Routing – Problem in routing the network in GNS3

I'll go ahead and provide some more "in-depth" instructions on telling GNS3 to use a "remote hypervisor" (a dynamips instance listening on another machine).

You can even use this setup with Amazon EC2 (or another utility computing provider). A setup with a utility computing provider would also be extremely useful for testing out topologies with a very large number of routers, to see how OSPF may behave at scale, etc. I've documented how to do this at my last job (but this was before GNS3 was so popular) and we used it successfully for numerous scale tests. This would also be ideal for folks that don't want to spend the money on a high-end server but can afford to spend a few dollars for a few hours of "server time" for GNS3 labs, without chewing up CPU cycles on their home machines.

The following instructions assume your remote hypervisor is running Linux.

Step One: Set up your Linux box.

jjensen@jjensen-dev:~$ mkdir dynamips
jjensen@jjensen-dev:~$ cd dynamips
jjensen@jjensen-dev:~/dynamips$ mkdir tmp

Step Two: Set up GNS3. Edit -> IOS images and hypervisors. Click the "External Hypervisors" tab. Add in the IP address info for your remote hypervisor (Most of the time you can leave all the fields besides IP address as the default). Once you've filled in the IP of your remote hypervisor, click "Save".

Once you have your remote hypervisor added, go back to the "IOS images" tab and add in IOS images. There are two important bits to remember:

Use the "Linux format" directory notation (see screenshot), and make sure that the "use the hypervisor manager" checkbox is unchecked so that you can select the remote hypervisor that you just added. When adding the IOS image with the remote hypervisor, make sure that your remote hypervisor is selected.

Once you have your IOS image added, start up Dynamips on your remote machine.

jjensen@jjensen-dev:~/network_eng/dynamips$ sudo ./dynamips-0.2.8-RC3-community-x86_64.bin -H 7200 &

You should now be able to add devices to GNS3 topologies on your Windows machine, and GNS3 will communicate with the remote hypervisor on another machine. You also get the console access via PuTTy and such for free as well. Note that there isn't really a "configuration limit" on how you want to add your IOS images and hypervisors. You could even have it so that you have a separate remote hypervisor per IOS image if you wanted. Pretty powerful stuff.

If anyone could add additional answers on how to make this work with JunOS/"virtual" Olive, I think that would also be pretty useful. :-)

Since Router 1 is on an outside interface of Router 2, it will not be able to originate traffic to the inside of Router 2. You have configured inside source NAT on Router 2, and this is one-way. Addresses are translated from the inside to the outside. When traffic is originated from the inside, NAT creates a table entry in order for responding traffic to be translated, but it has no table entry for traffic originated from the outside.

Running NAT on links where you are running a routing protocol is a very bad idea.

Edit based on your updated information:

If you need or want the firewall to know about the routes on the other side of Router 2, you will need to somehow get the routes into the firewall's routing table, otherwise any traffic for the unknown networks will be sent toward the default route for the firewall, and that should be the WAN.

A router, including the routing process of your firewall, needs to have a route in its routing table for any network to which it is expected to forward traffic. A default route can be used to encompass all networks, and any more specific routes in the routing table are used. Since your firewall's routing table has no routes to the networks on the other side of Router 2, it will use its default route.

You can configure your firewall to participate in OSPF with your two routers, and that will place those routes in the firewall's routing table. It will also let you originate the default route into OSPF from the firewall, and then you should remove that from the other routers.

The other, less desirable, solution is to manually configure static routes in your firewall for the networks to which it has no direct connection. This doesn't scale, and when you add, remove, or change those networks, you will need to manually change the static routes in the firewall.