ICMP REdirect

[Spoutnik]

Hi Guys,

I was wondering if someone's already had this problem. A lot of switches have a function called ICMP redirect. This function is used when you have too routers (Main and another one) and a workstation wants to pass by the main (always supposed to be the default gateway) to join another network even if the better way to go is to pass by the other router. So the main router will send a packet called ICMP redirect to the workstation and tell him to pass directly by the other router. The workstation interpret this packet and create a route in his table to send all packet to the good router. This function is very practical and help to have a clean network without undesired traffic.

But, we discovered that the CLAN board catch theses ICMP redirect packets and use them to create a new route and send all VoIP packets to our firewall. I know the problem is in our main router because there's a 0.0.0.0 route which send all packets to our firewall and when i disabled the ICMP redirect function, all works well. But I don't understand why this Avaya CLAN board can interpret these packets. The CLAN is supposed to use the default gateway when he don't know the network where send a packet.

It's a very normal configuration (to have Main router and firewall in parallel on the same network) and I was wondering if someone's already had this problem. Maybe there will have a firmware release who address this issue.

Thanks for your reply.

Spoutnik

 

[gonzo99]

Hello,

we have a similar problem.

Router is 172.18.4.1 (administered as default gw on clan)
ISDN-Backup-router is 172.18.4.5

sometimes (I think after changes in ATM Backbone when ATM goes down), the Router send a ICMP-Redirect packet to the c-lan-board's.
C-lan-boards use the informations provided to create a dynamic entry in their routing table. So they use (in our case) 172.18.4.5 as Router.
I've seen this making a "trace-route ip ..." and "status ip-interface .. " (ICMP-counters rise)
It seems the c-lan-boards doesen't clear this dynamic entry.
Since the error occurs for different locations (and rarely) it was difficult to figure it out.
Maybe they clear the entries not for all destination-IPs and not every time.

On Cisco-router such a entry will be deleted after 15 minutes. No idea for the c-lan timeout. Maybe days? A "busyout / release c-lan board" has cleared the routing-table. As I remember, not in all cases --> "reset system" is your friend.

Now we switched off ICMP-Redirects on the Router.

Is there a way to configure the ICMP-behavior on c-lan-boards?

If anyone have additional informations about specific C-LAN Firmware issues, please reply to this tread.

Ronny