Docker L3 network routing notworking Sophos XG fireall

Can you give us a network diagram? Doesn’t need to be an artwork.

Hi!

Thank you for your help as requested here with the initial chart:  

Does the VLAN appear on the XG?

Ian

Hi!

There is no VLAN. The debian running the docker does not have a separate VLAN and that's why the docker creates an L3 network. The container can reach the firewall but nothing else. A ping request from the container goes to the host, but back to the firewall, the firewall will prevent the ping from coming back.
For example:
I ping the IP 10.20.55.55 from the ip 192.168.245.250 then I see this in the firewall logs:

Hi!

There is no VLAN. The debian running the docker does not have a separate VLAN and that's why the docker creates an L3 network. The container can reach the firewall but nothing else. A ping request from the container goes to the host, but back to the firewall, the firewall will prevent the ping from coming back.
For example:
I ping the IP 10.20.55.55 from the ip 192.168.245.250 then I see this in the firewall logs:

Hi Opizol As you updated "A ping request from the container goes to the host" -  Are you able to see this ICMP request on XG Firewall or not? OR Directly ICMP reply packets only you are observing on Firewall..!! 

I mean I just wanted to confirm hope it is not an asymmetric routing scenario due to which the firewall is not allowing the reply packets routed via it..!  (This means your ICMP request are routed directly from container to host from Vswitch and when the host generated an ICMP reply that is routed via the firewall, being Firewall as in GW IP - which crates asymmetric routing scenarios on the firewall as the firewall does not have that ICMP request packetes routed via it..! ) 

If it is an asymmetric routing scenario then try to avoid it and if it is still needed then it will be required to add a stateful bypass inspection rule in XG CLI.

Sophos Firewall/Sophos UTM: Identify an asymmetric routing design condition
https://support.sophos.com/support/s/article/KB-000038267?language=en_US

For bypassing stateful inspection command can be found in the below guide and if that is the scenario then to test it you may first try by adding the host-to-host rule to bypass it from stateful inspection and if this allows communication then you may later on replace bypass rule with network as per need.

https://support.sophos.com/support/s/article/KB-000044309?language=en_US

HiVishal_R !

Yes, yes this is the right solution, I tested it today and it works. Thank you very much for your help.

Hi Opizol  Perfect, thanks for sharing the latest feedback here and I am glad you managed to fix the issue with the given suggestions..!