Could not ping from an internal private IP to a destination in the Internet

[Stv]

Hello community,

I have a weird situation where I could not ping from the internal private IP address to a host in the Internet. The issue is described as follows.

The FW (200E) has an vlan, let say vlan 200 and IP range is 192.168.200.0/24. The logical interface on the FW for this network is 192.168.200.1.

When I assigned a PC to this VLAN, it has the IP 192.168.200.2. From this PC I can ping the Internet as normal.

However, If on the FW, I choose ping-option source 192.168.200.1, I can ping the WAN interface but could not ping the Internet. The weird situation is that both 192.168.200.1 and 192.168.200.2 are on the same VLAN, affected by the same policy, but 200.1 could not ping the Internet while 200.2 could.

Can anyone give some advice?

Thank you so much.

Stv

[ede_pfau]

Try "diag debug flow" to see why.

[Stv]

Hi Ede,

Thank you for your advice.

I ran the debug and execute ping with 01 repeat and got the result below. It does not provide much of information to consider.

 id=20085 trace_id=131 func=print_pkt_detail line=5347 msg="vd-root received a packet(proto=1, 10.250.4.1:23046->151.101.193.67:2048) from local. type=8, code=0, id=23046, seq=0." id=20085 trace_id=131 func=init_ip_session_common line=5506 msg="allocate a new session-1ffebb0f"

The IP 10.250.4.1 is assigned on an logical interface. Have you got any further suggestion?

Thank you.

Stv

[emnoc]

What is your rule and if you have SNAT? I bet if you diag sniffer packet on the outside interface, your going out NOT-SNAT

e.g

diag sniffer packet wan1 "icmp and host 151.101.193.67"

Ken Felix