No way to ping PBX

[tarikkk]

Hi every body
Here is my network:
I have an entering point router which public adress finishes by 2.82 then a second with 0.137 then a floor router with 3.81 and then a switch with a PBX 3.82 and a PC with 3.84 on the switch
The problem is: when I ping the PBX from a trace server like

http://www.traceroute.org

the trace stops at the 2nd entering building router which adress is 107.
but when I ping the PC the ping replies and pass through 82, 107 and 81 routers
At the same time why the router stops a ping to PBX and not to PC
I reverse the adresses, I put a cross cable in stead of the switch, I changed the PBX, I did almost everything, no way to ping the PBX
I think that if the problem was on PBX the ping should stops at 81 router not 107
I'm getting crazy with this problem, if you have any idea please give it to me
You have to know that on PBX there no firewall functionnality, it's a simple network card.
The default gateway on the PBX and PC is 3.81 adress
Subnnet mask is 255.255.255.248

Thanks in advance

 

[pansophic]

Let me start with a couple of administrative items. 1st, allowing your PBX to be accessed from outside of your local network is a VERY dangerous thing to do, since security on most PBXs is woefully inadequate for the threats that exist on the Internet. 2nd, ping a very effective basic troubleshooting tool that has very little to do with how the network will operate for any given protocol. ICMP (the protocol that ping uses) is a frequently blocked and likely dropped protocol (since it does not carry data, any device that is resource limited will drop the packets). So if a ping works, the host is up and the network is good. If ping doesn't work, you haven't really learned much of anything (unless ping normally works or you are on the same subnet as the other host).

Traceroute is an interesting method for determining the route that a given packet will take. It uses ICMP, so like ping packets it may be blocked along the route (even where other protocols like UDP and TCP are not). But because you are running the traceroute remotely, the interface that will reject or drop the packets is the outbound facing interface, not the inbound facing interface of the router. So while your gateway for the PBX is .3.81, it is the interface on the other side of the router that would be the last to respond or would send the destination unreachable message.

Without a diagram of the network it is difficult to evaluate where your problem might lie, but I would count myself fortunate that the PBX is not accessible from the Internet. If you have a legitimate need to access the PBX remotely, a VPN is the only way (IMHO) to go about providing that access. It could be that the PBX will only respond to ICMP packets from the local subnet. It could be that the PBX doesn't support ICMP (although I would be very surprised if this were the case). It could be that whoever manages the router is blocking ICMP replies from the PBX (although generally you would do that for everything or nothing behind the router).

If you could do an ASCII art diagram or post a network diagram (with sufficiently masked IP addresses of course) that would probably be helpful. It might also help to know the type of PBX (there may be a forum here for that make/model). You can use RFC 1918 Private IP addresses to mask the true address (10.x.x.x or 192.168.x.x).

Personally, I prefer to run hping whenever possible vice traceroute because hping allows you to use the correct protocol and ports to fully evaluate firewall, port forwarding and routing issues.


pansophic

 

[burtsbees]

Pan---the pc on the same subnet replies to pings from the internet, so all edge and inside devices are allowing ICMP, at least echo and echo-reply...

Tar---are you able to ping the PBX from the PC? The path to the PBX is all L2, being on the same subnet, so I would be surprised if you CAN ping the PBX from the pc but NOT the internet!

Also, can you ping the PBX from the edge device?

/

 

[tarikkk]

Yes I can ping the PBX from my PC on the same subnet
That's what's making me crazy

But today I found new amazing things:

I can do VOIP to and from the PBX through internet

The PBX is connected to another one in another country and it works perfectly, but I still can not ping PBX!

Sure that the important thing is that it works since this is what I'm looking for (Voip connectiity)

But I have to recognize that the impossibility to ping the PBX is very strange and has no explanation for me??????
X-files!!!!

 

[burtsbees]

The only explanation is that the PBX itself blocks ICMP. Otherwise, the edge device or something between has to block it specifically to that IP address/MAC address. To narrow it down to

A. The PBX blocks pings
B. Some firewall/router blocks ICMP at layer 2 (MAC address)

try and switch the PBX IP address with the PC IP address. After that (or right now) I would call the PBX vendor to see why the PBX blocks ICMP. I am not a VoIP guru, so I don't know about PBX's...just Cisco R&S and networking in general.

/

 

[tarikkk]

How come I can ping the PBX on the same LAN?
If PBX blocks ICMP I wouln't be able to ping it locally.

Yes I've already switched the adresses, same problem!!!

I've already called the constructor he said "never seen this problem before"!!!! for him the problem is on the network

 

[burtsbees]

Yeah, I'm an idiot...you can ping the PBX on the same LAN...

What lies between the PBX and the internet? Like everything...

/

 

[burtsbees]

Also, what if you made the pc .79 so that they're on different subnets? I would try that, unless my tired eyes missed the part where you tried that...

Definitely a good test---that woould tell you that the PBX is blocking ICMP at layer 3, but allowing layer 2.

/

 

[burtsbees]

Correction...COULD be blocking it at L3...told ya I was tired...

I heard that...

/

 

[tarikkk]

No, I didn't try this because the 80 adress is the id adress of the network,
we have only six adresses from 81 to 86, and I tried all theses adresses

 

[burtsbees]

Ah, public IP's then, T1...

Out of curiosity, why are you not NATting? Is there a static NAT that is wrong (not necessary) in the router? Can you post a config of everything between the PBX and the internet?

/

 

[tarikkk]

Unfortunatlu not
I'm in charge of the PBX only
There's another guy from another company that's in charge of the data router of teh building, and he's not very helpful everything is no for him

 

[burtsbees]

That's because he knows not what he does...lol

That's usually from cranial rectumitis...

Oh, well---"All's well that ends well"---you are able to verify correct function of the PBX, correct?

/

 

[tarikkk]

yeah "all's well that ends well"
Because we can do what we need to do (making VOIP calls)
But the mystery still complete about the ping or may be it's as you said " PBX is blocking ICMP at layer 3, but allowing layer 2". but why this is not true in other networks?????!!!!!

 

[burtsbees]

It is true in other networks...according to this:

"The PBX is connected to another one in another country and it works perfectly, but I still can not ping PBX!"

/