WAN Alias IP for specific hosts in LAN

Hi mftitalia 

Your rule configuration is fine for outbound traffic. Any traffic generated from machine 192.168.1.93 towards WAN zone will be NAT by IP 2.2.2.131 based on rule settings.

What is the output of packet request and drop packets on XG while you are browsing traffic from machine 192.168.1.93 ?

command for packet request:

console > tcpdump 'host X.X.X.X.

where X.X.X.X is the outside  Public IP for which you are checking PING from 1.93 machine ( Like 8.8.8.8 or 4.2.2.2)

command for drop packet

console > drop 'host X.X.X.X

Thanks for support! =)

The problem is that 192.168.1.93 is unable to ping and is unable to browsing... no way to comunicate with internet

Tracert end to firewall ip 192.168.1.1

The output of the command is strange... look like the sophos wont answer the arp

Console > tcpdump 'host 2.2.2.131.

12:37:53.204067 Port2, OUT: IP 2.2.2.131 > 8.8.8.8: ICMP echo request, id 1,
 seq 1750, length 40                                                            
12:37:58.204300 Port2, OUT: IP 2.2.2.131 > 8.8.8.8: ICMP echo request, id 1,
 seq 1751, length 40                                                            
12:37:58.226668 Port2, IN: ARP, Request who-has 2.2.2.131 tell 2.2.2.129
, length 46                                                                     
12:38:03.204689 Port2, OUT: IP 2.2.2.131 > 8.8.8.8: ICMP echo request, id 1,
 seq 1752, length 40                                                            
12:38:03.227238 Port2, IN: ARP, Request who-has 2.2.2.131 tell 2.2.2.129
, length 46            

Btw this is the ports configuration:

Could be this the problem?

Command:

Console > drop 'host 2.2.2.131

doen't say nothing...

console> drop 'host 2.2.2.131                                               
                                                                                
 

Hi mftitalia 

Thanks for sharing the packet request and drop packets.

From the packets it has been observed the issue is with WAN router. There is an ARP connectivity problem between XG and WAN router 2.2.2.129 for alias IP 2.2.2.131.

In packet request it is giving message who has 2.2.2.131 tell 2.2.2.129. Which means 2.2.2.129 doesn't have ARP or connectivity for 2.2.2.131.

Is there any chance to reboot the router connected on Port2 to re learn the ARP of IPs and that may fix this issue.

Please check the Internet after reboot of WAN Port2 router and confirm the tcpdump if still it is giving ARP issue or not.

=(

After reboot:

console> tcpdump 'host 2.2.2.131.                                           
tcpdump: Starting Packet Dump                                                   
13:21:48.335365 Port2, IN: ARP, Request who-has 2.2.2.131 tell 2.2.2.129
, length 46                                                                     
13:21:51.668108 Port2, IN: ARP, Request who-has 2.2.2.131 tell 2.2.2.129
, length 46                                                                     

Sorry i misunderstood.. i restarted the firewall before, now i restarted the Cisco of the FTTH... i will know you what happen

Same condition:

I restarted Sophos and restarted Cisco, the situation is the same:

13:32:30.426581 Port2, IN: ARP, Request who-has 2.2.2.131 tell 2.2.2.129
, length 46                                                                     
13:32:43.396830 Port2, IN: ARP, Request who-has 2.2.2.131 tell 2.2.2.129
, length 46                                                                     
13:33:05.908182 Port2, IN: ARP, Request who-has 2.2.2.131 tell 2.2.2.129
, length 46

I tryed to connect a notebook with static IP 2.2.2.131/29 and the notebook works, it can browsing using 2.2.2.131 so the problem cannot be the Cisco.. at least i think..

Hi mftitalia 

You may check and confirm below step as well if there is any possibility to interrupt current setup & settings for a while. 

Note: Please take a backup of current configuration before below changes.

================================

a)Please delete Alias of 2.2.2.131 from Port2 settings.

b)On Port2 main interface settings assign 2.2.2.131 IP( in place of 2.2.2.130) with other settings as it is and on existing rule of system 192.168.1.93, select NAT with "MASQ" and confirm gateway status green or RED with this setup. If gateway gets green then ARP is getting learned and you may confirm via below console command as well.

console> sy dia uti arp sh 2.2.2.131

c)If still issue there then you may try by changing the Interface of XG to confirm is it working with another Interface or not. ( Note : While configuring another Interface with network 2.2.2.X, you need to wiped out settings of Port2 ).

=========================

If all above fails then revert setting to original and log a support case to conclude it further.

After resetted and reconfigured the interface, both on door 2 and on door 5, everythings work... no comment... is not possibile to have this kind of problems...

After resetted and reconfigured the interface, both on door 2 and on door 5, everythings work... no comment... is not possibile to have this kind of problems...