Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a multihomed windows server.

  • It has two physical interfaces A (192.168.1.140) and B (10.42.130.140)
  • From machines on the same subnet both interfaces are pingable
  • From a 3rd subnet B is pingable but A is not
  • The windows machines default route is via interface A however there is a static route to the 3rd subnet via interface B

When you ping A from the third subnet the router reports that outbound connections from interface A are actually been sent out of interface B (and thus denied).

The goal is to be able to have both interfaces pingable from the 3rd subnet 10.42.100.0/24. The network topology is fairly simple, three switches each with only their own subnet traffic A, B and C connected via a Cisco ASA 5520. There are other minor subnets around however they are not really relevant to the issue at hand.

This looks like windows isn't responding from the right interface (the interface it got the request in on) and is pushing all it's traffic out via which ever route it deems best. Is there any way to bind traffic to the correct interface? I'd even accept a Cisco ASA rule to allow the traffic (it's dropping the SYN ACK) out of the B subnet.

The routing table of the windows machine looks like so:


IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 13 72 36 e5 30 ...... Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)
0x10004 ...00 13 72 36 e5 32 ...... Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client) #2
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.1.30    192.168.1.140     20
        10.42.0.0      255.255.0.0      10.42.130.1    10.42.130.140      1
      10.42.130.0    255.255.255.0    10.42.130.140    10.42.130.140     10
    10.42.130.140  255.255.255.255        127.0.0.1        127.0.0.1     10
   10.255.255.255  255.255.255.255    10.42.130.140    10.42.130.140     10
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      192.168.1.0    255.255.255.0    192.168.1.140    192.168.1.140     20
    192.168.1.140  255.255.255.255        127.0.0.1        127.0.0.1     20
    192.168.1.255  255.255.255.255    192.168.1.140    192.168.1.140     20
        224.0.0.0        240.0.0.0    10.42.130.140    10.42.130.140     10
        224.0.0.0        240.0.0.0    192.168.1.140    192.168.1.140     20
  255.255.255.255  255.255.255.255    10.42.130.140    10.42.130.140      1
  255.255.255.255  255.255.255.255    192.168.1.140    192.168.1.140      1
Default Gateway:      192.168.1.30
===========================================================================
Persistent Routes:
  None

Thanks

share|improve this question
4  
Please post the output of "route PRINT" from the Windows box. Also, is there any other way for the packets to be router between subnet A and B from C? An explanation of the network topology would be helpful. –  Hyppy Mar 21 '11 at 13:18
    
What's the Cisco ASA have to do with Windows Server Routing?? –  Chris S Mar 21 '11 at 13:42
    
At least tell us the network address of the third subnet! –  ultrasawblade Mar 21 '11 at 13:43
    
@Hyppy, included and the topology is very simple, safe to assume any/any permit IP rules between each subnet. –  Antitribu Mar 21 '11 at 13:50
    
@Chris S, the Cisco is handling the routing between the subnets, I've edited that into the question –  Antitribu Mar 21 '11 at 13:51
show 1 more comment

1 Answer 1

If you are trying to get traffic, including ICMP pings, across a different subnet, then forwarding needs to be involved. or the interfaces need to be on a router. Other than enabling Internet Connection Sharing, which restricts the IP ranges handed out on a second interface, I don't know how to enable IP forwarding on Windows.

Your 3rd subnet sounds like it shares some of the same network bits as interface B, and that's why you can ping B.

The proper way to do what you are trying to do is change the IP of interface A to be in the same subnet as interface B, and make sure your 3rd subnet is also the same subnet.

share|improve this answer
    
Routing is enabled on the Cisco ASA and it handles passing traffic between the sites. I'm not trying to enable forwarding or routing on the Windows box at all. I'm trying to have windows respond to traffic on the interface it received it from, so if I ping 192.168.1.140 on interface A my reply should come from A not B which it currently is. The IP addresses can not be changed and merging the subnets unfortunately isn't feasible either. –  Antitribu Mar 22 '11 at 9:49
    
Have you done any tracert's? Have you also confirmed traffic paths with tools other than ping, for example, do you have a service listening on 192.168.1.140 (and only 192.168.1.140) that you can possibly confirm as reachable from 10.42.130.140? –  ultrasawblade Mar 22 '11 at 15:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.