Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 17 replies
  • Subscribers 2 subscribers
  • Views 35620 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't access device behind RED

dhd
Hi I have a site setup with the following setup

Internal>ASG120Cluster->WAN->Router serving DHCP>RED10>Cisco>Client PC's

My RED is in standard unified mode and has an interface 172.16.250.1/29 serving DHCP on 172.16.250.4-6
The RED is 172.16.250.1 the Cisco WAN side is 172.16.250.2 

The Cisco can ping external addresses on my ASG Cluster as can client PC's

however I can't ping the Cisco or client pc's from the ASG or anything inside it.  I can ping my RED address however.

Firewall rules are Trusted networks(internal etc)>any>any and RED network and client networks>ports they require(https etc)>external address of virtual webserver (server load balancing)

Any ideas?


This thread was automatically locked due to age.
  • 0
    Firebear, if the IP is not on the interface but is on another device in the subnet of the interface, binding the object to the interface will cause routing problems for VPNs and DNATs.  There are some uses for binding to an interface, but doing so will cause most admins to have mysterious problems.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Hi Balfson,

    as i wrote before VPN needs the virtual Interface wich is not available.
    DNATs are an special case, but a DNAT to an device in the same subnet than the UTM Inferface ?

    Greets Firebear
  • 0
    Hi,
    sorry to push this thread up, but I've the same problem.
    UTM220 9.310-11 with two RED10. One of the REDs (transparent/split) have been used for 3 years without any problems. 
    I add a new RED10 (standard/split) with two firewall rules
    (red -> any -> internal AND internal -> any -> red).

    ICMP ping forward is enabled.

    Ping from Client behind RED to internal is possible.
    Ping from internal to Client behind RED is impossible

    It is strange that the old RED is forwarding pings in both directions.

    All Clients have set the UTM as default gateway.

    There are any hints?

    Regards,
    Ulrich
  • 0
    Ulrich, please click on [Go Advanced] below and attach a picture of one of those firewall rules.  Do you get any hints from #1 in Rulz?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    I disabled ATP and IDS for testing but it doesn't matter to the problem.
  • 0
    Are you sure that the client behind the RED doesn't have a client firewall that blocks the incoming ICMP (ping) requests from a "different" subnet?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels
    Are you sure that the client behind the RED doesn't have a client firewall that blocks the incoming ICMP (ping) requests from a "different" subnet?


    Damn! sorry for this stupid post. you're right!
    Thanks.
Unfiltered HTML