From dhcp user static ip is not reachable to usg6600
[Problem Analysis]
topo：
PC (getting IP from DHCP server) à Cisco Switch (172.16.10.3) à USG6600 (172.16.10.1/172.16.30.1) à S5720 (172.16.30.2) à Server (172.16.11.87)
use the command of Firewalls session table check the session is empty
d f s t v s i 172.16.11.81
[Root Cause]
The port g1/0/2 and g1/0/3 donot add to the trust zone ,leadding to the session is cannot built up
add interface (Security zone view) <http://support.huawei.com/hedex/pages/EDOC1000154459AEH0731H/06/EDOC1000154459AEH0731H/06/resources/cli/add_interface.html?ft=99&id=add_interface&keyword=zone&text=add%25252Binterface%25252B%25252528Security%25252B%2525253Cb%2525253Ezone%2525253C%2525252Fb%2525253E%25252Bview%25252529&docid=EDOC1000154459>
[Solution Description]
The main issue is from PC cannot ping server. From PC can ping until S5720. After login into the S5720, we find that the switch cannot ping the server. However, from the USG we can ping the server successfully.
[C-USG6650-FW]firewall zone trust
[FICUS-NOC-USG6650-FW-zone-trust]add inter g1/0/2
[FICUS-NOC-USG6650-FW-zone-trust]add inter g1/0/3
[C-USG6650-FW]return
<xxxxx>save
Check the session is built up：OK
icmp VPN: public --> public Vlan: 100 172.16.11.87:1 --> 172.16.10.192:2048
0.
