Hi everyone,
I hope you can help me out here.
I found something quite strange, but since I just started using Sophos recently, I might have misconfigured something.
Via WebUI, when I go to Diagnostics and try to run a ping or traceroute to a specific VLAN using the LAN interface, I always get 100% packet loss on ping, and on traceroute I see multiple host unreachable (!H) responses.
However, when I perform the exact same test via the CLI (console), everything works fine. I can ping the destination and get a proper traceroute result.
Here is an example of the WebUI traceroute output:
Traceroute to 192.168.7.2 (192.168.7.2), 30 hops max, 46 byte packets
1 * * *
2 192.168.1.235 48.110 ms !H * *
3 * 192.168.1.235 68.253 ms !H *
4 * * 192.168.1.235 68.085 ms !H
5 * * *
6 192.168.1.235 68.925 ms !H * *
7 * 192.168.1.235 67.119 ms !H *
8 * * 192.168.1.235 68.349 ms !H
9 * * *
10 192.168.1.235 67.822 ms !H * *
11 * 192.168.1.235 68.479 ms !H *
12 * * 192.168.1.235 67.992 ms !H
13 * * *
14 192.168.1.235 70.116 ms !H * *
15 * 192.168.1.235 68.280 ms !H *
16 * * 192.168.1.235 69.090 ms !H
17 * * *
18 192.168.1.235 69.123 ms !H * *
19 * 192.168.1.235 74.238 ms !H *
20 * * 192.168.1.235 65.492 ms !H
21 * * *
22 192.168.1.235 68.467 ms !H * *
23 * 192.168.1.235 73.351 ms !H *
24 * * 192.168.1.235 69.655 ms !H
25 * * *
26 192.168.1.235 63.660 ms !H * *
27 * 192.168.1.235 68.248 ms !H *
28 * * 192.168.1.235 68.541 ms !H
29 * * *
30 192.168.1.235 68.723 ms !H * *
192.168.1.235 is my Sophos firewall
192.168.7.2 is a device on one of my VLANs
And here is the same test via shell:
SFVH_KV01_SFOS 21.5.0 GA-Build171# traceroute 192.168.7.2
traceroute to 192.168.7.2 (192.168.7.2), 30 hops max, 46 byte packets
1 192.168.7.2 (192.168.7.2) 3.293 ms 1.035 ms 1.141 ms
Could this be a bug? Or am I doing something wrong? Any help would be greatly appreciated!
Thanks in advance.
Did you try traceroute with -i for Interface?
Because that is what you do, if you select the interface in the Diagnostic.
See:
__________________________________________________________________________________________________________________
Both in the traceroute and ping I select the interface LAN. Via Shell I didn't try using -i but I did now and I am having the same via webui
SFVH_KV01_SFOS 21.5.0 GA-Build171# traceroute -i PortA 192.168.7.1
traceroute to 192.168.7.1 (192.168.7.1), 30 hops max, 46 byte packets
1 Sophos_fw (192.168.1.235) 3061.948 ms !H 3071.180 ms !H 3071.915 ms !H
I suppose the issue is because I don't have a rule?
Traceroute with the -i parameter basically means, it tries to reach your host from that interface.
If there is "no route to the host" we never receive any reply.
Without the Interface, you will get the best fitting route by the Kernel.
But if you give an Interface, we try to reach the target by using your interface, which in your example, will lead to a timeout (we are not able to reach it).
__________________________________________________________________________________________________________________
Thanks for the explanation, that makes sense.
However, I’m still a bit confused.
Even after creating a firewall rule to allow communication between the VLAN and the physical interface network, the firewall still doesn’t seem to find a valid route.
Is there any additional configuration I might be missing?
Should I manually add a static route or enable something else to allow traffic between a physical interface and a VLAN interface on the same device?
Any guidance would be appreciated.
For directly connected subnets, you don't need a separate route.
The destination device has the sophos as default gateway configured? Otherwise, it don't know the "LAN-Network" is reacheble over the sophos. (answers to devices within the same NetworkSegment are possible without route or def-GW ... so a ping without selected interface can be answered)
However, it is possible too, that a higher-priority SD-WAN route is redirecting traffic via the wrong interface.
Dirk
Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.