SNMP Traffic blocked between host and printer in same subnet

if printer don't answer, the PC try to reach the device over the gateway ... possible.

Or you have enabled "proxy arp" at the internal interface.

if traffic reach the UTM the firewall drops the traffic.

so the question should be "why reach the tradffic the UTM?".

btw: if you create a rule allowing traffic from internal lan to same subnet you should get a "pass"...

Hi Jas,

Show us how does the Interfaces & Routing | Interface, page looks in your UTM. Also, show us the FW-rule configured to allow this traffic to/fro.

Thanks

dirkkotte: Yup, I aggree that the packets will pass when I create a rule that allows them. But more important for me is, why UTM is blocking the packets.

sachingurung: Here is a screenshot of my Interface page

ProxyARP is disabled for all IFs. And just for your information: the destination MAC address from the firewall log above is the MAC address of eth1.

"...why UTM is blocking the packets"

The UTM is blocking the packets because there are no rule allow this traffic passing the UTM.

The question should be: why reach the traffic the UTM or why the destination mac is the UTM mac?

You should use Wireshark at the PC to capture packets directed to 192.168.10.9.

also you can post output from "arp -a" and "route print" from PC.

Another option ... the Management-Software try to send the packets to def-gw mac address if device is not reachable.

Try to disable/uninstall management software. Sometimes the ways of the programmer are inscrutable.

dirkkotte said:

...

The UTM is blocking the packets because there are no rule allow this traffic passing the UTM.

The question should be: why reach the traffic the UTM or why the destination mac is the UTM mac?

....

Yep, I mean the same but asked the wrong question.

dirkkotte said:

...

You should use Wireshark at the PC to capture packets directed to 192.168.10.9.

...

Yep, already done. Packets are send through the IP of the printer (192.168.10.9), but to the mac address of the gateway.

dirkkotte said:

...

also you can post output from "arp -a" and "route print" from PC.

Yep, also already done. No entry for the printer. Only the gateway and some other devices in my network are shown.

It seems to be normal that traffic for an offline host, which is not listed in the ARP list of the source host or gateway, is send to the mac address of the gateway. I've pinged an offline host in my network and captured the traffic:

1. The client sends out several ARP requests for the destination IP
2. Also the gateway (UTM) sends out an ARP request for the destination IP
3. No answer to the ARP requests
4. Ping request goes to the destination IP, but to the mac address of the gateway
5. Gateway response with ICMP type 3, Destination unreachable

If the host is online

1. The client sends out an ARP request for the destination IP
2. Host sends ARP response with his mac address
3. Ping request goes to the destination IP and mac address
4. Host answeres to ping - everybody happy.

I'm just wondering why I've never seen this before in the firewall, e.g. when I try to access an SMB share of my HTPC which is offline. This traffic should be also dropped by the firewall of the UTM, or should'nt it? Is there a difference behaviour between UDP and TCP packets?

EDIT: Forgot to tell you, that the SNMP request come from the Windows print spooler. For the IP connection SNMP is activated for management purposes.