This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos fire wall Dual stack Control Center/system interfaces WAN link manager is red why not green?

Hi All,

I recently added IPv6 support to XG FW and something says not right. I have pubic v6 address on WAN link, 2 private ranges on LAN and DMZ . I am using router advertisement for IPv6. The FW rules show traffic on v6 both directions, The v6 test web sites give it 10/10 pass (https://test-ipv6.com/). 1/2 my traffic volume in reports is v6. It all works great.!

However the gateway and interfaces turned red after I set this up and persist today, is it really broken? seems fine to me. Thoughts anyone?

This thread was automatically locked due to age.

Top Replies

LuCar Toni 6 months ago in reply to wilspin +1 suggested

Click on the starlink, and change the monitoring option. The firewall will try to reach out to the health check client and if this is not reachable (the gateway) then it will be shown as red.

Parents

0 emmosophos 6 months ago

Hello Daniel,

Thank you for contacting the Sophos Community.

What IP are the interfaces Pinging if you go to the WAN Link Manager? In order for this to change from RED to Green, it has to hear back from the IP being Pinged, if it doesn't then the interface turns RED.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 wilspin 6 months ago in reply to emmosophos

Hey Emmanuel,

Ping does not work for IPv6, that is why we have red. The result is blank with OK button, no verbose at all.Wan link manager is pinging the default gateway (GW) on my router. This is a DHCP generated setting from the router. this is the same GW address used by all machines connected to this router. They all can ping the GW but not Sophos FW. BTW the IP is a link-local address, (FE80:::) I suspect that is not liked by FW.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 6 months ago in reply to wilspin

Hi,

the link local address is usually the destination gateway address. Please post a copy of your WAN manager settings?

Ian

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 wilspin 6 months ago in reply to rfcat_vk

here:
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni 6 months ago in reply to wilspin

Click on the starlink, and change the monitoring option. The firewall will try to reach out to the health check client and if this is not reachable (the gateway) then it will be shown as red.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 wilspin 6 months ago in reply to LuCar Toni

Yes I tried changing that option, did not solve anything. The question is why is it not reachable? The IPv4 gateway is fine. Lots of traffic on both. How can I have v6 traffic if the gateway is not available? Clearly it is. Just not to that management tool.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 6 months ago in reply to wilspin

Maybe the starlink is not setup to respond to ping?

In that case change the ping test to your local interface and try access again.

Ian

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 wilspin 6 months ago in reply to rfcat_vk

quote from above;'

this is the same GW address used by all machines connected to this router. They all can ping the GW
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 6 months ago in reply to wilspin

Edit and save your WAN link interface, otherwise try a restart of the XG. There are a number of older threads on a similar vain.

Ian

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni 6 months ago in reply to wilspin

Please show us the gateway, which is selected there and a proof, you can ping it from the SFOS firewall. Because this is most likely the case, the firewall cannot reach the gateway via ICMP.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 wilspin 6 months ago in reply to LuCar Toni

I can only ping from other devices not Sophos firewall that is the complaint.
Cancel
Vote Up 0 Vote Down

Cancel
0 wilspin 6 months ago in reply to rfcat_vk

Yes I read those threads, tried the remedies to no avail.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 wilspin 6 months ago in reply to rfcat_vk

Yes I read those threads, tried the remedies to no avail.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data