Interface not reachable any more

Hi Thomas,

I am a bit confused, if you are not able to reach the gateway on 172.xx IP address, how were you able to change the interface IP address ? 

What is the firmware version on XG? 

Thanks

Hi Sachin,

sorry for that...i forgot to mention, that I have theXG135 Appliance (8 Ports)
I'm still able to acces the admin webconsole from one of the other interfaces
Only from one port i have the problem that devices cannot reach it

I hope now it's easier to understand

Firmware is the newest: 15.01.0 MR-2

Thanks
Thomas

Hi Thomas,

That helped! Login to GUI from the port you are able to. Navigate through 

• System
• Administration
• Device Access

Check if you have HTTP and HTTPS box selected for the concerned interface. 

Hope that helps :)

Hi Sachin,

i edited my post above again, sorry for the missunderstandings

My problem is, that the interface itself is not reachable, even by pinging or try a "traceroute/tracert"
By trying to ping or run the tracert command i always get the "destination host not reachable" error.
From this net it should not be possible to access the webconsole, so the boxes described by you below are not checked.
Though, the interface should be reachable by network commands like ping, tracert/tracerout?

The packages cannot "go trough" the interface, because it's not even reachable for them and i can't get an internet connection.

I hope now it  become clear what my problem is

Thanks

Hi Thomas,

Device access allows limiting the administrative access of the following device services from various default zones, LAN, WAN, DMZ, VPN and customs zones.If you uncheck all the services for device access, all the traffic will be dropped. So if you are not able to ping, that might be because ICMP option is unchecked. Also, check if there is a drop rule configured in "Local Service ACL Exception Rule" option. PFA screenshot.

Thanks

Hi Sachin,

I checked this. There's no Exception Rule and the Device Acces Options should be ok:

But i think this couldn't be a problem with the configuration of the zone.
As described changing the interface IP is enough to get this working (without changing anything in this zone)

Thanks
Thomas

Thomas,

LAN_30 has the issue, right? Connect a computer on that zone, make sure a policy rule exists where DNS and HTTP/S services are enabled and post a TCPDUMP from XG CLI while you try to ping www.google.com

From CLI, type:tcpdump icmp

Post the output.

Thanks.

Hi Luk,

for testing this i have a "any-any" rule from the "LAN_30" zone
I can't post you the tcpdump because there's nothing coming in on the XG from the interface the "LAN_30" zone is assigned to.

By trying to ping www.google.de i get an "unknown host" error because the computer can't reach a DNS server
To bypass this, i edited the hosts-file and then got a "destination host unreachable" error

The tcpdump on the XG showed nothing coming from the affected port the whole time
By changing the interface IP to 192.168.30.* for testing again, everything is working fine and the tcpdump shows me the packages.
Changing back to 172.30.*.* it's like at the beginning....traffic doesn't reach the Interface and tcpdump doesn't show new packages coming from affected interface any more

So there's the following problem:
- Interface IP 172.30.1.10 (or any other 172.30.*.* IP) and computer (directly connected to interface on XG) get IP ->computer can't reach interface IP and because of this can't ping www.google.de or another adress outside
- Interface IP 192.168.30.10 and computer (directly connected to interface on XG) get IP ->Computer is able to reach interface IP and can ping www.google.de or other adresses outside

It seems there's a problem only affecting the 172.30.*.* net range on the XG, but i really don't get what this could be

Thanks
Thomas

Hi Thomas,

If LAN_30 has the issue, it's clear from the screenshot as the HTTP & HTTPS access are not selected. Please select the required device access protocols.

Thanks 

Hi Sachin,

I tested this, but it doesn't work.
But I'm not talking about the HTTP/HTTPS Acces to the Webconsole of the XG.
Even ICMP Packages (ping) can't reach the interface, this is not an issue with the admin services options

By changing this i'm only allowed to access the admin console from the network (if the network itself would work) i'm coming from
But my problem is, that the basic network isn't working
-> ICMP packages not reaching the interface

And as described above...by changing the Interface IP to 192.168.30.* (device access HTTP/HTTPS empty as in screenshot) this is working
So this has nothing to do with my device access options?

Thanks
Thomas