Allowing ping

[R1chou]

Hello,

I have an internal IIS server with one site configured with the following address (for example) : https://toto.test.fr

The IP server is for example : 10.0.10.1

The public ip address is for example : 1.1.1.1

I created the following virtual IP

name : test external ip : 1.1.1.1

internal ip : 10.0.10.1

Port forwarding TCP : 443 to 443

Then I created my policy enabling all from external to access to test on service HTTPS.

It's working but I would like to know how to enable the ping to toto.test.fr because currently it's not working.

I tried to add a new virtual ip by selecting port forwarding ICMP and added ICMP+Ping  to my policy but it doesn't work.

Regards,

[ede_pfau · Accepted solution]

hi,

and welcome to the forums.

As ICMP / ping does not use ports, a port-forwarding VIP will not forward it. Make the VIP non-portforwarding, and limit the incoming services in the policy.

[ede_pfau · Accepted solution]

hi,

and welcome to the forums.

As ICMP / ping does not use ports, a port-forwarding VIP will not forward it. Make the VIP non-portforwarding, and limit the incoming services in the policy.

[R1chou]

Hi,

Thank you, the public ip address used in my VIP "test" is already used by another VIP forwarding port 88 to another server. I suppose that I can't use your solution, correct ?

Regards,

[Markus]

Did you have only one IP? If so, you can allow ping on your wan interface...

[rwpatterson]

That is correct. Unfortunately it is one or the other (port forwarding multiples or only non-port forwarding).

[ede_pfau · Accepted solution]

Yep, either use multiple port-forwarding VIPs on the same public address, or several public addresses for multiple non-portforwarding VIPs to different internal servers. You cannot combine one pf-VIP with one non-pf-VIP on the same public address.

Pinging the interface will tell you about the state of the firewall or WAN line, not about the internal server.

[R1chou]

Thanks everyone !