Issue Description
when ping from the server device to termimal device, the Ping packet drop on USG6650, but when Ping from the gateway of server 10.20.12.1 to terminal device, the Ping can pass.
when ping from 10.20.12.11 to 10.22.225.18, all packets drop. when ping from 10.20.12.1 to 10.22.225.28, all packets pass. Check on the firewall, the ICMP is allowed between the two subnets.
Handling Process
Ping from 10.20.12.11 to 10.22.225.28, and check firewall session on the USG6650, there is no session table.
Ping from 10.12.11.1 to 10.22.225.28, and check firewall session on the USG6650, there is the right session table and pass.
traffic count on the firewall, find out that when Ping from 10.20.12.11 to 10.225.28, the destination port is 68.
Root Cause
Root CauseThe issue is caused by the software V500R001C30SPC100, it is a software bug, When the ICMP go through USG6650 with desionation port 68, the USG firewall will consider it as the DHCP packet and drop it.
Solution
Upgrade the software to V500R001C30SPC600 and install patch V500R001SPH001.
