Skip to main content
Stv
Stv
New Member
September 9, 2019
Question

Could not ping from an internal private IP to a destination in the Internet

  • September 9, 2019
  • 1 reply
  • 3621 views

Hello community,

 

I have a weird situation where I could not ping from the internal private IP address to a host in the Internet. The issue is described as follows.

 

The FW (200E) has an vlan, let say vlan 200 and IP range is 192.168.200.0/24. The logical interface on the FW for this network is 192.168.200.1.

 

When I assigned a PC to this VLAN, it has the IP 192.168.200.2. From this PC I can ping the Internet as normal.

 

However, If on the FW, I choose ping-option source 192.168.200.1, I can ping the WAN interface but could not ping the Internet. The weird situation is that both 192.168.200.1 and 192.168.200.2 are on the same VLAN, affected by the same policy, but 200.1 could not ping the Internet while 200.2 could.

 

Can anyone give some advice?

 

Thank you so much.

 

Stv

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    September 9, 2019

    Try "diag debug flow" to see why.

    Stv
    StvAuthor
    New Member
    September 9, 2019

    Hi Ede,

     

    Thank you for your advice.

     

    I ran the debug and execute ping with 01 repeat and got the result below. It does not provide much of information to consider.

     

     id=20085 trace_id=131 func=print_pkt_detail line=5347 msg="vd-root received a packet(proto=1, 10.250.4.1:23046->151.101.193.67:2048) from local. type=8, code=0, id=23046, seq=0." id=20085 trace_id=131 func=init_ip_session_common line=5506 msg="allocate a new session-1ffebb0f"

     

    The IP 10.250.4.1 is assigned on an logical interface. Have you got any further suggestion?

     

    Thank you.

    Stv

    emnoc
    emnoc
    New Member
    September 9, 2019

    What is your rule and if you have SNAT? I bet if you diag sniffer packet on the outside interface, your going out NOT-SNAT

     

    e.g

     

    diag sniffer packet wan1 "icmp and host 151.101.193.67"

     

    Ken Felix

    Terms & ConditionsAccessibility statement