Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 22 replies
  • Subscribers 29 subscribers
  • Views 2068 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issue with VLAN between 2 XG firewalls with V19 home edition

matthieu

Hello,

I encounter weird communication issues on a network shared between two XG firewalls since V19 upgrade. A drawing being better than a long speech, here's my network topology :

In short : 

192.168.1.x is the LAN side of my ISP router.

192.168.2.x is my internal LAN, protected by XG1. Since some of my hosts cannot be directly plugged to XG1, I put a second XG (XG2) in another room, with some other hosts connected to it. XG1 and XG2 are interconnected with a trunk comprised of VLAN 100 for my LAN (and some other VLANS). VLAN 100 is member of LAN bridges on both XG1 and XG2. Actually, XG2 is simply used as a simple manageable L2 switch, extending XG1's LAN. 

The issue : 

This configuration used to work in V18.5. But since V19 migration, communications between LAN hosts on XG1 and XG2 are blocked, with a weird behavior

- the desktop on the left can flawlessly reach the Internet

- the desktop fails to communicate with the server on the right. A wireshark trace shows that a few first packets are exchanged, then communications are blocked.

- when pinging from desktop to server, the first packet gets a successful answer, but all following packets don't get answers. Same behavior with a ping from server to desktop.

- the desktop cannot connect to the XG1 admin interface on its LAN IP (even if admin is allowed on zone LAN) 

Since it looks like communications are blocked not immediately but after a few successful messages, I was thinking about firewall erroneously dropping packets. Unfortunately both the firewall log and the drop-packet-capture command are silent. IPS logs are silent too.

Any idea would be helpful.

Best Regards,

Matthieu



This thread was automatically locked due to age.
Parents
  • 0

    Hello,

    Here's some more troubleshooting information. It seems that this issue belongs to the class of strange issues. When I ping from desktop to server, only the first ping request gets an answer as explained in my previous post. But as soon as I start "tcpdump icmp" on XG1 console, the issue disappears instantly and ping works flawlessly as long as tcpdump runs. If I stop the tcpdump command, the ping problem comes back instantly. If I restart tcpdump pings works again, etc ....

    Looks like a bug somewhere ?

    Thanks in advance for any help

    Best Regards

    Matthieu

Reply
  • 0

    Hello,

    Here's some more troubleshooting information. It seems that this issue belongs to the class of strange issues. When I ping from desktop to server, only the first ping request gets an answer as explained in my previous post. But as soon as I start "tcpdump icmp" on XG1 console, the issue disappears instantly and ping works flawlessly as long as tcpdump runs. If I stop the tcpdump command, the ping problem comes back instantly. If I restart tcpdump pings works again, etc ....

    Looks like a bug somewhere ?

    Thanks in advance for any help

    Best Regards

    Matthieu

Children
  • 0 in reply to matthieu

    Hi matthieu, 

    I see in your screenshot below you are already running v19.0 MR1 build #365. 

    I assume this is still an issue on MR1? Does the issue also disappear on MR1 when you run tcpdump? I ask because we did fix an issue in MR1 related to how VLAN packets pass through the system, so I wanted to confirm if your issue is still present on v19.0 MR1. 

  • 0 in reply to bobbylam

    Hello,

    Actually yes, the issue is still present with MR1 on both firewalls (they were already in MR1 when I did the tcpdump test mentioned in my previous post). I encountered the issue with V19 GA then upgraded to MR1 hoping that MR1 would solve the issue, but it didn't.

    Best Regards

    Matthieu

Unfiltered HTML