My setup is as follows:
1 Astaro 320 with 3 ports in use (I've disabled everything else until I solve this): LAN, DMZ, ATT
The LAN and DMZ port each go to separate VLAN's on a HP Procurve. The LAN has my laptop and one other VM on its VLAN, and the DMZ has one VM. The ATT link goes through a couple switches directly to a Cisco router, which is dedicated to our ATT fiber link. (There is only my test system on this link currently).
Now for my problem. I can surf/ping from the LAN (my laptop) and everything is fine. Also, ALL traffic shows up on tcpdump of eth0 (firewall LAN port) and eth5 (firewall ATT port). When I ping ALL request/replies show up in both places.
tcpdump -ni eth0 proto '\icmp'
gives me this:
6:24:22.005757 IP 192.168.0.254 > 12.*.*.5: ICMP echo request, id 50215, seq 0, length 64
16:24:22.008468 IP 12.*.*.5 > 192.168.0.254: ICMP echo reply, id 50215, seq 0, length 64
16:24:23.005886 IP 192.168.0.254 > 12.*.*.5: ICMP echo request, id 50215, seq 1, length 64
16:24:23.008541 IP 12.*.*.5 > 192.168.0.254: ICMP echo reply, id 50215, seq 1, length 64
16:24:24.006013 IP 192.168.0.254 > 12.*.*.5: ICMP echo request, id 50215, seq 2, length 64
16:24:24.008867 IP 12.*.*.5 > 192.168.0.254: ICMP echo reply, id 50215, seq 2, length 64
16:24:25.006391 IP 192.168.0.254 > 12.*.*.5: ICMP echo request, id 50215, seq 3, length 64
16:24:25.009917 IP 12.*.*.5 > 192.168.0.254: ICMP echo reply, id 50215, seq 3, length 64
16:24:26.006524 IP 192.168.0.254 > 12.*.*.5: ICMP echo request, id 50215, seq 4, length 64
16:24:26.010109 IP 12.*.*.5 > 192.168.0.254: ICMP echo reply, id 50215, seq 4, length 64
tcpdump -ni eth0 proto '\icmp'
gives me this:
16:24:22.005934 IP 12.*.*.2 > 12.*.*.5: ICMP echo request, id 50215, seq 0, length 64
16:24:22.008360 IP 12.*.*.5 > 12.*.*.2: ICMP echo reply, id 50215, seq 0, length 64
16:24:23.006064 IP 12.*.*.2 > 12.*.*.5: ICMP echo request, id 50215, seq 1, length 64
16:24:23.008444 IP 12.*.*.5 > 12.*.*.2: ICMP echo reply, id 50215, seq 1, length 64
16:24:24.006201 IP 12.*.*.2 > 12.*.*.5: ICMP echo request, id 50215, seq 2, length 64
16:24:24.008772 IP 12.*.*.5 > 12.*.*.2: ICMP echo reply, id 50215, seq 2, length 64
16:24:25.006569 IP 12.*.*.2 > 12.*.*.5: ICMP echo request, id 50215, seq 3, length 64
16:24:25.009792 IP 12.*.*.5 > 12.*.*.2: ICMP echo reply, id 50215, seq 3, length 64
16:24:26.006725 IP 12.*.*.2 > 12.*.*.5: ICMP echo request, id 50215, seq 4, length 64
16:24:26.009889 IP 12.*.*.5 > 12.*.*.2: ICMP echo reply, id 50215, seq 4, length 64
When I ping from the DMZ machine ALL requests/replies show up on eth2 (firewall DMZ port) but almost none show up on eth5!
tcpdump -ni eth2 proto '\icmp'
gives me this:
16:30:15.136939 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 0, length 64
16:30:15.137213 IP 12.*.*.5 > 10.*.*.3: ICMP echo reply, id 54556, seq 0, length 64
16:30:16.131089 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 1, length 64
16:30:16.131371 IP 12.*.*.5 > 10.*.*.3: ICMP echo reply, id 54556, seq 1, length 64
16:30:17.135234 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 2, length 64
16:30:17.135473 IP 12.*.*.5 > 10.*.*.3: ICMP echo reply, id 54556, seq 2, length 64
...
16:32:03.417894 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 108, length 64
16:32:03.418209 IP 12.*.*.5 > 10.*.*.3: ICMP echo reply, id 54556, seq 108, length 64
16:32:04.414275 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 109, length 64
16:32:05.417679 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 110, length 64
16:32:05.417962 IP 12.*.*.5 > 10.*.*.3: ICMP echo reply, id 54556, seq 110, length 64
while
tcpdump -ni eth5 proto '\icmp'
gives me this:
16:30:52.255985 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 37, length 64
16:32:04.414437 IP 10.*.*.3 > 12.*.*.5: ICMP echo request, id 54556, seq 109, length 64
See the problem? The only time tcpdump shows that traffic is when the request doesn't return a reply!
I can't for the life of me figure out how this traffic is going missing from tcpdump, yet still going out and returning. The only thing I can think of is that my NAT could be causing it-but if I turn off the NAT the traffic won't ever get returned... and NATing shouldn't affect tcpdump, just as the masquerade for the LAN doesn't.
I've got a case with Astaro support, but so far they can't explain it. Anyone? Anything?
Edit: Just to clarify this happened both with v7.1 and after I updated to v7.304 (support told me that might fix it).
This thread was automatically locked due to age.