Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 28 subscribers
  • Views 1233 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

LAN/Internet seperate FW

richie913

Hi

First of all a quick brief on our set up.

we have two DCs, both DCs have a HA pair of firewalls controlling our LAN traffic. We also have a HA pair of firewalls across both DCs for DMZ and Internet traffic.

Our LAN firewalls have a leg in the DMZ and all internal routing seems fine (all sites can route to the DMZ primary firewall and vice versa)

Our LAN firewalls are configure to route all DMZ and external traffic to our Internet/DMZ firewall and all LAN traffic via VPLS. Again, LAN access to DMZ servers is working fine.

The issue is breaking out to the internet. I have tried several types of rules (including even very briefly trying an allow any/any, along with various NAT rules) but I cannot get out to the internet.

Running a packet capture from the LAN FW I can see the traffic passing to the DMZ interface. On the DMZ FW I can see the packet in on the DMZ interface and out of the WAN interface. However the packet states it’s a violation with the reason as Firewall.

I have double checked routing, I’ve made strict and then very open rules to test, but I am running out of ideas!

Does anyone have any suggestions or pointers for troubleshooting? The information I’m getting doesnt seem to help me in anyway

thanks



This thread was automatically locked due to age.
Parents
  • 0

    Can you send us a picture that shows the firewalls of the clusters, the zones and internet breakout(s) including some sample networks? What do you mean by controlling the LAN traffic? Routing + internal FW rules?

    How are the datacenters connected (Layer 2, Layer 3, IPSec, ...).

  • 0 in reply to BerndFeist

    Hey,

    Thanks for responding.

    Hopefully this helps...

    So breaking it down to DC specific (as I think trying to troubleshoot the cross DC traffic is a slight red herring as the issue persists on local traffic with local breakout) all traffic from our LAN passes through to our "LAN" FW via its LAN interface. The route on the LAN firewall interface sends any non internal traffic (at our other DC) to our DMZ/Internet firewall via its DMZ port. 

    The DMZ FW routes all internet traffic to our ISP Router via the WAN interface.

    The WAN interface is accessible from the DMZ/Internet FW. I can also ping the LAN Core switch from the DMZ/Internet FW.

    The DMZ/Internet FW has an allow rule for any zone to access the WAN on HTTP/HTTPS/ 

    The Log viewer sees the packets going out to a HTTP/HTTPS connection as allowed, matching the rule mentioned.

    The packet capture sees the packets going out to a HTTP/HTTPS connection as a violation, matching rule 0 (drop).

    The source IP address in the logs is as the LAN IP address.

    The source zone is the DMZ interface and the destination zone is the WAN interface.

    Again, I think the 2 DCs I mentioned may just confuse the issue as the DC routing is in place and working, and we get the issue even with local LAN->WAN breakout.

    I hope this helps with understanding my issue more, but please let me know if I can give any more info to assist.

    Thanks

Reply
  • 0 in reply to BerndFeist

    Hey,

    Thanks for responding.

    Hopefully this helps...

    So breaking it down to DC specific (as I think trying to troubleshoot the cross DC traffic is a slight red herring as the issue persists on local traffic with local breakout) all traffic from our LAN passes through to our "LAN" FW via its LAN interface. The route on the LAN firewall interface sends any non internal traffic (at our other DC) to our DMZ/Internet firewall via its DMZ port. 

    The DMZ FW routes all internet traffic to our ISP Router via the WAN interface.

    The WAN interface is accessible from the DMZ/Internet FW. I can also ping the LAN Core switch from the DMZ/Internet FW.

    The DMZ/Internet FW has an allow rule for any zone to access the WAN on HTTP/HTTPS/ 

    The Log viewer sees the packets going out to a HTTP/HTTPS connection as allowed, matching the rule mentioned.

    The packet capture sees the packets going out to a HTTP/HTTPS connection as a violation, matching rule 0 (drop).

    The source IP address in the logs is as the LAN IP address.

    The source zone is the DMZ interface and the destination zone is the WAN interface.

    Again, I think the 2 DCs I mentioned may just confuse the issue as the DC routing is in place and working, and we get the issue even with local LAN->WAN breakout.

    I hope this helps with understanding my issue more, but please let me know if I can give any more info to assist.

    Thanks

Children
No Data