cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7212
Views
5
Helpful
5
Replies

Cannot Ping FTD gateway address

keithcclark71
Level 3
Level 3

I cannot ping from my host192.168.5.80  that is on the same subnet to the internal zone interface of the FTD 192.168.5.1 that is also addressed on the same subnet. I do not see my system in the FTD arp table. When SSH'd into the FTD interfaces say up with protocol up. This is a FMCv also which runs on ESXI and I see nothing wrong within ESXI virtual switch. I have another deployment and all internal hosts can ping the FTD gateway. Its just a straight up assigned IP address to the Ethernet/1/1 on the FTD no vlan definition etc

5 Replies 5

@keithcclark71 by default you should be able to ping the local interface IP address of the FTD, unless you've got platform settings configured to restrict ICMP?

 

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/platform_settings_for_firepower_threat_defense.pdf

 

Can ping your host from the FTD, you may need to turn off your local firewall on your PC.

Rob i got it resolved but still need to narrow down. If I put an unmanaged switch between my PC 192.168.5.80 and Inside Interface Ip 192.168.5.1 I cannot ping. However if I take my pc plug into managed unifi and inside from FTD into that same unifi switch i can ping. Unifi ports are all trunked by default. What is strange is I am not applying vlan to the interface but rather just placing an IP on the actual interface. I know untagged vlan 1 goes through the trunk by default so I believe this is why i am getting replies. For some reason it's not seeing my traffic through the unmanaged switch as untagged.

 

Also got another update thought you may like. I am setting up Meshed FTDs to replace 4 production ASA5505s. My initial plan was configuring FTD best I can then driving to location to replace production ASA with that FTD and hope all tunnels come up etc Glad I didn't do this I was way off. I have another customer that has a useable from static block so I created another tunnel to match on the ASA where the FMC is located then went to customer site with the FTD and cabled it up as additional layer 3 through there cable modem bridged router. So I get everything basically set can ping 8.8.8.8 so i know now my PAT is in place and have internet access and the tunnel does not friggin come up. I review both sides etc and I cant make changes to the FTD as im not tunneled into the subnet where the FMC is (I also put managed IP on the FTD from that same managed subnet lol) Gonna have to chjnge that Ip to the remote side tomorrow. Anyways launching ASDM etc no friggin tunnel, back n fourth between tunnel policy\proposal PSK , timers , NAT , ACL's man i have my head between my knees almost in tears at this point. I review the tunnel one more time before I off myself and notice FTD has reverse route enabled and ASA side does not. I set ASA side enabled cause I cant disable on the FTD side because i firstly don't have a tunnel to the management side and even if I did the management IP is part of the remote subnet where the FMC is and i'm not onsite where the FTD is but rather working from home.  Anyways the struggle is real man and my tunnel is now up. I had to generate interesting traffic which isn't really interesting when tunnel does not come up but after making that noted change I was very interested cause tunnel up now thank god. .  So now I can be more confident that when I drop into actual production it will work but probably wont lol I'm sure you guys can relate thanks for all the help

. However if I take my pc plug into managed unifi and inside from FTD into that same unifi switch i can ping.<<- this indication that there is issue with VLAN is you config the FTD with sub interface not as router port.

See attached. Not VLAN member that I can see nor is it Sub interface. I cannot ping it with unmanaged switch between my PC and the interface. Windows firewall nothing to do with etc. Ill look into more tomorrow see what deal is

the host have OS firewall so the ping is failed 

Review Cisco Networking for a $25 gift card