Can't ping Synology NAS from another VLAN

Hi Kam,

Correct me if I'm wrong; this is how I understand your setup.

And the issue you’re facing is, as shown, traffic with a red mark

Can you check using the diagnostic tools if you'll get a ping reply here? image show below

I tried diagnostics - 4 packets transmitted, 0 packets received.. I even tried with disconnecting the first port (VLAN 10), the same result.

Did you physically disconnect the NAS from the VLAN?

Ian

Of course. The first port with VLAN 10. So only second port with VLAN 2 is now connected to switch.

Run 

console>tcpdump ‘host <ip address> and proto ICMP

Run ping again from GUI and share the output

I'm not great at console, but managed to run tcpdump. Next performed diagnostic test as before, but still the same result - 4 packets sent, 0 packets received.

OK. Tried again without proto:
6 packets captured
6 packets received by filter
0 packets dropped by kernel

How many LAN interfaces has this Synology NAS?

Are you using other LAN ports on that NAS with different IP networks?

Where is the default gateway of the NAS pointing to?

NAS has two LAN interfaces - LAN 1 and LAN 2. Both has fixed IP, gateways and DNS. LAN 1 has IP X.X.10.103 and is member of MGMT VLAN, LAN 2 has IP X.X.2.100 and is member of NAS VLAN. Each VLAN has its own gateway, which is VLAN network address.

Seems issue with the switch and NAS configuration, for troubleshoot add any other windows/linux system and check trace route

Also, share interface snapshots from Sophos GUI with switch configuration.

Regards

I have VLANS on separate ports on Sophos. As for Synology, LAN 1 is connected to switch port 5, LAN 2 is connected to switch port 7. On the Unifi switch, each access port setup is the same and each tagged port setup is the same.

It seems that you are trying to do a router on a stick. So the firewall should be the one to route the traffic to different vlans.

Let's check the firewall if it can send the traffic to your Synology. Try this Advance shell command:

Syntax:

ip route get {IP of destination (IP synology)}  

• This will show where traffic to the synology will be forwarded to

ping -a {source IP of firewall interface} {IP of destination (IP synology)}

• This will confirm if the VLAN interface has access to the synology

So kindly test with Port 3,5,4 and 6 if which one has access.

Since this traffic is also a LAN - LAN kindly make sure that you have a permitted LAN-LAN rule

It seems that you are trying to do a router on a stick. So the firewall should be the one to route the traffic to different vlans.

Let's check the firewall if it can send the traffic to your Synology. Try this Advance shell command:

Syntax:

ip route get {IP of destination (IP synology)}  

• This will show where traffic to the synology will be forwarded to

ping -a {source IP of firewall interface} {IP of destination (IP synology)}

• This will confirm if the VLAN interface has access to the synology

So kindly test with Port 3,5,4 and 6 if which one has access.

Since this traffic is also a LAN - LAN kindly make sure that you have a permitted LAN-LAN rule

It could also be possible that Synology will only accept traffic from a specific network and for that, you would need to configure NAT.

IP ROUTE GET showed me the same as you described in screenshot. Unfortunately PING didn't went well - 41 packets transmitted, 0 packets received. Tried also another ports, but none of them is working for ping. As for the rule, I read your earlier post on the other subject at this forum and already created LAN-LAN rule at the top. Weird thing - although I have this rule since several weeks, there is no traffic there:

Since all the other VLAN interfaces didn’t get a reply, the firewall either didn’t send the packet or didn’t receive the reply packet. But just to be sure, can you run a simple ping X.X.2.100 from the Advance Shell. If we get a reply, then we can definitely resolve this by creating a NAT rule. If the ping error is Request Time Out, then most likely, the firewall didn’t receive the reply from Synology.

As for the internet access issue when changing the default gateway to X.X.2.1 it could be that the Synology is hitting a different firewall rule which does not include internet access

Unfortunately - no packets received...

Hmm, we can further check this. Kindly run this command

tcpdump -veni any host X.X.2.100 & ping -c X.X.2.100

note: hit cntrl+c to stop tcpdump

You can also analyze the logs and it will show if the firewall received any reply from X.X.2.100

Hi,

make sure you have removed the ip address details from the non active port.

Ian