CloudLabBox
Try the free demo

Multi-vendor troubleshooting lab 7 of 12

NAT and asymmetric routing in a mixed edge

A depot adds a second internet line on a MikroTik beside its FortiGate, and three tickets follow: a published server that answers on one public address only, a partner site that can be pinged but not loaded, and an office whose traffic dies at the firewall. Trace each flow both ways and repair the return path.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 4,352 MB in total. That fits the free demo too.

In your workspace: Shared, then Multi-vendor interoperability and troubleshooting guided labs, then 07 - NAT and asymmetric routing in a mixed edge

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 80 minutes
Nodes need
6 vCPU, 4,352 MB
Smallest plan
Lite

The scenario

Larkfield's Goole depot has always used a FortiGate (FW1) on ISP-A. To survive an outage, and to get a bigger line for staff, they've added a MikroTik (GW2) on ISP-B, on the same LAN. Servers still use FW1 as their gateway. Staff PCs now use GW2. The partner's booking system only accepts ISP-A's address, so GW2 has a route to the partner through FW1. The goods-in office hangs off GW2, on its own subnet.

Three tickets came in the morning after the change:

  1. Customers: the tracking portal works at 203.0.113.3 but hangs at 198.51.100.3, the address published for ISP-B.
  2. Depot staff: the partner's booking system at 172.16.50.10 can be pinged but won't load.
  3. Goods-in: their office can't reach the partner at all, although it reaches the internet through ISP-B.
DeviceInterfaceAddressNotes
ISPGi0/0203.0.113.1/29ISP-A
ISPGi0/1198.51.100.1/29ISP-B
ISPGi0/2192.0.2.1/24, 172.16.50.1/24Internet and partner
FW1port1203.0.113.2/29Publishes 203.0.113.3 to S1:80
FW1port210.50.0.1/24Gateway for servers
GW2ether1198.51.100.2/29, .3/29Publishes .3 to S1:80
GW2ether210.50.0.2/24Gateway for staff
GW2goods-in10.51.0.1/24The goods-in office
S1eth010.50.0.20/24Tracking portal, gateway FW1
H1eth010.50.0.10/24Staff PC on the hardened build, gateway GW2
EXTeth0192.0.2.10/24, 172.16.50.10/24A customer on the internet, and the partner's server

What you’ll practise

  • Draw a flow in both directions and find where it stops being symmetric
  • Prove with captures where a return packet really goes
  • Read a stateful drop in FortiGate debug flow and in RouterOS connection tracking
  • Explain why ping can work when TCP doesn't
  • Read a reverse-path drop and fix it with a route
  • Force return traffic through the right device with source NAT, and say what that costs

The tasks

  1. Start the hosts
  2. Confirm the tickets
  3. Follow ticket 1 with a capture
  4. Fix ticket 1 on GW2
  5. Follow ticket 2
  6. Fix ticket 2 on GW2
  7. Follow and fix ticket 3

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of NAT and asymmetric routing in a mixed edge6 nodes and 1 network, 7 links. Every link is listed as text below the diagram.ISPFW1GW2S1H1EXTDepot-LANeth0eth0port2ether2Gi0/0port1Gi0/1ether1Gi0/2eth0
6 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to FW1 port1
  • ISP Gi0/1 to GW2 ether1
  • ISP Gi0/2 to EXT eth0
  • FW1 port2 to Depot-LAN (network)
  • GW2 ether2 to Depot-LAN (network)
  • S1 eth0 to Depot-LAN (network)
  • H1 eth0 to Depot-LAN (network)
Nodes in NAT and asymmetric routing in a mixed edge, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
FW1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
GW2MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
S1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
EXTAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Multi-vendor interoperability and troubleshooting guided labs.

  3. Open 07 - NAT and asymmetric routing in a mixed edge and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Multi-vendor troubleshooting labs

All Multi-vendor troubleshooting labs

Related labs in other courses

CloudLabBox is independent of Arista Networks, Cisco, CompTIA, Fortinet, HPE, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.