topic Re: FirePower1010 routing problems in Network Security

FirePower1010 routing problems

ratemaki — Fri, 11 Sep 2020 09:33:03 GMT

Hi,

I've the FirePower1010 versions 6.5.0.2.

There are several interfaces:

- Ethernet 1/2 with address 192.168.24.245 and is belong by inside_zone

- Ethernet 1/4 with address 192.168.23.245 and is belong by video_zone

But I cann't ping 192.168.23.245 from PC with ip 192.168.24.124. The ip 192.168.24.245 is default gateway on PC.

Whireshark from PC shows messege "No response found!" when I try to ping 192.168.23.245.

Tracer from FP1010 shows "Drop-reason: (no-route)":

There is routing table FP1010:

In policies is rule allow traffic from inside_zone to video_zone.

Can anyone help me? please.

Re: FirePower1010 routing problems

Rob Ingram — Fri, 11 Sep 2020 09:58:47 GMT

Hi,

That is to be expected and won't work by design. The FTD will only respond to ICMP traffic sent to the interface that traffic comes in on, you cannot send ICMP traffic through an interface to a far interface.

Ping "through" the FTD to another devices, such as a PC, you will of course need firewall rules to permit this.

HTH

Re: FirePower1010 routing problems

ratemaki — Fri, 11 Sep 2020 10:18:26 GMT

Thanks for answer!

But when I try to ping through the FTD to another devices it's no work too...

Wireshark shows the same message "No response found!",

trace shows:

For clear: it shows output-interface: inside_3 (it's Ethernet1/3) because I ping host in 172.1.0.0/24 network and ip address Ethernet1/3 is 172.1.0.1. It's different that I posted in the first message because there are not yet hosts in 192.168.23.0/24.

There is rule permit traffic also.

Re: FirePower1010 routing problems

Rob Ingram — Fri, 11 Sep 2020 10:25:38 GMT

Is there a firewall enabled on the remote device you are trying to ping?

Do you have NAT configured?

What is the full output of that packet-tracer, please provide the output.

Re: FirePower1010 routing problems

ratemaki — Fri, 11 Sep 2020 11:16:28 GMT

Problem is solved!

The reason is an incorrect network configuration of the host (in the network 172.1.0.0/24) and, as a result, traffic asymmetry.

@Rob Ingram Thank you for help!

Re: FirePower1010 routing problems

Ruben Cocheno — Fri, 11 Sep 2020 13:19:09 GMT

@ratemaki

Check for asymmetric routing, it is when the flow of packets in one direction passes through a different interface than that used for the return path.

Re: FirePower1010 routing problems

ratemaki — Fri, 11 Sep 2020 14:08:18 GMT

I created a nat for traffic from the 192.168.24.0 / 24 network to the 172.1.0.0 / 24 network as a temporary solution.

I'll chek again after reconfiguration the host.

You can also create a bypass rule if you have asymmetric routing.