply
        > 2: 62.40.124.41 (62.40.124.41) 1.117ms 3:
        > 62.40.124.41 (62.40.124.41) 0.951ms pmtu 1488
        > 3: no reply
        > 4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.688ms
        > asymm 17 5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 35.294ms asymm 16
        > 6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.594ms
        > asymm 15 7: ae7.mx1.dub.ie.geant.net (62.40.98.92)
        > 35.314ms asymm 14 8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.577ms
        > asymm 13 9: 62.40.102.15 (62.40.102.15)
        > 34.417ms asymm 11 10: 10.0.0.1
        > (10.0.0.1) 34.288ms reached
        > Resume: pmtu 1488 hops 10 back 246
        >
        > In fact, 10.0.0.1 is visible within the trace towards 10.0.3.45 – see
        > hop #10:
        >
        > [root@potemkin02 ~]# tracepath 10.0.3.45
        > 1: 10.0.96.132 (10.0.96.132) 0.142ms
        > pmtu 9100
        > 1: no reply
        > 2: 62.40.124.41 (62.40.124.41) 1.060ms 3:
        > 62.40.124.41 (62.40.124.41) 1.006ms pmtu 1488
        > 3: no reply
        > 4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.700ms
        > asymm 17 5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 34.593ms asymm 16
        > 6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.572ms
        > asymm 15 7: ae7.mx1.dub.ie.geant.net (62.40.98.92)
        > 34.771ms asymm 14 8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.544ms
        > asymm 13 9: 62.40.102.15 (62.40.102.15)
        > 34.359ms asymm 11 10: 10.0.0.1
        > (10.0.0.1) 34.424ms 11: no reply
        >
        > Despite that, I cannot ping 10.0.3.45 from 10.0.96.132. I can ping
        > 10.0.0.1, though.
        >
        > With kind regards,
        > Jan
        >

        ________________________________

        Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
        This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
        http://www.tid.es/ES/PAGINAS/disclaimer.aspx
        _______________________________________________
        Fiware-lab-help mailing list
        Fiware-lab-help@lists.fi-ware.org
        https://lists.fi-ware.org/listinfo/fiware-lab-help

        Show
        FIWARE-LAB-HELP FIWARE-LAB-HELP added a comment - I don't think that "ping" is a reliable tool in this case, anyway. — Yes, I can admit you can ping a 10.0.0.1 from your IP, but FI-LAB's 10.0.0.1 doesn't respond to ping from 10.0.0.0/8 – In fact, it drops those packages. BR, José Ignacio. El 19/05/14 12:39, Jan Kundrát escribió: > On Monday, 19 May 2014 12:32:37 CEST, José Ignacio Carretero Guarde > wrote: >> It seems that somewhere in the european Backbone (62.40.102.15) didn't >> find FI-LAB's 10.0.0.1 > > I don't think that the problem is in the GEANT's infrastructure > because the CESNET node can reach 10.0.0.1 just fine: > > [root@potemkin02 ~] # tracepath 10.0.0.1 > 1: 10.0.96.132 (10.0.96.132) 0.102ms > pmtu 9100 > 1: no reply > 2: 62.40.124.41 (62.40.124.41) 1.117ms 3: > 62.40.124.41 (62.40.124.41) 0.951ms pmtu 1488 > 3: no reply > 4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.688ms > asymm 17 5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 35.294ms asymm 16 > 6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.594ms > asymm 15 7: ae7.mx1.dub.ie.geant.net (62.40.98.92) > 35.314ms asymm 14 8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.577ms > asymm 13 9: 62.40.102.15 (62.40.102.15) > 34.417ms asymm 11 10: 10.0.0.1 > (10.0.0.1) 34.288ms reached > Resume: pmtu 1488 hops 10 back 246 > > In fact, 10.0.0.1 is visible within the trace towards 10.0.3.45 – see > hop #10: > > [root@potemkin02 ~] # tracepath 10.0.3.45 > 1: 10.0.96.132 (10.0.96.132) 0.142ms > pmtu 9100 > 1: no reply > 2: 62.40.124.41 (62.40.124.41) 1.060ms 3: > 62.40.124.41 (62.40.124.41) 1.006ms pmtu 1488 > 3: no reply > 4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.700ms > asymm 17 5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 34.593ms asymm 16 > 6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.572ms > asymm 15 7: ae7.mx1.dub.ie.geant.net (62.40.98.92) > 34.771ms asymm 14 8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.544ms > asymm 13 9: 62.40.102.15 (62.40.102.15) > 34.359ms asymm 11 10: 10.0.0.1 > (10.0.0.1) 34.424ms 11: no reply > > Despite that, I cannot ping 10.0.3.45 from 10.0.96.132. I can ping > 10.0.0.1, though. > > With kind regards, > Jan > ________________________________ Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo. This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at: http://www.tid.es/ES/PAGINAS/disclaimer.aspx _______________________________________________ Fiware-lab-help mailing list Fiware-lab-help@lists.fi-ware.org https://lists.fi-ware.org/listinfo/fiware-lab-help
        Hide
        FIWARE-LAB-HELP FIWARE-LAB-HELP added a comment -

        On Monday, 19 May 2014 12:32:37 CEST, José Ignacio Carretero Guarde wrote:
        > It seems that somewhere in the european Backbone (62.40.102.15) didn't
        > find FI-LAB's 10.0.0.1

        I don't think that the problem is in the GEANT's infrastructure because the
        CESNET node can reach 10.0.0.1 just fine:

        [root@potemkin02 ~]# tracepath 10.0.0.1
        1: 10.0.96.132 (10.0.96.132) 0.102ms pmtu
        9100
        1: no reply
        2: 62.40.124.41 (62.40.124.41) 1.117ms
        3: 62.40.124.41 (62.40.124.41) 0.951ms pmtu
        1488
        3: no reply
        4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.688ms asymm
        17
        5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 35.294ms asymm
        16
        6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.594ms asymm
        15
        7: ae7.mx1.dub.ie.geant.net (62.40.98.92) 35.314ms asymm
        14
        8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.577ms asymm
        13
        9: 62.40.102.15 (62.40.102.15) 34.417ms asymm
        11
        10: 10.0.0.1 (10.0.0.1) 34.288ms reached
        Resume: pmtu 1488 hops 10 back 246

        In fact, 10.0.0.1 is visible within the trace towards 10.0.3.45 – see hop
        #10:

        [root@potemkin02 ~]# tracepath 10.0.3.45
        1: 10.0.96.132 (10.0.96.132) 0.142ms pmtu
        9100
        1: no reply
        2: 62.40.124.41 (62.40.124.41) 1.060ms
        3: 62.40.124.41 (62.40.124.41) 1.006ms pmtu
        1488
        3: no reply
        4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.700ms asymm
        17
        5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 34.593ms asymm
        16
        6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.572ms asymm
        15
        7: ae7.mx1.dub.ie.geant.net (62.40.98.92) 34.771ms asymm
        14
        8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.544ms asymm
        13
        9: 62.40.102.15 (62.40.102.15) 34.359ms asymm
        11
        10: 10.0.0.1 (10.0.0.1) 34.424ms
        11: no reply

        Despite that, I cannot ping 10.0.3.45 from 10.0.96.132. I can ping
        10.0.0.1, though.

        With kind regards,
        Jan


        Trojitá, a fast Qt IMAP e-mail client – http://trojita.flaska.net/
        _______________________________________________
        Fiware-lab-help mailing list
        Fiware-lab-help@lists.fi-ware.org
        https://lists.fi-ware.org/listinfo/fiware-lab-help

        Show
        FIWARE-LAB-HELP FIWARE-LAB-HELP added a comment - On Monday, 19 May 2014 12:32:37 CEST, José Ignacio Carretero Guarde wrote: > It seems that somewhere in the european Backbone (62.40.102.15) didn't > find FI-LAB's 10.0.0.1 I don't think that the problem is in the GEANT's infrastructure because the CESNET node can reach 10.0.0.1 just fine: [root@potemkin02 ~] # tracepath 10.0.0.1 1: 10.0.96.132 (10.0.96.132) 0.102ms pmtu 9100 1: no reply 2: 62.40.124.41 (62.40.124.41) 1.117ms 3: 62.40.124.41 (62.40.124.41) 0.951ms pmtu 1488 3: no reply 4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.688ms asymm 17 5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 35.294ms asymm 16 6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.594ms asymm 15 7: ae7.mx1.dub.ie.geant.net (62.40.98.92) 35.314ms asymm 14 8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.577ms asymm 13 9: 62.40.102.15 (62.40.102.15) 34.417ms asymm 11 10: 10.0.0.1 (10.0.0.1) 34.288ms reached Resume: pmtu 1488 hops 10 back 246 In fact, 10.0.0.1 is visible within the trace towards 10.0.3.45 – see hop #10: [root@potemkin02 ~] # tracepath 10.0.3.45 1: 10.0.96.132 (10.0.96.132) 0.142ms pmtu 9100 1: no reply 2: 62.40.124.41 (62.40.124.41) 1.060ms 3: 62.40.124.41 (62.40.124.41) 1.006ms pmtu 1488 3: no reply 4: ae2.mx1.fra.de.geant.net (62.40.98.53) 34.700ms asymm 17 5: ae1.mx1.ams.nl.geant.net (62.40.98.129) 34.593ms asymm 16 6: ae2.mx1.lon.uk.geant.net (62.40.98.80) 34.572ms asymm 15 7: ae7.mx1.dub.ie.geant.net (62.40.98.92) 34.771ms asymm 14 8: ae1.mx2.dub.ie.geant.net (62.40.98.91) 34.544ms asymm 13 9: 62.40.102.15 (62.40.102.15) 34.359ms asymm 11 10: 10.0.0.1 (10.0.0.1) 34.424ms 11: no reply Despite that, I cannot ping 10.0.3.45 from 10.0.96.132. I can ping 10.0.0.1, though. With kind regards, Jan – Trojitá, a fast Qt IMAP e-mail client – http://trojita.flaska.net/ _______________________________________________ Fiware-lab-help mailing list Fiware-lab-help@lists.fi-ware.org https://lists.fi-ware.org/listinfo/fiware-lab-help
        Hide
        FIWARE-LAB-HELP FIWARE-LAB-HELP added a comment -

        Hi,

        It seems that somewhere in the european Backbone (62.40.102.15) didn't
        find FI-LAB's 10.0.0.1

        Best regards,
        José Ignacio.

        El 19/05/14 12:03, Jan Kundrát escribió:
        > Hi,
        > I created a testing VM in the FI-LAB region. The VM got assigned a
        > private IPv4 address of 10.0.3.45, and I also added a floating IP
        > 130.206.83.11. I can access the public IPv4 just fine, but it seems
        > that the private, XIFI-federated IPv4 range is having some troubles.
        >
        > Here's how a tracepath looks from one of our nodes at CESNET:
        >
        > [root@potemkin02 ~]# tracepath 10.0.3.45 1:
        > 10.0.96.132 (10.0.96.132) 0.138ms pmtu
        > 9100 1: no reply
        > 2: 62.40.124.41 (62.40.124.41) 1.049ms
        > 3: 62.40.124.41
        > (62.40.124.41) 0.983ms pmtu 1488
        > 3: no reply 4:
        > ae2.mx1.fra.de.geant.net (62.40.98.53) 34.677ms asymm
        > 17 5: ae1.mx1.ams.nl.geant.net
        > (62.40.98.129) 34.591ms asymm 16
        > 6: ae2.mx1.lon.uk.geant.net
        > (62.40.98.80) 34.565ms asymm 15
        > 7: ae7.mx1.dub.ie.geant.net
        > (62.40.98.92) 34.530ms asymm 14
        > 8: ae1.mx2.dub.ie.geant.net
        > (62.40.98.91) 34.546ms asymm 13
        > 9: 62.40.102.15
        > (62.40.102.15) 34.323ms asymm 11
        > 10: 10.0.0.1
        > (10.0.0.1) 34.403ms
        > 11: no reply 12:
        > no reply 13: no reply
        > 14: no reply 15:
        > no reply 16: no reply
        > 17: no reply 18:
        > no reply 19: no reply
        > 20: no reply 21:
        > no reply 22: no reply
        > 23: no reply 24:
        > no reply 25: no reply
        > 26: no reply 27:
        > no reply
        >
        > In contrast, this is how a testing tracepath looks from the VM I
        > launched:
        >
        > [root@test-el6-1 ~]# traceroute 10.0.96.1
        > traceroute to 10.0.96.1 (10.0.96.1), 30 hops max, 60 byte packets
        > 1 10.0.0.1 (10.0.0.1) 20.300 ms 20.272 ms 20.243 ms
        > 2 130.206.82.1 (130.206.82.1) 29.885 ms 29.851 ms 29.832 ms
        > 3 130.206.82.1 (130.206.82.1) 2936.241 ms !H 2936.227 ms !H
        > 2936.205 ms !H
        >
        > Could you please confirm that this is expected to work? Unfortunately,
        > the information about the allocation and utilization of the XIFI-wide
        > federated IPv4 space is rather scarce in varioud public deliverables.
        > It's well possible that this use case is not supposed to work at all.
        > Could you please clarify that?
        >
        > With kind regards,
        > Jan
        >

        ________________________________

        Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
        This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
        http://www.tid.es/ES/PAGINAS/disclaimer.aspx
        _______________________________________________
        Fiware-lab-help mailing list
        Fiware-lab-help@lists.fi-ware.org
        https://lists.fi-ware.org/listinfo/fiware-lab-help

        Show
        FIWARE-LAB-HELP FIWARE-LAB-HELP added a comment - Hi, It seems that somewhere in the european Backbone (62.40.102.15) didn't find FI-LAB's 10.0.0.1 Best regards, José Ignacio. El 19/05/14 12:03, Jan Kundrát escribió: > Hi, > I created a testing VM in the FI-LAB region. The VM got assigned a > private IPv4 address of 10.0.3.45, and I also added a floating IP > 130.206.83.11. I can access the public IPv4 just fine, but it seems > that the private, XIFI-federated IPv4 range is having some troubles. > > Here's how a tracepath looks from one of our nodes at CESNET: > > [root@potemkin02 ~] # tracepath 10.0.3.45 1: > 10.0.96.132 (10.0.96.132) 0.138ms pmtu > 9100 1: no reply > 2: 62.40.124.41 (62.40.124.41) 1.049ms > 3: 62.40.124.41 > (62.40.124.41) 0.983ms pmtu 1488 > 3: no reply 4: > ae2.mx1.fra.de.geant.net (62.40.98.53) 34.677ms asymm > 17 5: ae1.mx1.ams.nl.geant.net > (62.40.98.129) 34.591ms asymm 16 > 6: ae2.mx1.lon.uk.geant.net > (62.40.98.80) 34.565ms asymm 15 > 7: ae7.mx1.dub.ie.geant.net > (62.40.98.92) 34.530ms asymm 14 > 8: ae1.mx2.dub.ie.geant.net > (62.40.98.91) 34.546ms asymm 13 > 9: 62.40.102.15 > (62.40.102.15) 34.323ms asymm 11 > 10: 10.0.0.1 > (10.0.0.1) 34.403ms > 11: no reply 12: > no reply 13: no reply > 14: no reply 15: > no reply 16: no reply > 17: no reply 18: > no reply 19: no reply > 20: no reply 21: > no reply 22: no reply > 23: no reply 24: > no reply 25: no reply > 26: no reply 27: > no reply > > In contrast, this is how a testing tracepath looks from the VM I > launched: > > [root@test-el6-1 ~] # traceroute 10.0.96.1 > traceroute to 10.0.96.1 (10.0.96.1), 30 hops max, 60 byte packets > 1 10.0.0.1 (10.0.0.1) 20.300 ms 20.272 ms 20.243 ms > 2 130.206.82.1 (130.206.82.1) 29.885 ms 29.851 ms 29.832 ms > 3 130.206.82.1 (130.206.82.1) 2936.241 ms !H 2936.227 ms !H > 2936.205 ms !H > > Could you please confirm that this is expected to work? Unfortunately, > the information about the allocation and utilization of the XIFI-wide > federated IPv4 space is rather scarce in varioud public deliverables. > It's well possible that this use case is not supposed to work at all. > Could you please clarify that? > > With kind regards, > Jan > ________________________________ Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo. This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at: http://www.tid.es/ES/PAGINAS/disclaimer.aspx _______________________________________________ Fiware-lab-help mailing list Fiware-lab-help@lists.fi-ware.org https://lists.fi-ware.org/listinfo/fiware-lab-help

          People

          • Assignee:
            jicg José Ignacio Carretero Guarde
            Reporter:
            fw.ext.user FW External User
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: