Firewall on subinterfaces

liyajun · Created Jun 25, 2018 14:11:45

Posted by asmolarek at 2018-06-25 13:58 Posted by StarOfWest at 2018-06-25 13:58 it's possible to tell which is the source IP and destination ...

ping from 10.10.14.100 to 10.10.10.1, the ip packet will not go out through G0/0/1.10, that why there's no session.
if a packet destination is router itself, we should use local zone.
in this case, please try firewall interzone trust local

TTTony · Created Jun 25, 2018 13:22:19

Can you try to set up "firewall interzone trust mgmt " swap the zone :)

Poland_Arek · Created Jun 25, 2018 13:38:27

Yes, same result.

StarOfWest · Created Jun 25, 2018 13:50:16

it's possible to tell which is the source IP and destination IP of the ping?

According to your configuration you allow traffic from 10.10.14.1 towards any host from 10.10.10.0/24 subnet and reverse. Anything else than this, is denied.

Please provide exact source IP and destination IP and checked whether the router is generating any session towards that destination. Run the following command while you are pinging.
display firewall session protocol icmp destination 10.10.14.x verbose

Poland_Arek · Created Jun 25, 2018 13:58:05

This post was last edited by asmolarek at 2018-06-25 14:02.

Posted by StarOfWest at 2018-06-25 14:02 it's possible to tell which is the source IP and destination IP of the ping? According to your confi ...

I ping router IP (10.10.10.1) from source IP 10.10.14.100.

I don't see any firewall session when I pinging.

OK, I see that I have to configure interzone mgmt to local zone.

liyajun · Created Jun 25, 2018 14:11:45

Posted by asmolarek at 2018-06-25 13:58 Posted by StarOfWest at 2018-06-25 13:58 it's possible to tell which is the source IP and destination ...

ping from 10.10.14.100 to 10.10.10.1, the ip packet will not go out through G0/0/1.10, that why there's no session.
if a packet destination is router itself, we should use local zone.
in this case, please try firewall interzone trust local

StarOfWest · Created Jun 25, 2018 14:25:22

Posted by asmolarek at 2018-06-25 08:58 Posted by StarOfWest at 2018-06-25 08:58 it's possible to tell which is the source IP and destination ...

Since you ping the router IP address, yes, you have to define a interzone policy towards local zone.

Firewall on subinterfaces

Best answer

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

Firewall on subinterfaces

Best answer

Third Party’s Trade Secret

My Followers