Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 11 replies
  • Answers 1 answer
  • Subscribers 30 subscribers
  • Views 27618 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot ping devices from one subnet to another.

Justin Franks

 Hi All,

 

I have a Cyberoam CR50iNG running Sophos XG SFOS 16.05.6 MR-6 firmware.

 

I have 2 interfaces PortA and PortE, both are in the LAN zone.

 

PortA subnet is 10.140.0.0/23

PortE subnet is 10.140.10.0/24

 

PortA cannot ping devices in the PortE subnet. However, PortE devices can ping devices on the PortA subnet.

Both subnets are connected to the Cyberoam with managed switched but no other routers are used.

Both subnets can get to the internet with no issues.

 

There is a Firewall rule for LAN to LAN allow all any any.

 

Any ideas where this issue is coming from?



This thread was automatically locked due to age.
  • 0

    Hi Justin,

    Check #1.1 in my troubleshooting guide and check if the ICMP traffic for both the destination is forwarded or dropped for any reason. Show me the results. 

    Thanks

  • 0 in reply to sachingurung

    Hi Sachin,

     

    Here are the packet capture results.

     

     

    Here are my interface details.

     

    Here are the routing details.

     

    and lastly, here is the FW rule that should be processing these requests.

    I have tried the drop-packet-capture at your request but the command does not return any results.

    Can you see any major issues with my setup?

  • 0 in reply to Justin Franks

    Hi Justin,

    I don't think you require a unicast route to PortE and PortA, try deleting the last two routes. Alongside, is PING/ICMP selected for WLAN and LAN zone in Administration | Device Access?

    Thanks

  • 0 in reply to sachingurung

    Hi Sachin,

     

    I have removed the routes. I only added them after I started having issues to see if that would resolve them.

     

    Yes Ping is enabled on both interfaces.

     

    As I mentioned, the WLAN is able to access the LAN and WAN(s) but LAN cannot access WLAN.

     

    In the packet capture, traffic to the WLAN from the LAN is hitting FW rule 0. Even though there is a LAN > WLAN rule allowing the traffic.

  • 0 in reply to Justin Franks

    Justin,

    static routing are not necessary. Make sure to create a lan to lan firewall rule, otherwise traffic is blocked.

    Go to advanced shell from console, option 5 > 3 and type:

    route -n

    show us the result. Of course remove the static routing before issuing the command.

    Thanks

  • 0 in reply to lferrara 
    CR50iNG_CA01_SFOS 16.05.6 MR-6# route -n                                        
    Kernel IP routing table                                                         
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   
    10.140.0.0      0.0.0.0         255.255.254.0   U     0      0        0 PortA   
    10.140.0.231    0.0.0.0         255.255.255.255 UH    0      0        0 ppp0    
    10.140.10.0     0.0.0.0         255.255.255.0   U     0      0        0 PortE   
    10.140.15.0     0.0.0.0         255.255.255.0   U     0      0        0 PortE.10
    0                                                                               
    10.140.20.0     0.0.0.0         255.255.255.0   U     0      0        0 ETVDevDM
    Z                                                                               
    10.140.25.0     0.0.0.0         255.255.255.0   U     0      0        0 PortF   
    10.140.50.0     10.140.254.252  255.255.255.0   UG    3      0        0 PortG   
    10.140.254.0    10.140.254.252  255.255.255.248 UG    2      0        0 PortG   
    10.140.254.248  0.0.0.0         255.255.255.248 U     0      0        0 PortG   
    10.224.77.192   10.140.254.252  255.255.255.240 UG    0      0        0 PortG   
    61.69.254.220   0.0.0.0         255.255.255.252 U     0      0        0 PortH
  • 0 in reply to Justin Franks

    Hi Justin , 

    Could you initiate the packet capture again after removing the routes. 

  • 0 in reply to Aditya Patel

    Here are is my amended routing table.

     

    Here is the packet capture as requested.

    Time In Interface Out Interface Ethernet Type Status Source IP Destination IP Packet Type Ports[src,dst] Rule ID Reason
    2017-08-08 22:53:20 ppp0   IPv4 Incoming 10.140.0.231 10.140.10.253 TCP 64070,23 0  
    2017-08-08 22:53:19 PortA   IPv4 Incoming 10.140.1.27 10.140.10.253 ICMP -- 0  
    2017-08-08 22:53:19 ppp0   IPv4 Incoming 10.140.0.231 10.140.10.253 TCP 64070,23 0  
    2017-08-08 22:53:18 ppp0   IPv4 Incoming 10.140.0.231 10.140.10.253 TCP 64070,23 0  
    2017-08-08 22:53:16 PortA   IPv4 Incoming 10.140.1.27 10.140.10.253 UDP 47,124,161 0  
    2017-08-08 22:53:13 PortA   IPv4 Incoming 10.140.1.27 10.140.10.253 UDP 47,124,161 0  
  • 0 in reply to Justin Franks

    I have the same exact Problem with my Sophos XG 210

     

    I'm trying to route my traffic from my wireless subnet (192.168.20.x) on Port4 to my LAN (192.168.168.x) on Port1

    Both are in the LAN Zone.

    Traffic is also allowed with Firewall Rules, both to - and from my WiFi.

    If I look into my Log, traffic gets approved but it still doesn't work and I can't get access.

     

    Do I have to configure some Special Route for it to work or am I missing something?