Cant get a simple directly connected network firewall rule working. XGS126

Question

I am completely stumped by this. I am sure its something obvious that I am overlooking. 
 Lan Port 1 - 192.168.1.254/24 
 MGMT port 5 - 172.16.0.254/24 
 
 I already had a rule saying mgmt subnet source 172.16.0.0 could access lan subnet destination 192.168.1.0. That worked fine, the mgmt server (172.16.0.1) can RDP etc to the LAN server (192.168.1.250). 
 but then the server engineer said could I allow access from mgmt server to the LAN server ilo (192.168.1.251). First off I couldnt work out why this wasnt just working with the above rule. 
 So set up a separate rule above the other one just for mgmt server to lan server ilo but when I ping or try access it it doesnt work. I can see the out counter slightly increasing on the rule. 
 
 In the firewall logs I can see the rule being hit and being allowed.

What am I missing? I know the ilo is working fine as it is reachable from the lan network server so ive got past it being a physical (cable, connection) issue.

Vishal_R · Accepted Answer

Requested explanation: PeteH This confirms the reply from server 192.168.1.251 was not coming back when source 172.16.0.1 was communicating with its original IP, MASQ will change the source IP to Port1 Interface IP for out direction packet - which is of the same network as the end server source 172.16.0.1 and due to same network it seems server replied to ICMP request and fixed your PING issue.

Vishal_R · Answer

Hi PeteH Can you please check CLI TCPDUMP on the firewall for the destination server IP 192.168.1.251 to see if we are getting an ICMP reply while you are checking PING from the MGMT server? console> tcpdump 'host 192.168.1.251 and proto ICMP console> drop 'host 192.168.1.251 If the Firewall is forwarding packets out to Port1 (LAN zone interface) and there is no reply back from the LAN server and no drop packet on the firewall with the above command then try with a separate rule by creating a link NAT rule with MASQ action to see how it goes or if the separate rule is already added by you for specific source and destination then crate link NAT rule for that firewall rule with NAT action MASQ. After that check TCPDUMP and drop again with the shared command above..!

Vishal_R · Answer

Hi PeteH In the above-shared captures I have noticed that for request packets generated by source 172.16.0.1, no ICMP reply from destination IP 192.168.1.251 was received back. Also during our packet " Port1, OUT: IP 172.16.0.1 ", the original IP is there and no MASQ has been tried as per the shared suggestion earlier. Would you please create a separate rule for the above source and destination IP on top along with the linked NAT rule with NAT rule action MAQS and try to check the status again..!

Cant get a simple directly connected network firewall rule working. XGS126

Top Replies