Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 17 replies
  • Answers 2 answers
  • Subscribers 30 subscribers
  • Views 19222 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Not able to pass traffic between VLANs

Alex_B

I've been pulling my hair out for a while. I'm trying to pass traffic between my untagged lan and a VLAN, both in the same LAN zone.

Port A: 192.168.51.2/24
Port A.60: 192.168.60.1/24

Based on others having similar issues, I created IP Network objects for each subnet and made a rule to pass all traffic: 

Still 192.168.51.0/24 cannot ping 192.168.60.0/24. Both can reach the firewall and WAN fine, and receive DHCP from the firewall.



This thread was automatically locked due to age.
  • 0

    Hi

    you will need a rule for each direction you want traffic to flow in.

    Ian

  • 0

    Confirm that VLAN's are assigned to the LAN interface Network>Interface. Paste screenshot.

    Place this rule at the top of all rules

    Please paste the screenshot of the Network Object definition here. It should cover the full subnet.

    From on of the IP's on VLAN1 - are you able to ping the VLAN2 gateway IP address ?

  • 0 in reply to AB5g

    Ok, trying both of what ya'll said. I had both src/dst IP sets in the rule trying to make it one, but I tried splitting it up again:

    Here's the relevant config I could find. 

  • 0

    Is ‘Ping’ enabled for LAN in Local Service ACLs on the ‘Administration’ page under the ‘Device Access’ tab? It should be enabled by default, but just another thing to possibly check if you can’t ping.

    Your firewall rule seems fine. I just setup mine like yours and I’m able to ping from my untagged LAN to VLAN with no issues.

  • 0 in reply to shred

    The rules and the network definitions seems ok. I have mine setup like this with one consolidated rule (not 2).

    1. From on of the IP's on VLAN1 - are you able to ping the VLAN2 gateway IP address ? .
    2. Confirm you are pinging from the local machine and not through SSL VPN
  • 0 in reply to AB5g

    Yup, pings are enabled

    1. I'm able to hit the other vlans gateway IPs fine from either end. Also from the firewall I can ping 192.168.60.x IP addresses if I choose PortA.60 as the source.

    2. Haven't even installed the VPN on the machines I'm using, just my phone.

  • 0 in reply to Alex_B

    Are your end devices blocking the ping? An antivirus program on it perhaps ?

    Create a new rule place on top Source LAN; Source Any. Destination Any ; Source Any. Disable match known users and apply no policy for IPS

  • 0 in reply to AB5g

    Yeah, I've got multiple devices on each end and they can all see each other and up until I try to get passed gateway on the other side.

    Added that rule with no luck. It did kill my wan since it's higher than my LAN->WAN NAT rule so disabled after testing. But I guess that rules out the firewall being the cause? Also I did route -n from the console and everything looks good there. 

    I was guessing I was doing something wrong with the firewall but if you say it looks good then I imagine it must be. This is such a basic config. It's hosted on esx going into a cisco sg200. Let me go over all that config again and see if somethings wrong there.

    Adding on just to make sure this makes sense. I've got sophos xg in a vm, with the LAN/PortA portgroup set to vlan 4095/VGT so it esx doesn't strip the vlan tags. That gets passed to the Cisco SG200 L2 switch with a trunk port with VLAN 60 tagged and untagged going to vlan 1 / the rest of my lan.

  • 0 in reply to Alex_B

    As a workaround this would work in your scenario.

     

    One last thing - Create a new NAT rule and enable that in the new firewall rule (this should keep your wan alive).  

    So create a FW rule - place on top

    Source LAN service Any

    Destination LAN service Any

    Enable Nat 

     

     

  • 0 in reply to AB5g

    Awesome, that did it. I didn't realize you'd need to use NAT between 2 local vlans. 

    Both sides see eachother fine now with this as my top rule.