Violation Firewall on traffic from LAN zone to WiFi zone

Hi apijnappels,

Thank you for reaching out to the Community! 

Can you please show us the wireless network configuration and network definition for both the Internal LAN network and wireless network? 

Thanks,

wireless network config

LAN definition

I'm not sure what more you need to see from the wireless network, because both the wireless network as well as the wlnet1 interface are exactly the "same screenshot".

Those issues could occur, if we are talking about multiple duplicated networks. Could you doublecheck, that your wireless network range is not used on the XG somewhere else? Also is there a interface with 172.16.16.16? 

Maybe this is the definitions that H_Patel was requesting.

As an answer to LuCar Toni, yes I am certain that those ranges are only used once. 172.16.16.16 is the interface address of Port1 (the normal LAN interface).

Is there a command or place where I can find the complete routing table of XG so I can also check there if there's something strange?

Can you check on the Console the drop packet capture? 

use advanced shell and check for drppkt 

A lot of information is shown. I think this is a line that is about the traffic that is dropped and shouldn't have...

2021-01-07 19:11:52 0101021 IP 172.16.16.100.50412 > 10.20.30.11.4747 : proto TC P: S 1759223807:1759223807(0) win 64240 checksum : 44857
0x0000: 4500 0034 68e3 4000 7f06 ae4d ac10 1064 E..4h.@....M...d
0x0010: 0a14 1e0b c4ec 128b 68db 9fff 0000 0000 ........h.......
0x0020: 8002 faf0 af39 0000 0204 05b4 0103 0308 .....9..........
0x0030: 0101 0402 ....
Date=2021-01-07 Time=19:11:52 log_id=0101021 log_type=Firewall log_component=Fir ewall_Rule log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_ dev=Port1 out_dev=wlnet1 inzone_id=1 outzone_id=0 source_mac=e8:d8:d1:aa:6a:1d d est_mac=ac:22:0b:4f:3d:41 bridge_name= l3_protocol=IPv4 source_ip=172.16.16.100 dest_ip=10.20.30.11 l4_protocol=TCP source_port=50412 dest_port=4747 fw_rule_id= 0 policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_ id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_f ilter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 conni d=1531697728 masterid=0 status=256 state=1, flag0=755916341248 flags1=3435973836 8 pbdid_dir0=0 pbrid_dir1=0

And here's the routing table (route command from advanced shell). Not too long and 10.20.30.0/24 is not overlapping with others or being used more than once.

It indicates, your firewall rule does not match. Double check the objects and the Zones your are using.

In fact you could delete this firewall rule and create a new one, check if this one is matching. It looks like the firewall broke somehow. 

Hi apijnappels,

Are you able to ping the wireless network from the firewall? 

Thanks,

Hi 

Yes, I can ping the specific address from the XG diagnostics page

And as LuCar Toni's question about the firewall rule, I just created a new rule as the very first rule with LAN/WiFi zones any source to LAN/WiFi zone any destination allow but that also doesn't work and gets no traffic...

So to recap; networks are unique, non-overlapping in route table, XG can ping the specified host, LAN host cannot get through somehow, not with ping, not with the port number needed.

EDIT: Just created a new wireless network bridged to LAN as a test and in that network the clients can communicate to each other. This is however not the intended solution, since I want to make sure that the wireless network stays in its own separate zone.