Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 23 replies
  • Answers 1 answer
  • Subscribers 42 subscribers
  • Views 4445 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't ping Synology NAS from another VLAN

Kam

Hi all,

I have a huge problem with simple ping to NAS VLAN from any other VLAN. I tried almost everything and it just doesn't work.

My infrastructure:

Sophos firewall with NAS VLAN 2, no DHCP, Synology has fixed IP X.X.2.100 on port 2 with gateway and DNS set up to network address X.X.2.1. Next, USERS VLAN 3 with DHCP from X.X.3.100 and DNS and gateway set up to network address X.X.3.1. There is also management VLAN 10 with DHCP X.X.10.100 and DNS/gateway X.X.10.1. Synology is a member of this VLAN on port 1 with fixed IP X.X.10.103

I disabled firewall on Synology, didn't make any traffic control yet. On Sophos I created rule from zone USERS to NAS without restrictions.

I connected port 1 from Synology with fixed IP from VLAN 10 to untagged VLAN 10 port on Unifi switch. Next I connected port 2 from Synology with fixed IP from VLAN 2 to untagged VLAN 2 port on Unifi switch. At the end of the day, I would like to restrict port 1 to DSM only (for NAS management) and port 2 to file sharing only (SMB/FTP/AFP), but for now, all services are available on both ports.

Now, the problem is, when I'm pinging NAS on X.X.10.103 and my computer is in VLAN 10, NAS responds. When I try to ping NAS on X.X.2.100 from the same computer, it doesn't respond. When I switch port from my computer and connect it to VLAN 3, I can't ping any of the NAS addresses. Additionally, when I ping another device on VLAN 3 from computer in VLAN 10, it responds. What the hell is wrong with my setup?



This thread was automatically locked due to age.
Parents
  • 0

    Hi Kam,

    Correct me if I'm wrong; this is how I understand your setup.

    And the issue you’re facing is, as shown, traffic with a red mark

    Can you check using the diagnostic tools if you'll get a ping reply here? image show below

  • 0 in reply to Adam Dodge

    I tried diagnostics - 4 packets transmitted, 0 packets received.. I even tried with disconnecting the first port (VLAN 10), the same result.

  • 0 in reply to PhilippRusch

    NAS has two LAN interfaces - LAN 1 and LAN 2. Both has fixed IP, gateways and DNS. LAN 1 has IP X.X.10.103 and is member of MGMT VLAN, LAN 2 has IP X.X.2.100 and is member of NAS VLAN. Each VLAN has its own gateway, which is VLAN network address.

  • 0 in reply to Kam

    Seems issue with the switch and NAS configuration, for troubleshoot add any other windows/linux system and check trace route

    Also, share interface snapshots from Sophos GUI with switch configuration.

    Regards

    "Sophos Partner: Networkkings Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    I have VLANS on separate ports on Sophos. As for Synology, LAN 1 is connected to switch port 5, LAN 2 is connected to switch port 7. On the Unifi switch, each access port setup is the same and each tagged port setup is the same.

  • 0 in reply to Kam

    It seems that you are trying to do a router on a stick. So the firewall should be the one to route the traffic to different vlans.

    Let's check the firewall if it can send the traffic to your Synology. Try this Advance shell command:

    Syntax:

    ip route get {IP of destination (IP synology)}  

    • This will show where traffic to the synology will be forwarded to

    ping -a {source IP of firewall interface} {IP of destination (IP synology)}

    • This will confirm if the VLAN interface has access to the synology

    So kindly test with Port 3,5,4 and 6 if which one has access.

    Since this traffic is also a LAN - LAN kindly make sure that you have a permitted LAN-LAN rule

  • 0 in reply to Adam Dodge

    It could also be possible that Synology will only accept traffic from a specific network and for that, you would need to configure NAT.

  • 0 in reply to Adam Dodge

    IP ROUTE GET showed me the same as you described in screenshot. Unfortunately PING didn't went well - 41 packets transmitted, 0 packets received. Tried also another ports, but none of them is working for ping. As for the rule, I read your earlier post on the other subject at this forum and already created LAN-LAN rule at the top. Weird thing - although I have this rule since several weeks, there is no traffic there:


  • 0 in reply to Kam

    Since all the other VLAN interfaces didn’t get a reply, the firewall either didn’t send the packet or didn’t receive the reply packet. But just to be sure, can you run a simple ping X.X.2.100 from the Advance Shell. If we get a reply, then we can definitely resolve this by creating a NAT rule. If the ping error is Request Time Out, then most likely, the firewall didn’t receive the reply from Synology.

    As for the internet access issue when changing the default gateway to X.X.2.1 it could be that the Synology is hitting a different firewall rule which does not include internet access

  • 0 in reply to Adam Dodge

    Unfortunately - no packets received...

  • 0 in reply to Kam

    Hmm, we can further check this. Kindly run this command

    tcpdump -veni any host X.X.2.100 & ping -c X.X.2.100

    note: hit cntrl+c to stop tcpdump

    You can also analyze the logs and it will show if the firewall received any reply from X.X.2.100

  • 0 in reply to Kam

    Hi,

    make sure you have removed the ip address details from the non active port.

    Ian

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

Reply Children
No Data
Unfiltered HTML